# Malware Analysis: njRAT and Casdet behavior investigation

> A malware investigation examines njRAT and a UPX-packed Casdet executable with PEStudio static triage and ANY.RUN sandbox telemetry, alongside a malicious PDF and benign comparison files. The author reports process, registry and network behavior, extracted indicators and MITRE ATT&CK mappings in a report and screenshots.

- Type: Case study
- Targets: Binary
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/phour44/Malware-Analysis>
- Primary source: <https://github.com/phour44/Malware-Analysis/blob/c30cab3c470d81c4b6fc12b44bf3599e338a7fb8/README.md>
- Catalog page: <https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/>
- Record JSON: <https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/malware-analysis-njrat-casdet-case/index.md)

## Requirements & limits

- The investigation used PEStudio 9.56 and ANY.RUN on a Windows 10 guest.
- The author reports that Infected.exe crashed because libelf.dll was missing, so no sandbox behavior was observed for it.

## Primary sources

1. <https://github.com/phour44/Malware-Analysis/blob/c30cab3c470d81c4b6fc12b44bf3599e338a7fb8/README.md>

## More in Native binaries

- [Ghidra](https://awesomerea.org/resources/ghidra/index.md) · Tool
- [radare2](https://awesomerea.org/resources/radare2/index.md) · Tool
- [Cutter](https://awesomerea.org/resources/cutter/index.md) · Tool
- [Qiling](https://awesomerea.org/resources/qiling/index.md) · Tool
- [Unicorn Engine](https://awesomerea.org/resources/unicorn/index.md) · Tool
- [angr](https://awesomerea.org/resources/angr/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.