Malicious
PE Executable
MD5: 0aa86015d4391d17cbb7e60ef13a25a7
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 55 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- cf22bd8e3ea7ec65e7537b4424ea6756d455f6a2aa0db6bf4e2c97bd2f776c63
- MD5
- 0aa86015d4391d17cbb7e60ef13a25a7
- Verdict
- Malicious
- File type
- PE Executable · 55 KB
- Family
- njRat
- Category
- RAT
- C2 (defanged)
8[.]tcp[.]cpolar[.]cn
Cite this report: https://app.malva.re/sha256/cf22bd8e3ea7ec65e7537b4424ea6756d455f6a2aa0db6bf4e2c97bd2f776c63
Related njRat samples
- ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e 2026-11-03
- 1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242 2026-11-02
- 49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73 2026-10-27
- f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 2026-10-26
- 94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 2026-10-25
- d65e2eb84444c69bc58ea794056f7d2b00f517a484efbf62f6e10e4bfc15c585 2026-10-21
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
56.32 KB · 56,320 B
First seen
2026-11-03 10:30 · 6 hours ago
Last seen
2026-11-03 10:30 · 6 hours ago
Last analysis
2026-11-03 10:30 · 6 hours ago
Hashes
MD5
0aa86015d4391d17cbb7e60ef13a25a7
Sha1
babcbd4f78428cf5dd1c309a09b2eb91bd89ab57
Sha256
cf22bd8e3ea7ec65e7537b4424ea6756d455f6a2aa0db6bf4e2c97bd2f776c63
Sha384
df4007317c145bb5b03f58f94d3332a72e171d426dc8c8dd682d0893831c2e533c006d78ee63eac2e4df760ff268590e
Sha512
112ae442ca56322dc3dfd9be8a7db8536da726061eea8999f199fe86d869bfa583af7f440f11bd11e117c30e1b7b90dce482de4a1f9b0dfa71d9bfa4ec0781cd
SSDeep
1536:Z1PMsDnKNgpynpGSDLwsNMDOMXExI3pmfm:QsDn1on4SDLwsNMD/XExI3pm
TLSH
89431844BFEA5A05E2BD8F3468F545150634BA63E532EB1F48D568EB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE0aa86015d4391d17cbb7e60ef13a25a7njRat
Structure
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | dllhuhuhuhu |
| cnc_host [H] | 8.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | 15c132huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | �huhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
8.tcphuhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential