| File name: | njRAT v0.7d - NYANxCAT.zip |
| Full analysis: | https://app.any.run/tasks/7833ac12-4950-47f2-acf4-203edda0f401 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | July 31, 2020, 08:32:37 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 82C7D22BA02A04DB64E1BC0E8F0BE8AA |
| SHA1: | 0FB4218D05E671A59541F8910DF267CEF6EF07B6 |
| SHA256: | 00EF1CA313D70C30C0ED4724305612C33F367D73CE55AF9FF6F9E06546228568 |
| SSDEEP: | 24576:XHBS+ObH3zNiY+vV/se5MQuz1d19OQYOSIWoOfiYgsPy24fb1mUxMZ6:kDNQV/sAMkQYO2otsPK0fc |
MALICIOUS
Starts Visual C# compiler
- Builder.exe (PID: 4092)
Application was dropped or rewritten from another process
- Client.exe (PID: 956)
Stealing of credential data
- njRAT v0.7d.exe (PID: 2936)
Actions looks like stealing of personal data
- Client.exe (PID: 956)
SUSPICIOUS
Executable content was dropped or overwritten
- csc.exe (PID: 660)
Low-level read access rights to disk partition
- msconfig.exe (PID: 2536)
INFO
Manual execution by user
- njRAT v0.7d.exe (PID: 2936)
- Client.exe (PID: 956)
- msconfig.exe (PID: 2416)
- msconfig.exe (PID: 2536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2020:03:10 01:43:04 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | njRAT v0.7d - NYANxCAT/ |
Total processes
52
Monitored processes
9
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 660 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\uctpxlsr.cmdline" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | Builder.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 Modules
| |||||||||||||||
| 948 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\njRAT v0.7d - NYANxCAT.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 956 | "C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\Client.exe" | C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\Client.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
| 2092 | "C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\Builder.exe" | C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\Builder.exe | — | njRAT v0.7d.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Builder Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2416 | "C:\Windows\system32\msconfig.exe" | C:\Windows\system32\msconfig.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: System Configuration Utility Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2536 | "C:\Windows\system32\msconfig.exe" | C:\Windows\system32\msconfig.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: System Configuration Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2936 | "C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\njRAT v0.7d.exe" | C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\njRAT v0.7d.exe | explorer.exe | ||||||||||||
User: admin Company: njq8 Integrity Level: MEDIUM Description: njRAT Exit code: 0 Version: 0.7.0.0 Modules
| |||||||||||||||
| 2944 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESFA2F.tmp" "c:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\CSCEB2F06F7618F4ACAA168F7EF4EEECA.TMP" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 12.00.52519.0 built by: VSWINSERVICING Modules
| |||||||||||||||
| 4092 | "C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\Builder.exe" | C:\Users\admin\Desktop\njRAT v0.7d - NYANxCAT\Builder.exe | — | njRAT v0.7d.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Builder Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
1 920
Read events
1 683
Write events
230
Delete events
7
Modification events
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\njRAT v0.7d - NYANxCAT.zip | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (948) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
Executable files
1
Suspicious files
0
Text files
4
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Builder.exe | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\GeoIP.dat | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\njRAT v0.7d.exe | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Plugin\cam.dll | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Plugin\ch.dll | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Plugin\mic.dll | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Plugin\plg.dll | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Plugin\pw.dll | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\Plugin\sc2.dll | — | |
MD5:— | SHA256:— | |||
| 948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb948.20995\njRAT v0.7d - NYANxCAT\WinMM.Net.dll | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report