Malicious
Malicious

0439fe7734490a8e40c6b13b4ce5be35

PE Executable
MD5: 0439fe7734490a8e40c6b13b4ce5be35
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 55 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73
MD5
0439fe7734490a8e40c6b13b4ce5be35
Verdict
Malicious
File type
PE Executable · 55 KB
Family
njRat
Category
RAT
C2 (defanged)
5[.]tcp[.]cpolar[.]cn

Cite this report: https://app.malva.re/sha256/49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
56.32 KB · 56,320 B
First seen
2026-10-27 17:15 · yesterday
Last seen
2026-10-27 17:15 · yesterday
Last analysis
2026-10-27 17:15 · yesterday
Hashes
MD5 0439fe7734490a8e40c6b13b4ce5be35 Sha1 fccc067f1d2b1700b371de586a6bb4da43c69ea6 Sha256 49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73 Sha384 b543299622861d7823424c1db89657c6d401381f827825993f87203cd8909eceb883e071aa1e582e487996d93f1fd9f8 Sha512 12cef046699661aaf3f5fcd06659358272c43c5cbc934649ee4daaa5cc9a51fbe58746e89602686f4c2b1a55a9334b741ab730ca8e3986d5bf47c265a582cc8e SSDeep 1536:CDCUbsDnyNho6JypySDxwsNMDGXExI3pmam:qCEsDn4o6I4SDxwsNMDGXExI3pm TLSH 64431744BFEA4A05E2BD8F3468F655150A34BA63E532EB1E4CD668DB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

1 malicious · 2 files
EXE0439fe7734490a8e40c6b13b4ce5be35njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 5.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Thuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] e898cchuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
539
Main Method
System.Void j.A::main()
Main IL Instruction Count
2
Main IL 
call System.Void j.OK::ko()
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
539
Main Method
System.Void j.A::main()
Main IL Instruction Count
2
Main IL 
call System.Void j.OK::ko()
ret <null>

CnC CNCmalicious
5.tcphuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 2 files
EXE0439fe7734490a8e40c6b13b4ce5be35njRat
Structure

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 5.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Thuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] e898cchuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

CnC CNCmalicious
5.tcphuhuhuhuhuhuhu
0439fe7734490a8e40c6b13b4ce5be35
Port PORTmalicious
1huhuhuhu
0439fe7734490a8e40c6b13b4ce5be35
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙