Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
3 malicious · 22 files
EXEe0bf9265ae4e4245a953f8fd8e2269e1njRat
Structure
EXE[Base64-Block @0x0003A10D]njRat
Structure
BINResources
BINResources
BIN.Net Resources
BINFx9PnxL8E9D0yGhgbM.SLZDXh7WgO1BGYd5F8
BINfof0cY9GfaZOtiSwYX.HMtPQjlAavN7gsvnQF
BIN8x6uD68ryeaMkshdMT.VlEwyBKKrgoDMsV3jL
BINClassLibrary2.Resources.resources
EXEcurso
Structure
BINResources
BIN.Net Resources
BINClassLibrary2.g.resources
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
| Config. Field | Value |
|---|---|
| Mutex | d1tczhuhuhuhuhuhuhu |
| Hosts | jholychuhuhuhuhuhuhu |
| Port | 7huhuhuhu |
| KEY | <12huhuhuhu |
| USBNM | <Xwhuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | PDB Path: ClassLibrary2.pdb |
| Module Name | ClassLibrary2.dll |
| Full Name | ClassLibrary2.dll |
| Scope Name | ClassLibrary2.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | ClassLibrary2 |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 43 |
| Main Method | Not found or no body |
| Module Name | ClassLibrary2.dll |
| Full Name | ClassLibrary2.dll |
| Scope Name | ClassLibrary2.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | ClassLibrary2 |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 43 |
| Main Method | Not found or no body |
Mutex
MUTEXmalicious
d1tczhuhuhuhuhuhuhu
CnC
CNCmalicious
jholychuhuhuhuhuhuhu
Port
PORTmalicious
7huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential