Malicious
Malicious

27a958bfa62ab8bbd341385c01aef916

Share on LinkedIn
Print
PE Executable
MD5: 27a958bfa62ab8bbd341385c01aef916
Size: 24.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 23.5 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 1 embedded or derived file, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242
MD5
27a958bfa62ab8bbd341385c01aef916
Verdict
Malicious
File type
PE Executable · 23.5 KB
Family
njRat
Category
RAT
C2 (defanged)
196[.]202[.]45[.]5

Cite this report: https://app.malva.re/sha256/1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
24.06 KB · 24,064 B
Hashes
MD5 27a958bfa62ab8bbd341385c01aef916 Sha1 3838c6d2fd9de205047bc533e9ac60fd9b1a4458 Sha256 1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242 Sha384 4c33652ef1fa18f4e837e361cb397576633763571054bb0a78638561e4e6bf4d73542ca3b8f8e3450f144744cb739e9b Sha512 07ed2530ce878b243648574080540f1fbef22d044edec80dc5ea58b9211a10b6c1ab9a16d797216f53bf9d643f3975edaa4ec8d6c2347b5702fbe07ccea26b60 SSDeep 384:FQ+SAN7uprgvM5OSUswZXg6hgbm4hfpZmRvR6JZlbw8hqIusZzZptO:6OaxVULRpcnukM TLSH 1CB22B4E3FA98856C5BC17748AA5965003B091870423EE2FCCC550DBAFB3AD91D8CAFD
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

1 malicious · 2 files
EXE27a958bfa62ab8bbd341385c01aef916njRat
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
victim_name [VN]
version [VR] 0huhuhuhu
executable_name [EXE] winshuhuhuhu
directory [DR] Thuhuhuhu
reg_key [RG] 24244fhuhuhuhuhuhuhuhuhuhuhu
cnc_host [H] 196.huhuhuhu
cnc_port [P] 4huhuhuhu
splitter [Y] |huhuhuhu
BD [BD] Fhuhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
packet_size [b] 5huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
j.exe
Full Name
j.exe
EntryPoint
System.Void j.A::main()
Scope Name
j.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
j
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
214
Main Method
System.Void j.A::main()
Main IL Instruction Count
2
Main IL 
call System.Void j.OK::ko()
ret <null>
Module Name
j.exe
Full Name
j.exe
EntryPoint
System.Void j.A::main()
Scope Name
j.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
j
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
214
Main Method
System.Void j.A::main()
Main IL Instruction Count
2
Main IL 
call System.Void j.OK::ko()
ret <null>

CnC CNCmalicious
196.huhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙