analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DDOS, DOS JAPINHA.rar

Full analysis: https://app.any.run/tasks/eda40c97-9cfc-4cc1-833d-08dfce7aa9d0
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 09:29:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

4754F16CC0A8B9F4F5AC15A1B7BE66EB

SHA1:

519A551A8FA6620F43E3485F5E568D3BB59C609D

SHA256:

0DBCEA0912A2358EB90241F458D6152964BD9D76FEA75FB6554A89CDB057C3A1

SSDEEP:

768:fPqf6OhiUDE35qJJAXWUBPkOwjrxBS9wr:HOJgpKahZQxBUwr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3184)

    • Application was dropped or rewritten from another process

      • Japinha V9 BOTNET.exe (PID: 2944)
      • Japinha V9 BOTNET.exe (PID: 1352)
      • svchost.exe (PID: 2076)

    • Writes to a start menu file

      • svchost.exe (PID: 2076)

    • NJRAT was detected

      • svchost.exe (PID: 2076)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 2076)

  • SUSPICIOUS

    • Creates executable files which already exist in Windows

      • Japinha V9 BOTNET.exe (PID: 2944)

    • Uses NETSH.EXE for network configuration

      • svchost.exe (PID: 2076)

    • Executable content was dropped or overwritten

      • Japinha V9 BOTNET.exe (PID: 2944)
      • svchost.exe (PID: 2076)

    • Drops a file with a compile date too recent

      • Japinha V9 BOTNET.exe (PID: 2944)
      • svchost.exe (PID: 2076)

    • Starts itself from another location

      • Japinha V9 BOTNET.exe (PID: 2944)

    • Creates files in the user directory

      • svchost.exe (PID: 2076)

  • INFO

    • Manual execution by user

      • Japinha V9 BOTNET.exe (PID: 1352)
      • Japinha V9 BOTNET.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs searchprotocolhost.exe no specs japinha v9 botnet.exe japinha v9 botnet.exe no specs #NJRAT svchost.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1472"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DDOS, DOS JAPINHA.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3184"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2944"C:\Users\admin\Desktop\Japinha V9 BOTNET.exe" C:\Users\admin\Desktop\Japinha V9 BOTNET.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1352"C:\Users\admin\Desktop\Japinha V9 BOTNET.exe" C:\Users\admin\Desktop\Japinha V9 BOTNET.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2076"C:\Users\admin\svchost.exe" C:\Users\admin\svchost.exe
Japinha V9 BOTNET.exe
User:
admin
Integrity Level:
MEDIUM
888netsh firewall add allowedprogram "C:\Users\admin\svchost.exe" "svchost.exe" ENABLEC:\Windows\system32\netsh.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 154
Read events
805
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1472.2286\DDOS, DOS JAPINHA\WinMM.Net.dll —
MD5:—
SHA256:—
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1472.2500\DDOS, DOS JAPINHA\Japinha V9 BOTNET.exe —
MD5:—
SHA256:—
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1472.2686\DDOS, DOS JAPINHA\Como USar.txt —
MD5:—
SHA256:—
2076svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\17e62eeef470afdb1567f940cdca1b18.exeexecutable
MD5:06BCA2F76A63912E36B0276DDBD732D2
SHA256:57347012633BB878DAB78E1BC57D8A3E00A8279D1E1F7C213E99808FEF1ABDFF
2944Japinha V9 BOTNET.exeC:\Users\admin\svchost.exeexecutable
MD5:06BCA2F76A63912E36B0276DDBD732D2
SHA256:57347012633BB878DAB78E1BC57D8A3E00A8279D1E1F7C213E99808FEF1ABDFF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2076
svchost.exe
141.255.153.93:1177
marcoatn1.duckdns.org
Lost Oasis SARL
NL
unknown

DNS requests

Domain
IP
Reputation
marcoatn1.duckdns.org
  • 141.255.153.93
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DDOS, DOS JAPINHA.rar