Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

The file cc604d6b6a1e0e9d8ca76854a7692252 is a PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 2 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Inconclusive
File type
PE Executable
Family
njRat
Category
RAT

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Detection
Symbol obfuscation
Low

3 files
EXEcc604d6b6a1e0e9d8ca76854a7692252njRat
Structure

Name Value
Info 
PDB Path: C:\Users\PAT\Desktop\tai lieu hoc tap\AsyncRAT_1\AsyncRAT-C#\Client\obj\Debug\Stub.pdb
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
111
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
56
Main IL 
nop <null>
nop <null>
ldsfld System.String Client.Settings::Install
call System.Boolean System.Convert::ToBoolean(System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0016: ldsfld System.String Client.Settings::BDOS
call System.Void Client.Install.NormalStartup::Install()
nop <null>
ldsfld System.String Client.Settings::BDOS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0029: ldc.i4.0
call System.Boolean Client.Helper.Methods::IsAdmin()
br.s IL_002A: stloc.1
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0034: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.ProcessCritical::Set()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
nop <null>
leave.s IL_0042: br.s IL_0074
pop <null>
nop <null>
nop <null>
leave.s IL_0042: br.s IL_0074
br.s IL_0074: ldc.i4.1
nop <null>
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0060: nop
nop <null>
call System.Void Client.Connection.ClientSocket::Reconnect()
nop <null>
call System.Void Client.Connection.ClientSocket::InitializeClient()
nop <null>
nop <null>
nop <null>
leave.s IL_0068: ldc.i4 5000
pop <null>
nop <null>
nop <null>
leave.s IL_0068: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.3 <null>
br.s IL_0044: nop
An error has occurred. This application may no longer respond until reloaded. Reload 🗙