njRat PE Executable malware analysis – 86c0b5372b34

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 3 files

EXE86c0b5372b347af86d7c1a9f272114ecnjRat

Structure

BINResources

Config. Field	Value
Key (AES_256)	NTRGOVhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	ggK7l2huhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	micrhuhuhuhuhuhuhu
Install-Folder	%Aphuhuhuhu
Mutex	k5p2huhuhuhu
Version	0huhuhuhu
Delay	3huhuhuhu
Group	rhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	vBkvnxcKlVsj
Full Name	vBkvnxcKlVsj
EntryPoint	System.Void nVMdfQfJZk.hsmXbqavrE::Main()
Scope Name	vBkvnxcKlVsj
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	sdq
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void nVMdfQfJZk.hsmXbqavrE::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::zPwRxGSqlSGwG call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::ScheIgpgjqSbkz() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean daTHOuTeGdEBS.gLavTeOyyfOsG::FHAYZZfosYjNE() brtrue IL_0043: ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KfyCfhYnnyohvxKx ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KfyCfhYnnyohvxKx call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KdyBYGZFfSaztnh call System.Void daTHOuTeGdEBS.QQGCokUUmZTLN::NewoTiEQWvpBhQ() ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KdyBYGZFfSaztnh call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::dKMRyhRRKXHB call System.Void jyukMnuZrV.ifpGElDzVQT::EBiMBkrBnE() ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::dKMRyhRRKXHB call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void daTHOuTeGdEBS.hEZSSfMVIukxrl::DiBvbQsgiQjl() call System.Boolean daTHOuTeGdEBS.hEZSSfMVIukxrl::fsAWuEvBGeqxVV() brfalse IL_0089: call System.Void daTHOuTeGdEBS.hEZSSfMVIukxrl::DiBvbQsgiQjl() call System.Void daTHOuTeGdEBS.GqzgdBxRwUZ::ZfptmHHdDXYRDm() call System.Void daTHOuTeGdEBS.hEZSSfMVIukxrl::DiBvbQsgiQjl() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean kgzcsfestOx.JnqWOUzVTPivw::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void kgzcsfestOx.JnqWOUzVTPivw::szRKHLoeGczdB() call System.Void kgzcsfestOx.JnqWOUzVTPivw::vjLvEZDUVIaG() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	vBkvnxcKlVsj
Full Name	vBkvnxcKlVsj
EntryPoint	System.Void nVMdfQfJZk.hsmXbqavrE::Main()
Scope Name	vBkvnxcKlVsj
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	sdq
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void nVMdfQfJZk.hsmXbqavrE::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::zPwRxGSqlSGwG call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::ScheIgpgjqSbkz() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean daTHOuTeGdEBS.gLavTeOyyfOsG::FHAYZZfosYjNE() brtrue IL_0043: ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KfyCfhYnnyohvxKx ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KfyCfhYnnyohvxKx call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KdyBYGZFfSaztnh call System.Void daTHOuTeGdEBS.QQGCokUUmZTLN::NewoTiEQWvpBhQ() ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::KdyBYGZFfSaztnh call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::dKMRyhRRKXHB call System.Void jyukMnuZrV.ifpGElDzVQT::EBiMBkrBnE() ldsfld System.String nVMdfQfJZk.vbatrOfPAqfTKxNYaZ::dKMRyhRRKXHB call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void daTHOuTeGdEBS.hEZSSfMVIukxrl::DiBvbQsgiQjl() call System.Boolean daTHOuTeGdEBS.hEZSSfMVIukxrl::fsAWuEvBGeqxVV() brfalse IL_0089: call System.Void daTHOuTeGdEBS.hEZSSfMVIukxrl::DiBvbQsgiQjl() call System.Void daTHOuTeGdEBS.GqzgdBxRwUZ::ZfptmHHdDXYRDm() call System.Void daTHOuTeGdEBS.hEZSSfMVIukxrl::DiBvbQsgiQjl() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean kgzcsfestOx.JnqWOUzVTPivw::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void kgzcsfestOx.JnqWOUzVTPivw::szRKHLoeGczdB() call System.Void kgzcsfestOx.JnqWOUzVTPivw::vjLvEZDUVIaG() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

Key (AES_256) MUTEXmalicious

NTRGOVhuhuhuhuhuhuhuhuhuhuhu

Mutex MUTEXmalicious

k5p2huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential