analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

_Cracked_Streambot_2.rar

Full analysis: https://app.any.run/tasks/5c4937ea-a0b8-49c4-aa57-52c658c93b79
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 15, 2019, 18:29:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
imminent
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C98AAE43EC84FADC9EAC5EBC0CD7A1B2

SHA1:

FCD63318B9146484A521D9AFC0AFC0AE17F13D18

SHA256:

141FB3AB10523E8624E5736218F9A6B7A8CD1FFB3862444F491D5792FA6D3142

SSDEEP:

196608:R9itwJNPwD7qM2KFJUycFd+o+zOwAd+jDoWRJO4Zvj57UIG+uMNZkyzf29F0Hl:uiJNYy4C/Fd+ond47nOc9UIG+DZ/29Fg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • streambot2.exe (PID: 3384)
      • Protectedcy.exe (PID: 3732)
      • Protectednj.exe (PID: 3352)
      • Protectedin.exe (PID: 1696)
      • SDVGJHKHC.exe (PID: 1492)
      • 22.exe (PID: 2344)
      • ZVKQHTPNL.exe (PID: 3304)
      • Protectedwo.exe (PID: 3472)
      • Protectedwo.exe (PID: 2192)
      • Protectedwo.exe (PID: 1012)
      • Protectedwo.exe (PID: 2956)
      • Protectedwo.exe (PID: 3872)
      • Protectedcy.exe (PID: 1212)
      • 2222.sfx.exe (PID: 3136)
      • 2222.exe (PID: 3652)
      • Protectedwo.exe (PID: 3568)
      • Protectedwo.exe (PID: 572)
      • Protectedcy.exe (PID: 3892)
      • Streambot 2.exe (PID: 3660)
      • Streambot 2.exe (PID: 3856)
      • Protectedcy.exe (PID: 736)
      • vgdsikgkkebi.exe (PID: 1104)
      • avfpdwwevrto.exe (PID: 772)
      • kgedvkmaodrl.exe (PID: 2784)
      • orrqrpcsgwbz.exe (PID: 2412)
      • skecatbucrom.exe (PID: 2556)
      • skecatbucrom.exe (PID: 3724)
      • skecatbucrom.exe (PID: 2616)
      • skecatbucrom.exe (PID: 2224)
      • skecatbucrom.exe (PID: 3412)
      • skecatbucrom.exe (PID: 1748)
      • SystemProcess.exe (PID: 3452)
      • skecatbucrom.exe (PID: 1640)
      • Protectedcy.exe (PID: 2432)

    • Known privilege escalation attack

      • Streambot 2.exe (PID: 3856)

    • Changes the autorun value in the registry

      • 22.exe (PID: 2344)
      • 2222.exe (PID: 3652)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2540)
      • schtasks.exe (PID: 2844)
      • schtasks.exe (PID: 3496)
      • schtasks.exe (PID: 868)
      • schtasks.exe (PID: 944)
      • schtasks.exe (PID: 2468)
      • schtasks.exe (PID: 3164)
      • schtasks.exe (PID: 488)
      • schtasks.exe (PID: 2256)
      • schtasks.exe (PID: 3396)
      • schtasks.exe (PID: 776)

    • Uses Task Scheduler to run other applications

      • Protectedwo.exe (PID: 572)
      • 22.exe (PID: 2344)
      • 2222.exe (PID: 3652)
      • Protectedcy.exe (PID: 3732)
      • Protectednj.exe (PID: 3352)
      • Protectedin.exe (PID: 1696)
      • Streambot 2.exe (PID: 3660)
      • skecatbucrom.exe (PID: 2616)
      • Protectedcy.exe (PID: 736)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2920)

    • Detected Imminent RAT

      • RegSvcs.exe (PID: 1012)

    • NJRAT was detected

      • RegAsm.exe (PID: 1332)

  • SUSPICIOUS

    • Modifies the open verb of a shell class

      • Streambot 2.exe (PID: 3856)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3348)
      • Protectedwo.exe (PID: 572)
      • Streambot 2.exe (PID: 3660)
      • 22.exe (PID: 2344)
      • 2222.sfx.exe (PID: 3136)
      • 2222.exe (PID: 3652)
      • Protectedcy.exe (PID: 3732)
      • Protectedin.exe (PID: 1696)
      • Protectednj.exe (PID: 3352)

    • Application launched itself

      • Protectedwo.exe (PID: 572)
      • Protectedcy.exe (PID: 3732)
      • Protectedcy.exe (PID: 3892)
      • Protectedcy.exe (PID: 1212)
      • skecatbucrom.exe (PID: 2616)
      • Protectedcy.exe (PID: 736)

    • Creates files in the user directory

      • Protectedcy.exe (PID: 3732)
      • Protectednj.exe (PID: 3352)
      • Protectedcy.exe (PID: 3892)
      • RegSvcs.exe (PID: 1012)

    • Uses NETSH.EXE for network configuration

      • RegAsm.exe (PID: 1332)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
120
Monitored processes
67
Malicious processes
14
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe streambot 2.exe no specs eventvwr.exe no specs eventvwr.exe streambot 2.exe streambot2.exe no specs protectedcy.exe protectedin.exe protectednj.exe protectedwo.exe 22.exe 2222.sfx.exe protectedwo.exe no specs protectedwo.exe no specs protectedwo.exe no specs protectedwo.exe no specs protectedwo.exe no specs protectedwo.exe no specs schtasks.exe no specs 2222.exe schtasks.exe no specs schtasks.exe no specs sdvgjhkhc.exe schtasks.exe no specs schtasks.exe no specs zvkqhtpnl.exe searchprotocolhost.exe no specs protectedcy.exe no specs #IMMINENT regsvcs.exe schtasks.exe no specs #NJRAT regasm.exe regasm.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs protectedcy.exe protectedcy.exe no specs regasm.exe no specs regasm.exe no specs netsh.exe no specs vgdsikgkkebi.exe no specs orrqrpcsgwbz.exe no specs kgedvkmaodrl.exe no specs avfpdwwevrto.exe no specs systemprocess.exe no specs skecatbucrom.exe no specs taskmgr.exe no specs regasm.exe no specs regasm.exe no specs skecatbucrom.exe no specs skecatbucrom.exe no specs skecatbucrom.exe no specs skecatbucrom.exe no specs skecatbucrom.exe no specs skecatbucrom.exe no specs schtasks.exe no specs regasm.exe no specs regasm.exe no specs wmiapsrv.exe no specs protectedcy.exe no specs schtasks.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3348"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\_Cracked_Streambot_2.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3856"C:\Users\admin\Desktop\[Cracked]Streambot 2\V\Streambot 2.exe" C:\Users\admin\Desktop\[Cracked]Streambot 2\V\Streambot 2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3652"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—Streambot 2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1716"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
Streambot 2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3660"C:\Users\admin\Desktop\[Cracked]Streambot 2\V\Streambot 2.exe" C:\Users\admin\Desktop\[Cracked]Streambot 2\V\Streambot 2.exe
eventvwr.exe
User:
admin
Integrity Level:
HIGH
3384"C:\Users\admin\AppData\Local\Temp\streambot2.exe" C:\Users\admin\AppData\Local\Temp\streambot2.exe—Streambot 2.exe
User:
admin
Company:
Shadiku Izayoi, Emma Skye <neosyndicate.net>
Integrity Level:
HIGH
Description:
streambot²
Exit code:
3221225781
Version:
2.5.0.0
3732"C:\Users\admin\AppData\Local\Temp\Protectedcy.exe" C:\Users\admin\AppData\Local\Temp\Protectedcy.exe
Streambot 2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
1696"C:\Users\admin\AppData\Local\Temp\Protectedin.exe" C:\Users\admin\AppData\Local\Temp\Protectedin.exe
Streambot 2.exe
User:
admin
Integrity Level:
HIGH
3352"C:\Users\admin\AppData\Local\Temp\Protectednj.exe" C:\Users\admin\AppData\Local\Temp\Protectednj.exe
Streambot 2.exe
User:
admin
Integrity Level:
HIGH
572"C:\Users\admin\AppData\Local\Temp\Protectedwo.exe" C:\Users\admin\AppData\Local\Temp\Protectedwo.exe
Streambot 2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Total events
2 761
Read events
2 620
Write events
0
Delete events
0

Modification events

No data
Executable files
27
Suspicious files
8
Text files
387
Unknown types
0

Dropped files

PID
Process
Filename
Type
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap14.datimage
MD5:58724CE63DFB037C86EE19358FC20157
SHA256:D4D9BE6BFBAAF7B4215D149907182B8D92137628E0369986D07E8E27006817E8
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap12.datimage
MD5:D8D7A1347773A2F1BF652174075C6BC3
SHA256:4D19EEFAA357F7EAC71FA28EB55AAD26627716B6ABE6F0361C4948E69E7ECB62
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap10.datimage
MD5:15FEC6C33A20A6ECB295FA55514781E7
SHA256:E238521A1915A0C488D87FA0068D03135BA2D806268F58E973B858195975B20D
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap21.datimage
MD5:83E5EEF02E173AC3EFD8CA49609EC5E3
SHA256:87249BFB103A8FDE22FE5C6C77CB990E36AE31FBFF8A5FF8361F99199B0F79F4
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap23.datimage
MD5:FA9AAF285BAD435122001B162B72F0B8
SHA256:A6637FBCDEB5EA08A7297E2B50CA5EAA9039E99AD1B84A780007B3B34022E016
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap19.datimage
MD5:42BC9A74D40E97E194DA9EB07C8304D1
SHA256:FEF73F3330FEEBF6591FCF11E695370D98CED4342F25EE0D6984BC6BD031346D
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap20.datimage
MD5:694B28725867A2C893A2535CA310ACB8
SHA256:475FE9452812C91BCD7208687DE014419FDC0C77FE29747FD18DDA3EADACAEA8
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap15.datimage
MD5:9739753453EC79E41C49500DDA06D0C9
SHA256:56407243DFEA14F0A42D5CD7E0D7CE3D3D828C83AB3C1A70FC3E09056E99D110
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap18.datimage
MD5:9073D4D6CB37AB39CAA44CFF241182EE
SHA256:19105802E9202F5070919D1326732BE8E8B0D0EF0B9E7DD11AA6BF7DD43042D3
3348WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3348.1376\[Cracked]Streambot 2\V\includes\dat01\ap13.datimage
MD5:636121997F8139FA039DA7EAA207C23F
SHA256:7F7E0C0BAA8EDB2035D7108ED7760C7F26D80205CB6CA2609904E5B8F69BE6F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
31
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1492
SDVGJHKHC.exe
83.49.248.1:2222
pooleu.xmrminingpool.net
Telefonica De Espana
ES
unknown
3304
ZVKQHTPNL.exe
83.49.248.1:2222
pooleu.xmrminingpool.net
Telefonica De Espana
ES
unknown
1012
RegSvcs.exe
192.69.169.25:9003
todoaqui.duckdns.org
ATLINK SERVICES, LLC
US
malicious
1332
RegAsm.exe
192.69.169.25:5553
todoaqui.duckdns.org
ATLINK SERVICES, LLC
US
malicious
3892
Protectedcy.exe
192.69.169.25:1552
todoaqui.duckdns.org
ATLINK SERVICES, LLC
US
malicious
3892
Protectedcy.exe
192.69.169.25:1978
todoaqui.duckdns.org
ATLINK SERVICES, LLC
US
malicious
—
—
83.49.248.1:2222
pooleu.xmrminingpool.net
Telefonica De Espana
ES
unknown

DNS requests

Domain
IP
Reputation
pooleu.xmrminingpool.net
  • 83.49.248.1
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
Chrome.mywire.org
  • —
malicious
wuap.hopto.org
  • 0.0.0.0
malicious
todoaqui.duckdns.org
  • 192.69.169.25
malicious
malwaresbytes.duckdns.org
  • 192.69.169.25
malicious
Opera.mywire.org
  • —
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
_Cracked_Streambot_2.rar