Malicious
PE Executable
MD5: 0439fe7734490a8e40c6b13b4ce5be35
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 55 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73
- MD5
- 0439fe7734490a8e40c6b13b4ce5be35
- Verdict
- Malicious
- File type
- PE Executable · 55 KB
- Family
- njRat
- Category
- RAT
- C2 (defanged)
5[.]tcp[.]cpolar[.]cn
Cite this report: https://app.malva.re/sha256/49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73
Related njRat samples
- f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 2026-10-26
- 94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 2026-10-25
- d65e2eb84444c69bc58ea794056f7d2b00f517a484efbf62f6e10e4bfc15c585 2026-10-21
- 6bba006161f3d18b18495b329961b76ec1a6ad6e7595c6b74e86f961049d5370 2026-10-20
- 3464447f8b816cfb5d61575cf343971394e5f4834adb2b7d3964c305dbb18182 2026-10-20
- d90ec6fb084a6ab655146a8380cfbc94b0732f427eb820971284af43a4a7b732 2026-10-19
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
56.32 KB · 56,320 B
First seen
2026-10-27 17:15 · yesterday
Last seen
2026-10-27 17:15 · yesterday
Last analysis
2026-10-27 17:15 · yesterday
Hashes
MD5
0439fe7734490a8e40c6b13b4ce5be35
Sha1
fccc067f1d2b1700b371de586a6bb4da43c69ea6
Sha256
49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73
Sha384
b543299622861d7823424c1db89657c6d401381f827825993f87203cd8909eceb883e071aa1e582e487996d93f1fd9f8
Sha512
12cef046699661aaf3f5fcd06659358272c43c5cbc934649ee4daaa5cc9a51fbe58746e89602686f4c2b1a55a9334b741ab730ca8e3986d5bf47c265a582cc8e
SSDeep
1536:CDCUbsDnyNho6JypySDxwsNMDGXExI3pmam:qCEsDn4o6I4SDxwsNMDGXExI3pm
TLSH
64431744BFEA4A05E2BD8F3468F655150A34BA63E532EB1E4CD668DB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE0439fe7734490a8e40c6b13b4ce5be35njRat
Structure
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 5.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | e898cchuhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | Vihuhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
5.tcphuhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential