analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1.rar

Full analysis: https://app.any.run/tasks/ae4cec7a-a748-45fd-ad69-af5ae759e39a
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 13:08:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5F11656B4120DBE46E357B0AE4418908

SHA1:

52F5676C576555846F968B64FAFD1715B3DF383A

SHA256:

179E7DC4F8503D282849B1562AE5238B5BDD7E39BA7ADB47B6F9033BD3553D20

SSDEEP:

24576:4pR6gLV1lmrUXTpRhF93isfBkLva2qNnX7yp:4pR6g7lDX/hF934Dalno

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 832)

    • Application was dropped or rewritten from another process

      • NETFLIX Checker Account By X-KILLER.exe (PID: 3352)
      • Chrome.exe (PID: 2848)
      • NETFLIX Checker Account By X-KILLER.exe (PID: 3004)
      • NETFLIX Checker Account By X-KILLER.exe (PID: 2668)
      • Chrome.exe (PID: 3228)

    • Writes to a start menu file

      • Chrome.exe (PID: 3228)

    • Connects to CnC server

      • Chrome.exe (PID: 3228)

    • Changes the autorun value in the registry

      • Chrome.exe (PID: 3228)

    • NJRAT was detected

      • Chrome.exe (PID: 3228)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2468)
      • NETFLIX Checker Account By X-KILLER.exe (PID: 3004)
      • Chrome.exe (PID: 2848)
      • Chrome.exe (PID: 3228)

    • Creates files in the user directory

      • Chrome.exe (PID: 2848)
      • Chrome.exe (PID: 3228)

    • Starts itself from another location

      • Chrome.exe (PID: 2848)

    • Uses NETSH.EXE for network configuration

      • Chrome.exe (PID: 3228)

  • INFO

    • Manual execution by user

      • NETFLIX Checker Account By X-KILLER.exe (PID: 3352)
      • NETFLIX Checker Account By X-KILLER.exe (PID: 3004)
      • regedit.exe (PID: 3796)
      • regedit.exe (PID: 1008)

    • Application was crashed

      • NETFLIX Checker Account By X-KILLER.exe (PID: 2668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe searchprotocolhost.exe no specs netflix checker account  by x-killer.exe no specs netflix checker account  by x-killer.exe netflix checker account  by x-killer.exe chrome.exe #NJRAT chrome.exe netsh.exe no specs regedit.exe no specs regedit.exe

Process information

PID
CMD
Path
Indicators
Parent process
2468"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
832"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3352"C:\Users\admin\Desktop\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exe" C:\Users\admin\Desktop\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3004"C:\Users\admin\Desktop\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exe" C:\Users\admin\Desktop\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2668"C:\Users\admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER.exe" C:\Users\admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER.exe
NETFLIX Checker Account By X-KILLER.exe
User:
admin
Integrity Level:
HIGH
Description:
checker by X-KILLER
Exit code:
3762504530
Version:
1.0.0.0
2848"C:\Users\admin\AppData\Local\Temp\Chrome.exe" C:\Users\admin\AppData\Local\Temp\Chrome.exe
NETFLIX Checker Account By X-KILLER.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3228"C:\Users\admin\AppData\Roaming\Chrome.exe" C:\Users\admin\AppData\Roaming\Chrome.exe
Chrome.exe
User:
admin
Integrity Level:
HIGH
3972netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\Chrome.exe" "Chrome.exe" ENABLEC:\Windows\system32\netsh.exe—Chrome.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3796"C:\Windows\regedit.exe" C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1008"C:\Windows\regedit.exe" C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 065
Read events
1 520
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3004NETFLIX Checker Account By X-KILLER.exeC:\Users\admin\AppData\Local\Temp\Chrome.exeexecutable
MD5:A2D06601C7BF3F3D7214CE8ABE7C997F
SHA256:B56BB55344BEF45412EE43F801F984C98E90B11AF2C311826F4CDF50B8BAC2CD
3228Chrome.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4b2f8b456a14ab793e892dad306662bf.exeexecutable
MD5:A2D06601C7BF3F3D7214CE8ABE7C997F
SHA256:B56BB55344BEF45412EE43F801F984C98E90B11AF2C311826F4CDF50B8BAC2CD
2468WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2468.25251\NETFLIX Checker Account By X-KILLER\NETFLIX Checker Account By X-KILLER.exeexecutable
MD5:FF2826465C70ED2BCF9924588445EE08
SHA256:940169227A43458306B8A5827197EBEEA2D34B68CAFEA5BEC19CD1254357B653
2848Chrome.exeC:\Users\admin\AppData\Roaming\Chrome.exeexecutable
MD5:A2D06601C7BF3F3D7214CE8ABE7C997F
SHA256:B56BB55344BEF45412EE43F801F984C98E90B11AF2C311826F4CDF50B8BAC2CD
2468WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2468.25251\NETFLIX Checker Account By X-KILLER\xNet.dllexecutable
MD5:3DF8D87A482EFAD957D83819ADB3020F
SHA256:2AC175B4D44245EE8E7AEE9CC36DF86925EF903D8516F20A2C51D84E35F23DA4
3004NETFLIX Checker Account By X-KILLER.exeC:\Users\admin\AppData\Local\Temp\NETFLIX Checker Account By X-KILLER.exeexecutable
MD5:867F1FBC0A5D89A100D4FE867FA4B34F
SHA256:E22C7F85F00CC4A5219D23EAD9AE28897EBEA30D09B39387456C1F4FD4541CE5
2468WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2468.25251\NETFLIX Checker Account By X-KILLER\SkinSoft.VisualStyler.dllexecutable
MD5:2D84A619D4BD339F860CB48AF0C9B6C8
SHA256:365FFDE7DF914840EB21C96F34C39912A4B031E3814B8E902B67ACEE6DFF65A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3228
Chrome.exe
51.89.170.23:8172
yasserchar.ddns.net
—
GB
malicious

DNS requests

Domain
IP
Reputation
yasserchar.ddns.net
  • 51.89.170.23
malicious

Threats

PID
Process
Class
Message
3228
Chrome.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3228
Chrome.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3228
Chrome.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
9 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1.rar