njRat PE Executable malware analysis – 6bfbc1e3bd23

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE6bfbc1e3bd23ae03605e53f22349bb4fnjRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	NXdBelhuhuhuhuhuhuhuhuhuhuhu
Ports	1huhuhuhu
Hosts	45.2huhuhuhuhuhuhu
Version	0huhuhuhu
Install	fhuhuhuhu
Install-Folder	%Aphuhuhuhu
Install File	souhuhuhuhu
Mutex	1UDYhuhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	UFJw3Fhuhuhuhuhuhuhuhuhuhuhu
Anti-VM	thuhuhuhu
PasteBin	nhuhuhuhu
BDOS	thuhuhuhu
Delay	3huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	LFRLwxlEWaK
Full Name	LFRLwxlEWaK
EntryPoint	System.Void HjJwJyMsqLgI.upohqsgcsAKr::Main()
Scope Name	LFRLwxlEWaK
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void HjJwJyMsqLgI.upohqsgcsAKr::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::MlrrzhWSCyPwyxR call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean HjJwJyMsqLgI.OyKXzvdgVfCF::MimZTeXXiuKETNB() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean itDrkdadYgJZRm.xYSZNsyTDoDEaYV::PTeXFJTbTBIPH() brtrue IL_0043: ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::wMPjZUElQFWbZSr ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::wMPjZUElQFWbZSr call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::jTYpCkUEojKc call System.Void itDrkdadYgJZRm.tKJXJkAnZcLDCDp::XiLrcYCClyG() ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::jTYpCkUEojKc call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::DGxFysAkCS call System.Void uSnKHAobFbAYz.GoXQbVbjgHHLij::IkrhXagzopb() ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::DGxFysAkCS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void itDrkdadYgJZRm.wrDsPybKrOMl::DWcBRTQJMid() call System.Boolean itDrkdadYgJZRm.wrDsPybKrOMl::VhWpZfDkuGVc() brfalse IL_0089: call System.Void itDrkdadYgJZRm.wrDsPybKrOMl::DWcBRTQJMid() call System.Void itDrkdadYgJZRm.RzrzsdTiobdh::qTKsgRNrbHRd() call System.Void itDrkdadYgJZRm.wrDsPybKrOMl::DWcBRTQJMid() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean pXKJqNMHiKfAMzyp.nuHuyajEqvho::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void pXKJqNMHiKfAMzyp.nuHuyajEqvho::QGmAGJkLftLA() call System.Void pXKJqNMHiKfAMzyp.nuHuyajEqvho::cwjnADxteGVeZWlFe() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	LFRLwxlEWaK
Full Name	LFRLwxlEWaK
EntryPoint	System.Void HjJwJyMsqLgI.upohqsgcsAKr::Main()
Scope Name	LFRLwxlEWaK
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AsyncClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void HjJwJyMsqLgI.upohqsgcsAKr::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::MlrrzhWSCyPwyxR call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean HjJwJyMsqLgI.OyKXzvdgVfCF::MimZTeXXiuKETNB() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean itDrkdadYgJZRm.xYSZNsyTDoDEaYV::PTeXFJTbTBIPH() brtrue IL_0043: ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::wMPjZUElQFWbZSr ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::wMPjZUElQFWbZSr call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::jTYpCkUEojKc call System.Void itDrkdadYgJZRm.tKJXJkAnZcLDCDp::XiLrcYCClyG() ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::jTYpCkUEojKc call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::DGxFysAkCS call System.Void uSnKHAobFbAYz.GoXQbVbjgHHLij::IkrhXagzopb() ldsfld System.String HjJwJyMsqLgI.OyKXzvdgVfCF::DGxFysAkCS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void itDrkdadYgJZRm.wrDsPybKrOMl::DWcBRTQJMid() call System.Boolean itDrkdadYgJZRm.wrDsPybKrOMl::VhWpZfDkuGVc() brfalse IL_0089: call System.Void itDrkdadYgJZRm.wrDsPybKrOMl::DWcBRTQJMid() call System.Void itDrkdadYgJZRm.RzrzsdTiobdh::qTKsgRNrbHRd() call System.Void itDrkdadYgJZRm.wrDsPybKrOMl::DWcBRTQJMid() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean pXKJqNMHiKfAMzyp.nuHuyajEqvho::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void pXKJqNMHiKfAMzyp.nuHuyajEqvho::QGmAGJkLftLA() call System.Void pXKJqNMHiKfAMzyp.nuHuyajEqvho::cwjnADxteGVeZWlFe() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Ports PORTmalicious

1huhuhuhu

CnC CNCmalicious

45.2huhuhuhuhuhuhu

Embedded Resources UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential