Malicious
PE Executable
MD5: 0ff0d400ca2ff8fa916ee8bac96781f5
Size: 56.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 55 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e
- MD5
- 0ff0d400ca2ff8fa916ee8bac96781f5
- Verdict
- Malicious
- File type
- PE Executable · 55 KB
- Family
- njRat
- Category
- RAT
- C2 (defanged)
6[.]tcp[.]cpolar[.]cn
Cite this report: https://app.malva.re/sha256/ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e
Related njRat samples
- cf22bd8e3ea7ec65e7537b4424ea6756d455f6a2aa0db6bf4e2c97bd2f776c63 2026-11-03
- 1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242 2026-11-02
- 49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73 2026-10-27
- f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 2026-10-26
- 94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 2026-10-25
- d65e2eb84444c69bc58ea794056f7d2b00f517a484efbf62f6e10e4bfc15c585 2026-10-21
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
56.32 KB · 56,320 B
First seen
2026-11-03 10:30 · 6 hours ago
Last seen
2026-11-03 10:30 · 6 hours ago
Last analysis
2026-11-03 10:30 · 6 hours ago
Hashes
MD5
0ff0d400ca2ff8fa916ee8bac96781f5
Sha1
18ce62e747cc7c430fe3c7ea83a6602d51c572b7
Sha256
ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e
Sha384
83b06f41faa63ca58ff9ebaed6930f03717284f1d1e8cbf8b7e02f17c643c882b1cda0f10a65eb97c8ee00e9c2a08926
Sha512
9c7e7b73532be838ecf607ae3cde0b10217b87a4acbb04e22c20f9288d8aa12d1846afcf0f83bd1ee5d2c49fab468ea149c34a02f8f0ced29531fdacf05ed708
SSDeep
1536:RXwMDnkSNkNy2OWDKfwsNMDmXExI3pm1m:+MDnk5ELWDawsNMDmXExI3pm
TLSH
92431744BFEA4A01E2BD8F3469F655150A34BA63E532EB1F48D568EB13327C58C40FE6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE0ff0d400ca2ff8fa916ee8bac96781f5njRat
Structure
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| packet_size [b] | 5huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| executable_name [EXE] | NjRat huhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | 6.tcphuhuhuhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| Anti_CH | Fhuhuhuhu |
| is_startup_folder [IsF] | Thuhuhuhu |
| USB_SP | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| cnc_port [P] | 1huhuhuhu |
| reg_key [RG] | fb4fd3huhuhuhuhuhuhuhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| victim_name [VN] | Vihuhuhuhu |
| version [VR] | <- NjRhuhuhuhuhuhuhuhuhuhuhu |
| splitter [Y] | Y262huhuhuhu |
| MSGE | Dihuhuhuhu |
| MSGT | Thhuhuhuhu |
| MSGB | Sorry,huhuhuhuhuhuhuhuhuhuhu |
| MSGSYM | vbChuhuhuhu |
| OBITO | Dihuhuhuhu |
| TSKE | Dihuhuhuhu |
| TSK | Wirehuhuhuhuhuhuhu |
| KAKASHI | Dihuhuhuhu |
| AKATSUKI | Dihuhuhuhu |
| CLEANSWEEP | Dihuhuhuhu |
| PASTEE | Dihuhuhuhu |
| PASTEBIN | https:huhuhuhuhuhuhuhuhuhuhu |
| CLIP | nhuhuhuhu |
| UAC | Dihuhuhuhu |
| nowifi | ohuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 539 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
6.tcphuhuhuhuhuhuhu
Port
PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential