// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

function detect() {

    if (!PE.isNET()) return null;

    if (validateReferences(
            isPositive = true,
            references = [
                "System.Net.Sockets",
                "System.IO.Compression"
            ]
        )) {
        return null;
    }

    if (checkForNative(
            type = "NjRAT", edition = "0.7D Green Edition", stubReferences = [
                "w",
                "System.Drawing",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll", "capGetDriverDescriptionA",
                "kernel32",
                "KERNEL32.DLL",
                "ntdll",
                "user32", "GetWindowText", "EnumChildWindows", "SendMessage", "GetWindowTextLength",
                "user32.dll",
                "winmm.dll"
            ],
            objectsToValidate = ["A", "kl", "mgr", "OK"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "NjRAT", edition = "0.7D Lime Edition", stubReferences = [
                "Stub",
                "System.Drawing",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll", "capGetDriverDescriptionA",
                "kernel32",
                "ntdll", "NtSetInformationProcess",
                "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState",
                "user32.dll",
                "wintrust.dll"
            ],
            objectsToValidate = ["Lime", "kl", "StartNow"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "NjRAT", edition = "0.7D", stubReferences = [
                "Stub",
                "System.Drawing",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll", "capGetDriverDescriptionA",
                "kernel32",
                "ntdll", "NtSetInformationProcess",
                "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState",
                "user32.dll"
            ],
            objectsToValidate = ["A", "kl", "OK"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "NjRAT", edition = "0.11G-0.12G", stubReferences = [
                "k",
                "System.Drawing",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll", "capGetDriverDescriptionA",
                "kernel32",
                "ntdll", "NtsetInformationProcess",
                "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState", "GetForegroundWindow", "GetWindowTextLengthA", "GetAsyncKeyState",
                "user32.dll"
            ],
            objectsToValidate = ["A", "kl", "OK"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "NjRAT", edition = "0.7D Danger Edition", stubReferences = [
                "Stub",
                "System.Drawing",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll", "capGetDriverDescriptionA",
                "Kernel32.dll",
                "KERNEL32.DLL",
                "user32", "GetWindowText", "EnumChildWindows", "GetForegroundWindow", "SendMessage", "GetWindowTextLength", "SetWindowPos",
                "user32.dll",
                "winmm.dll",
            ],
            objectsToValidate = ["e", "A", "CompDir", "connect"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "NjRAT", edition = "0.7D Golden Edition", stubReferences = [
                "Stub",
                "System.Drawing",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll",
                "kernel32",
                "Kernel32.dll",
                "ntdll", "NtSetInformationProcess",
                "user32",
                "user32.dll", "GetForegroundWindow", "GetWindowTextA",
                "winmm.dll",
            ],
            objectsToValidate = ["A", "OK", "connect"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "XWorm", edition = "3.0-5.0", stubReferences = [
                "System.Core",
                "System.Drawing",
                "System.Management",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "avicap32.dll", "capCreateCaptureWindowA",
                "kernel32.dll", "SetThreadExecutionState",
                "user32.dll", "GetForegroundWindow", "GetWindowText",
            ],
            objectsToValidate = ["Main", "ClientSocket", "Uninstaller"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "VenomRAT", edition = "6.X", stubReferences = [
                "Microsoft.CSharp",
                "System.Core",
                "System.Drawing",
                "System.Management",
                "System.Windows.Forms",
                "System.Runtime.InteropServices",
                "kernel32.dll", "SetThreadExecutionState",
                "ntdll.dll", "RtlSetProcessIsCritical",
                "user32.dll", "GetWindowText", "GetForegroundWindow",
            ],
            objectsToValidate = ["Aes256", "BytesTools", "Program"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative(
            type = "RevengeRAT", edition = "0.3", stubReferences = [
                "System.Management",
                "System.Windows.Forms",
                "avicap32.dll", "capGetDriverDescriptionA",
                "kernel32",
                "psapi", "EmptyWorkingSet",
                "user32", "GetWindowText"
            ],
            objectsToValidate = ["Execute", "Send", "data"],
            isVbNet = true
        )) {
        return null;
    }

    if (checkForNative( // Universal NjRAT detect
            type = "NjRAT", edition = "Unknown", stubReferences = [
                "System.Drawing",
                "System.Windows.Forms",
                "GetForegroundWindow",
                "System.Runtime.InteropServices",
                "System.Security.Cryptography",
                "GetWindowText",
                "avicap32.dll",
                "A",
                "OK",
                "kl",
            ],
            objectsToValidate = ["System"],
            isVbNet = true
        )) {
        return null;
    }
}

function checkForNative(type, edition, stubReferences, objectsToValidate, isVbNet) {
    if (validateReferences( // Checks for references
            isPositive = true,
            references = stubReferences
        )) {
        return false;
    }

    var isObfuscated = false;
    if (validateReferences( // Checks for naming obfuscation
            isPositive = true,
            references = objectsToValidate
        )) {
        isObfuscated = true;
    }

    if (isVbNet) { // Checks for the required presence of the VB NET Standard Library
        if (!PE.isNETStringPresent("Microsoft.VisualBasic")) {
            return false;
        }
    }

    _setResult("malware", type, edition, (isObfuscated ? "Obfuscated" : ""));
    return true;
}

function validateReferences(isPositive, references) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive) {
            if (!PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        }
    }
    return false;
}