Malicious
Malicious

03de5ddcf7e6f7d06ac0b9a0e5aeeb59

Share on LinkedIn
Print
PE Executable
MD5: 03de5ddcf7e6f7d06ac0b9a0e5aeeb59
Size: 44.03 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 43 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 2 embedded or derived files and a malware configuration (njRAT config.). It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67
MD5
03de5ddcf7e6f7d06ac0b9a0e5aeeb59
Verdict
Malicious
File type
PE Executable · 43 KB
Family
njRat
Category
RAT

Cite this report: https://app.malva.re/sha256/f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
44.03 KB · 44,032 B
First seen
2026-10-26 14:15 · 9 hours ago
Last seen
2026-10-26 14:15 · 9 hours ago
Last analysis
2026-10-26 14:15 · 9 hours ago
Hashes
MD5 03de5ddcf7e6f7d06ac0b9a0e5aeeb59 Sha1 f853e90473a161d69c7c513b0b23494bb20a6b54 Sha256 f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 Sha384 d4955b0525f4c3fab1402fc7d5a6226c4a545add7c7ed04faa2000b599095268b725340c319293944ff3cbdb6828cba1 Sha512 3e3a1a6b15772bc87bcaee4ecb6249452f2ecf9ba466d8bb60188f3392602c028cb7c0f617dd578936e227ecf80883a7657f0f333d1cc7674487db63db4dda03 SSDeep 384:DZyq4T4olYxOoyi0I7SycuENK8FQ5zgIij+ZsNO3PlpJKkkjh/TzF7pWn4mgreTn:ttouIli0gSjLKaauXQ/oJC+L TLSH F213D78CB794E174D5FF8BF1B492B2990B71A01BA802D30F99F254D94B73AC09611EE7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

1 malicious · 3 files
EXE03de5ddcf7e6f7d06ac0b9a0e5aeeb59njRat
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] Dllhuhuhuhu
cnc_host [H] Ni50Y3huhuhuhuhuhuhu
icn #huhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
RegistrySt Fhuhuhuhu
xDlol1 Javhuhuhuhu
Sleep Fhuhuhuhu
Sleep1 1huhuhuhu
reg_key [RG] Windhuhuhuhuhuhuhu
task [Task] Fhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
Hide Fhuhuhuhu
HP Thuhuhuhu
SPR fhuhuhuhu
victim_name [VN] Hahuhuhuhu
version [VR] Njrat huhuhuhuhuhuhuhuhuhuhu
splitter [Y] |Hhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Stub.OK.j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
436
Main Method
System.Void Stub.OK.j.A::main()
Main IL Instruction Count
20
Main IL 
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runx
ldnull <null>
ldftn System.Void Stub.OK.j.A::timx_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thx
ldsfld System.Threading.Thread Stub.OK.j.A::thx
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runy
ldnull <null>
ldftn System.Void Stub.OK.j.A::timy_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thy
ldsfld System.Threading.Thread Stub.OK.j.A::thy
callvirt System.Void System.Threading.Thread::Start()
call System.Void Stub.OK.j.OK::ko()
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Stub.OK.j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
436
Main Method
System.Void Stub.OK.j.A::main()
Main IL Instruction Count
20
Main IL 
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runx
ldnull <null>
ldftn System.Void Stub.OK.j.A::timx_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thx
ldsfld System.Threading.Thread Stub.OK.j.A::thx
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runy
ldnull <null>
ldftn System.Void Stub.OK.j.A::timy_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thy
ldsfld System.Threading.Thread Stub.OK.j.A::thy
callvirt System.Void System.Threading.Thread::Start()
call System.Void Stub.OK.j.OK::ko()
ret <null>

CnC CNCmalicious
Ni50Y3huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙