{
  "added_at": "2026-11-06",
  "category": "reconstruction-cases",
  "description_en": "A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. The author reports process, registry and network behavior, extracted indicators and MITRE ATT&CK mappings in a report and screenshots.",
  "description_zh": "该恶意软件研究用 PEStudio 静态检查和 ANY.RUN 沙箱遥测分析 njRAT 与经 UPX 打包的 Casdet 可执行文件，同时检查恶意 PDF 和良性对照文件。作者在报告及截图中记录了进程、注册表、网络行为、入侵指标和 MITRE ATT&CK 映射。",
  "entry_url": "https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/malware-analysis-njrat-casdet-case/",
  "evidence_url": "https://github.com/phour44/Malware-Analysis/blob/c30cab3c470d81c4b6fc12b44bf3599e338a7fb8/README.md",
  "group": "cases",
  "id": "malware-analysis-njrat-casdet-case",
  "json_url": "https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/malware-analysis-njrat-casdet-case/index.md",
  "name": "Malware Analysis: njRAT and Casdet behavior investigation",
  "name_zh": "Malware Analysis：njRAT 与 Casdet 行为研究",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirements": [
    "The investigation used PEStudio 9.56 and ANY.RUN on a Windows 10 guest.",
    "The author reports that Infected.exe crashed because libelf.dll was missing, so no sandbox behavior was observed for it."
  ],
  "requirements_zh": [
    "研究使用 PEStudio 9.56，并在 Windows 10 客户机中运行 ANY.RUN。",
    "作者报告称，Infected.exe 因缺少 libelf.dll 而崩溃，沙箱中未观察到其行为。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/phour44/Malware-Analysis",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}