njRat PE Executable malware analysis – 905904c9eba8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

37.89 KB · 37,888 B

First seen

2026-06-30 04:46 · 3 months ago

Last seen

2026-06-30 04:46 · 3 months ago

Last analysis

2026-06-30 19:01 · 3 months ago

Hashes

MD5 a1ddfd2f904651fa9ba5dc86e1609383 Sha1 a082d9a52424f4e7411b7d3abf025de06f0a9121 Sha256 905904c9eba8a60eb560d1d48c62be917ce9c64072a2727cbd6340e438db1cb0 Sha384 ae3bec190087273a59a42e2b65e78e14b0b1dd35d71da1833fd985abe15dea2b4af3ee63a16e2251c3b9875f612935c7 Sha512 eb2a0ef90bce4c6eda854eb2623d19d3364e503887e114d8f81efa4d79fb5ec56a18afc7d26361e4cd31f3d9d24e2706c967b8ff63a2902146c26f7385d7e66d SSDeep 384:taDvkit2Zf5W9cTYXyc/lPM20zHFmnPushrAF+rMRTyN/0L+EcoinblneHQM3epM:8DqjjTYic/lkEPusrM+rMRa8NuSpt TLSH BC032A4D7FE18168C5FD0A7B05B2D41207BAE04B6E23D90E8EF5649A37636C58F50AF2

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 2 files

EXEa1ddfd2f904651fa9ba5dc86e1609383njRat

Structure

BINResources

Config. Field	Value
packet_size [b]	5huhuhuhu
BD [BD]	Fhuhuhuhu
directory [DR]	Thuhuhuhu
executable_name [EXE]	serhuhuhuhu
cnc_host [HH]	155.1huhuhuhuhuhuhu
is_dir_defined [Idr]	Fhuhuhuhu
is_startup_folder [IsF]	Fhuhuhuhu
is_user_reg [Isu]	Fhuhuhuhu
NH [NH]	0huhuhuhu
cnc_port [P]	2huhuhuhu
reg_key [RG]	7f17b6huhuhuhuhuhuhuhuhuhuhu
reg_path [sf]	Softwahuhuhuhuhuhuhuhuhuhuhu
sizk	2huhuhuhu
victim_name [VN]	Hahuhuhuhu
version [VR]	ihuhuhuhu
splitter [Y]	\|huhuhuhu
HD	Fhuhuhuhu
anti [anti]	Exsahuhuhuhu
anti2 [anti2]	Fhuhuhuhu
usb [usb]	Fhuhuhuhu
usbx [usbx]	svchuhuhuhu
task [task]	Fhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	`nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>`
Module Name	w.exe
Full Name	w.exe
EntryPoint	System.Void w.A::main()
Scope Name	w.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	w
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	338
Main Method	System.Void w.A::main()
Main IL Instruction Count	5
Main IL	`nop <null> call System.Void w.OK::ko() nop <null> nop <null> ret <null>`

Port PORTmalicious

2huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential