Malicious
Malicious

0ff0d400ca2ff8fa916ee8bac96781f5

PE Executable
MD5: 0ff0d400ca2ff8fa916ee8bac96781f5
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 55 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e
MD5
0ff0d400ca2ff8fa916ee8bac96781f5
Verdict
Malicious
File type
PE Executable · 55 KB
Family
njRat
Category
RAT
C2 (defanged)
6[.]tcp[.]cpolar[.]cn

Cite this report: https://app.malva.re/sha256/ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
56.32 KB · 56,320 B
First seen
2026-11-03 10:30 · 7 hours ago
Last seen
2026-11-03 10:30 · 7 hours ago
Last analysis
2026-11-03 10:30 · 7 hours ago
Hashes
MD5 0ff0d400ca2ff8fa916ee8bac96781f5 Sha1 18ce62e747cc7c430fe3c7ea83a6602d51c572b7 Sha256 ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e Sha384 83b06f41faa63ca58ff9ebaed6930f03717284f1d1e8cbf8b7e02f17c643c882b1cda0f10a65eb97c8ee00e9c2a08926 Sha512 9c7e7b73532be838ecf607ae3cde0b10217b87a4acbb04e22c20f9288d8aa12d1846afcf0f83bd1ee5d2c49fab468ea149c34a02f8f0ced29531fdacf05ed708 SSDeep 1536:RXwMDnkSNkNy2OWDKfwsNMDmXExI3pm1m:+MDnk5ELWDawsNMDmXExI3pm TLSH 92431744BFEA4A01E2BD8F3469F655150A34BA63E532EB1F48D568EB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

1 malicious · 2 files
EXE0ff0d400ca2ff8fa916ee8bac96781f5njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] NjRat huhuhuhuhuhuhuhuhuhuhu
cnc_host [H] 6.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Thuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Thuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] fb4fd3huhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
539
Main Method
System.Void j.A::main()
Main IL Instruction Count
2
Main IL 
call System.Void j.OK::ko()
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
539
Main Method
System.Void j.A::main()
Main IL Instruction Count
2
Main IL 
call System.Void j.OK::ko()
ret <null>

CnC CNCmalicious
6.tcphuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 2 files
EXE0ff0d400ca2ff8fa916ee8bac96781f5njRat
Structure

Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] NjRat huhuhuhuhuhuhuhuhuhuhu
cnc_host [H] 6.tcphuhuhuhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Thuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Thuhuhuhu
cnc_port [P] 1huhuhuhu
reg_key [RG] fb4fd3huhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Dihuhuhuhu
TSKE Dihuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Dihuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

CnC CNCmalicious
6.tcphuhuhuhuhuhuhu
0ff0d400ca2ff8fa916ee8bac96781f5
Port PORTmalicious
1huhuhuhu
0ff0d400ca2ff8fa916ee8bac96781f5
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙