njRat PE Executable malware analysis – e9fd1d72d90e

The file e9fd1d72d90e7708e516b9ee0cec5fb7 is a PE Executable identified by Malva.RE as njRat (rat). Static analysis extracted 31 embedded or derived files. It matches 22 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: —
MD5: -
Verdict: Inconclusive
File type: PE Executable
Family: njRat
Category: RAT

Related njRat samples

f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67 2026-10-26
94996736d6917702bae5aa7ce888ee896be94fa6e620c0b155e9f3c7bbe5a369 2026-10-25
d65e2eb84444c69bc58ea794056f7d2b00f517a484efbf62f6e10e4bfc15c585 2026-10-21
6bba006161f3d18b18495b329961b76ec1a6ad6e7595c6b74e86f961049d5370 2026-10-20
3464447f8b816cfb5d61575cf343971394e5f4834adb2b7d3964c305dbb18182 2026-10-20
d90ec6fb084a6ab655146a8380cfbc94b0732f427eb820971284af43a4a7b732 2026-10-19

All njRat analyses →

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Low

32 files

EXEe9fd1d72d90e7708e516b9ee0cec5fb7njRat

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Client-explorer.exe
Full Name	Client-explorer.exe
EntryPoint	System.Void Client.Program::Main(System.String[])
Scope Name	Client-explorer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client-explorer
Assembly Version	6.0.9.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	12508
Main Method	System.Void Client.Program::Main(System.String[])
Main IL Instruction Count	134
Main IL	ldarg.0 <null> ldlen <null> brtrue IL_0011: ldarg.0 ldstr br IL_0018: stloc.0 ldarg.0 <null> ldc.i4.0 <null> ldelem System.String stloc.0 <null> call System.Boolean Client.Helper.Methods::IsAdmin() brtrue IL_003D: call System.Boolean Client.Helper.MutexControl::CreateMutex() ldloc.0 <null> ldstr --flag call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_003D: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Program::ForceGetAdminAccess() br IL_004D: ldc.i4.s 26 call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_004D: ldc.i4.s 26 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr 7n5rJCiEX08cdKRQsT6vxkbuaZ call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.1 <null> br IL_0093: ldloc.1 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.1 <null> ldc.i4.1 <null> add <null> stloc.1 <null> ldloc.1 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0085: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_00B0: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C9: leave IL_00D4 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_00D4: call System.Void Client.Helper.A::B() pop <null> leave IL_00D4: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00ED: leave IL_00F8 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00F8: nop pop <null> leave IL_00F8: nop nop <null> ldsfld System.String Client.Settings::Enable_Clipper call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0169: leave IL_0174 ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr btc ldsfld System.String Client.Settings::Clipper_BTC callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr eth ldsfld System.String Client.Settings::Clipper_ETH callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr ltc ldsfld System.String Client.Settings::Clipper_LTC callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr bch ldsfld System.String Client.Settings::Clipper_BCH callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Threading.Thread Finder.Helpers.ClipboardManager::MainThread dup <null> ldc.i4.0 <null> callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState) callvirt System.Void System.Threading.Thread::Start() leave IL_0174: nop pop <null> leave IL_0174: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0193: leave IL_019E call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0193: leave IL_019E call System.Void Client.Helper.ProcessCritical::Set() leave IL_019E: nop pop <null> leave IL_019E: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_01B3: leave IL_01BE call System.Void Client.Install.NormalStartup::Install() leave IL_01BE: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_01BE: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_01D2: leave IL_01DD call System.Void Client.Helper.Methods::ClearSetting() leave IL_01DD: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 pop <null> leave IL_01DD: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 dup <null> brtrue IL_01FF: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__2_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.IntPtr Client.Features.KeyLog.Keylogger::SetHook() pop <null> call System.Void System.Windows.Forms.Application::Run() ret <null>
Module Name	Client-explorer.exe
Full Name	Client-explorer.exe
EntryPoint	System.Void Client.Program::Main(System.String[])
Scope Name	Client-explorer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client-explorer
Assembly Version	6.0.9.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	12508
Main Method	System.Void Client.Program::Main(System.String[])
Main IL Instruction Count	134
Main IL	ldarg.0 <null> ldlen <null> brtrue IL_0011: ldarg.0 ldstr br IL_0018: stloc.0 ldarg.0 <null> ldc.i4.0 <null> ldelem System.String stloc.0 <null> call System.Boolean Client.Helper.Methods::IsAdmin() brtrue IL_003D: call System.Boolean Client.Helper.MutexControl::CreateMutex() ldloc.0 <null> ldstr --flag call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_003D: call System.Boolean Client.Helper.MutexControl::CreateMutex() call System.Void Client.Program::ForceGetAdminAccess() br IL_004D: ldc.i4.s 26 call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_004D: ldc.i4.s 26 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr 7n5rJCiEX08cdKRQsT6vxkbuaZ call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.1 <null> br IL_0093: ldloc.1 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.1 <null> ldc.i4.1 <null> add <null> stloc.1 <null> ldloc.1 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0085: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_00B0: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C9: leave IL_00D4 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_00D4: call System.Void Client.Helper.A::B() pop <null> leave IL_00D4: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00ED: leave IL_00F8 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00F8: nop pop <null> leave IL_00F8: nop nop <null> ldsfld System.String Client.Settings::Enable_Clipper call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0169: leave IL_0174 ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr btc ldsfld System.String Client.Settings::Clipper_BTC callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr eth ldsfld System.String Client.Settings::Clipper_ETH callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr ltc ldsfld System.String Client.Settings::Clipper_LTC callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> Finder.Config::ClipperAddresses ldstr bch ldsfld System.String Client.Settings::Clipper_BCH callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::set_Item(System.String,System.String) ldsfld System.Threading.Thread Finder.Helpers.ClipboardManager::MainThread dup <null> ldc.i4.0 <null> callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState) callvirt System.Void System.Threading.Thread::Start() leave IL_0174: nop pop <null> leave IL_0174: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0193: leave IL_019E call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0193: leave IL_019E call System.Void Client.Helper.ProcessCritical::Set() leave IL_019E: nop pop <null> leave IL_019E: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_01B3: leave IL_01BE call System.Void Client.Install.NormalStartup::Install() leave IL_01BE: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_01BE: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_01D2: leave IL_01DD call System.Void Client.Helper.Methods::ClearSetting() leave IL_01DD: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 pop <null> leave IL_01DD: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 dup <null> brtrue IL_01FF: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__2_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__2_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.IntPtr Client.Features.KeyLog.Keylogger::SetHook() pop <null> call System.Void System.Windows.Forms.Application::Run() ret <null>

Overview

Related njRat samples

Summary by MalvaGPT

Characteristics

File Structure

Information38

File Structure