Malicious
27a958bfa62ab8bbd341385c01aef916
PE Executable
MD5: 27a958bfa62ab8bbd341385c01aef916
Size: 24.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 23.5 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242
- MD5
- 27a958bfa62ab8bbd341385c01aef916
- Verdict
- Malicious
- File type
- PE Executable · 23.5 KB
- Family
- njRat
- Category
- RAT
- C2 (defanged)
196[.]202[.]45[.]5
Cite this report: https://app.malva.re/sha256/1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242
Related njRat samples
- 49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73 2026-10-27
- f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 2026-10-26
- 94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 2026-10-25
- d65e2eb84444c69bc58ea794056f7d2b00f517a484efbf62f6e10e4bfc15c585 2026-10-21
- 6bba006161f3d18b18495b329961b76ec1a6ad6e7595c6b74e86f961049d5370 2026-10-20
- 3464447f8b816cfb5d61575cf343971394e5f4834adb2b7d3964c305dbb18182 2026-10-20
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
24.06 KB · 24,064 B
First seen
2026-11-02 08:45 · 2 hours ago
Last seen
2026-11-02 08:45 · 2 hours ago
Last analysis
2026-11-02 08:45 · 2 hours ago
Hashes
MD5
27a958bfa62ab8bbd341385c01aef916
Sha1
3838c6d2fd9de205047bc533e9ac60fd9b1a4458
Sha256
1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242
Sha384
4c33652ef1fa18f4e837e361cb397576633763571054bb0a78638561e4e6bf4d73542ca3b8f8e3450f144744cb739e9b
Sha512
07ed2530ce878b243648574080540f1fbef22d044edec80dc5ea58b9211a10b6c1ab9a16d797216f53bf9d643f3975edaa4ec8d6c2347b5702fbe07ccea26b60
SSDeep
384:FQ+SAN7uprgvM5OSUswZXg6hgbm4hfpZmRvR6JZlbw8hqIusZzZptO:6OaxVULRpcnukM
TLSH
1CB22B4E3FA98856C5BC17748AA5965003B091870423EE2FCCC550DBAFB3AD91D8CAFD
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 2 files
EXE27a958bfa62ab8bbd341385c01aef916njRat
Structure
BINResources
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| victim_name [VN] | |
| version [VR] | 0huhuhuhu |
| executable_name [EXE] | winshuhuhuhu |
| directory [DR] | Thuhuhuhu |
| reg_key [RG] | 24244fhuhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | 196.huhuhuhu |
| cnc_port [P] | 4huhuhuhu |
| splitter [Y] | |huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| packet_size [b] | 5huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | j.exe |
| Full Name | j.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | j.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | j |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 214 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | j.exe |
| Full Name | j.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | j.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | j |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 214 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
196.huhuhuhu
Port
PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 2 files
EXE27a958bfa62ab8bbd341385c01aef916njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| victim_name [VN] | |
| version [VR] | 0huhuhuhu |
| executable_name [EXE] | winshuhuhuhu |
| directory [DR] | Thuhuhuhu |
| reg_key [RG] | 24244fhuhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | 196.huhuhuhu |
| cnc_port [P] | 4huhuhuhu |
| splitter [Y] | |huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| is_dir_defined [Idr] | Fhuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Fhuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| packet_size [b] | 5huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
196.huhuhuhu
27a958bfa62ab8bbd341385c01aef916
Port
PORTmalicious
4huhuhuhu
27a958bfa62ab8bbd341385c01aef916
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account