njRat PE Executable malware analysis – 804535fc5f5c

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 3 files

EXE804535fc5f5c8c802ebd2502c351b57cnjRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	SklyTXhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	fujNFEhuhuhuhuhuhuhuhuhuhuhu
Install	fhuhuhuhu
BDOS	fhuhuhuhu
Anti-VM	fhuhuhuhu
Install File	updhuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	88.2huhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	Asynchuhuhuhuhuhuhu
Delay	3huhuhuhu
Group	Dehuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	ysJBLicFCgZq
Full Name	ysJBLicFCgZq
EntryPoint	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Scope Name	ysJBLicFCgZq
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	syrogenerator
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	120
Main Method	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::nRGrXhrJluM call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean PLuSPdcDzppK.vrhVMONQropgA::TWhnJPiGIHIJKh() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean DjgdyfteXQTH.yrcoTRrhCLLNJ::tucSdYJIKHjQEPW() brtrue IL_0043: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Void DjgdyfteXQTH.iVCbbhqsoyZjTsrl::VueCBpDbYUmnmh() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Void ROgeBRnOuebPW.oQKsqUpSJhuoh::vFMLouLWkYk() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Boolean DjgdyfteXQTH.JSWTthSteHL::bQpruWmHtkgR() brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Void DjgdyfteXQTH.ZPzwaZGSXo::BFmWVIqnIDqozy() call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean axhTdnWQhBDTksE.UsbsGvBITN::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void axhTdnWQhBDTksE.UsbsGvBITN::XOZPepTsEskLQoM() call System.Void axhTdnWQhBDTksE.UsbsGvBITN::ZHofSQKsYJ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	ysJBLicFCgZq
Full Name	ysJBLicFCgZq
EntryPoint	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Scope Name	ysJBLicFCgZq
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	syrogenerator
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	120
Main Method	System.Void PLuSPdcDzppK.UQHmKFGmsbcKeo::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::nRGrXhrJluM call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean PLuSPdcDzppK.vrhVMONQropgA::TWhnJPiGIHIJKh() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean DjgdyfteXQTH.yrcoTRrhCLLNJ::tucSdYJIKHjQEPW() brtrue IL_0043: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::WuOknDSiRMWq call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Void DjgdyfteXQTH.iVCbbhqsoyZjTsrl::VueCBpDbYUmnmh() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::XONAikmueQZyfBT call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Void ROgeBRnOuebPW.oQKsqUpSJhuoh::vFMLouLWkYk() ldsfld System.String PLuSPdcDzppK.vrhVMONQropgA::oegmIuZzGtPd call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Boolean DjgdyfteXQTH.JSWTthSteHL::bQpruWmHtkgR() brfalse IL_0089: call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() call System.Void DjgdyfteXQTH.ZPzwaZGSXo::BFmWVIqnIDqozy() call System.Void DjgdyfteXQTH.JSWTthSteHL::vlswcDTGxDQI() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean axhTdnWQhBDTksE.UsbsGvBITN::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void axhTdnWQhBDTksE.UsbsGvBITN::XOZPepTsEskLQoM() call System.Void axhTdnWQhBDTksE.UsbsGvBITN::ZHofSQKsYJ() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

SklyTXhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

88.2huhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

Asynchuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential