Malicious
43ba5a3f20774f2ac402d8b310825f84
PE Executable
MD5: 43ba5a3f20774f2ac402d8b310825f84
Size: 28.16 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 27.5 KB PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 3 embedded or derived files, a malware configuration (njRAT config.) and 1 command-and-control endpoint. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- df565eec185189cd6281e541953975959b81524626f38272a85b6eef71c4ec16
- MD5
- 43ba5a3f20774f2ac402d8b310825f84
- Verdict
- Malicious
- File type
- PE Executable · 27.5 KB
- Family
- njRat
- Category
- RAT
- C2 (defanged)
adobeupdate[.]ddns[.]net
Cite this report: https://app.malva.re/sha256/df565eec185189cd6281e541953975959b81524626f38272a85b6eef71c4ec16
Related njRat samples
- ecdc0af0b88a9e93e7a409e510ffac0c9ae88f8e0cf314ea44ae6529fd841e3e 2026-11-03
- cf22bd8e3ea7ec65e7537b4424ea6756d455f6a2aa0db6bf4e2c97bd2f776c63 2026-11-03
- 1167be18640e28a0c1ee3d200549125a6ab40b79fcc998e7be6ccfe9ffc0a242 2026-11-02
- 49acbf8b7dc91464fb534b3dcf02f7c027115351edf9a985b182325f9ba45a73 2026-10-27
- f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 2026-10-26
- 94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 2026-10-25
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
28.16 KB · 28,160 B
First seen
2026-11-04 04:45 · an hour ago
Last seen
2026-11-04 04:45 · an hour ago
Last analysis
2026-11-04 04:45 · an hour ago
Hashes
MD5
43ba5a3f20774f2ac402d8b310825f84
Sha1
cec6ef6fdc36297935d1a352ce0f7a70cbbf27f2
Sha256
df565eec185189cd6281e541953975959b81524626f38272a85b6eef71c4ec16
Sha384
18d236cb4304e7b2b287b9be40c90aba6414a584abc81747e5d6904415d35cb1f05714fa8dc6a928d8e31b2c5e2ca8bc
Sha512
91f83e9ac9f3ea9d607b10fa55ddd672094bb7b1c62b960d08df0dd059349d8a66d0222c16253099264404f730b315ea308c05088130a5183223b2ff05fe2cb1
SSDeep
384:2c6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZH1PkR:ue9EJLN/yRpcnuu
TLSH
39C2194A3FA8C856C5AC1770C5A6C6B00370A9470412EE2B9CC578DBBF73BD52D48AF9
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 4 files
EXE43ba5a3f20774f2ac402d8b310825f84njRat
Structure
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINRT_GROUP_CURSOR4
BINID:0032
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| victim_name [VN] | |
| version [VR] | 0huhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| reg_key [RG] | 7c1307huhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | adobeuhuhuhuhuhuhuhu |
| cnc_port [P] | 3huhuhuhu |
| splitter [Y] | |huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| packet_size [b] | 5huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Module Name | j.exe |
| Full Name | j.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | j.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | j |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 214 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
| Module Name | j.exe |
| Full Name | j.exe |
| EntryPoint | System.Void j.A::main() |
| Scope Name | j.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v2.0.50727 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | j |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 214 |
| Main Method | System.Void j.A::main() |
| Main IL Instruction Count | 2 |
| Main IL | |
CnC
CNCmalicious
adobeuhuhuhuhuhuhuhu
Port
PORTmalicious
3huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential1 malicious · 4 files
EXE43ba5a3f20774f2ac402d8b310825f84njRat
Structure
BINResources
| Config. Field | Value |
|---|---|
| victim_name [VN] | |
| version [VR] | 0huhuhuhu |
| executable_name [EXE] | serhuhuhuhu |
| directory [DR] | Thuhuhuhu |
| reg_key [RG] | 7c1307huhuhuhuhuhuhuhuhuhuhu |
| cnc_host [H] | adobeuhuhuhuhuhuhuhu |
| cnc_port [P] | 3huhuhuhu |
| splitter [Y] | |huhuhuhu |
| BD [BD] | Fhuhuhuhu |
| is_dir_defined [Idr] | Thuhuhuhu |
| is_startup_folder [IsF] | Fhuhuhuhu |
| is_user_reg [Isu] | Thuhuhuhu |
| reg_path [sf] | Softwahuhuhuhuhuhuhuhuhuhuhu |
| packet_size [b] | 5huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCnC
CNCmalicious
adobeuhuhuhuhuhuhuhu
43ba5a3f20774f2ac402d8b310825f84
Port
PORTmalicious
3huhuhuhu
43ba5a3f20774f2ac402d8b310825f84
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account