File name:

738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zip

Full analysis: https://app.any.run/tasks/69a65ada-d38e-4fa0-9028-7ee4aba174c6
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 04:14:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
rat
njrat
bladabindi
remote
backdoor
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

31EE9EEC2E14D2034E60B97295C581BD

SHA1:

D848A75494752653E375F735E5E94FED3C7E246E

SHA256:

27E718684FF0F3E57DE11F270CE854CE0227858CCA44FC7746CD4FC15C2DE76B

SSDEEP:

384:uhsLUWmcg/gMsOdP3B9prX4KziBVb2Hw2B3sT1WVPzjcPkwqq9QRzeL75OmaL9z1:uhZWJg/ndP3RVGbIjCc8kiOKu9z7Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 616)

    • Create files in the Startup directory

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • NJRAT mutex has been found

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)
      • Server.exe (PID: 8180)

    • Uses Task Scheduler to run other applications

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • NJRAT has been detected (YARA)

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Connects to the CnC server

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • NJRAT has been detected (SURICATA)

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Changes the autorun value in the registry

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 616)

    • Connects to unusual port

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Executable content was dropped or overwritten

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Contacting a server suspected of hosting an CnC

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • The process executes via Task Scheduler

      • Server.exe (PID: 8180)

  • INFO

    • Creates files or folders in the user directory

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Reads the machine GUID from the registry

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Checks supported languages

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)
      • Server.exe (PID: 8180)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 616)

    • Create files in a temporary directory

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)

    • Reads the computer name

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 7680)
      • Server.exe (PID: 8180)

    • Reads the software policy settings

      • slui.exe (PID: 7256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(7680) 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
C2213.209.150.210
Ports7773
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:13 07:18:36
ZipCRC: 0x6e901c3c
ZipCompressedSize: 18143
ZipUncompressedSize: 44032
ZipFileName: 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #NJRAT 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe schtasks.exe no specs conhost.exe no specs slui.exe no specs #NJRAT server.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7224C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7256"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7680"C:\Users\admin\AppData\Local\Temp\Rar$EXb616.49761\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb616.49761\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb616.49761\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
NjRat
(PID) Process(7680) 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
C2213.209.150.210
Ports7773
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
7732schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\admin\AppData\Local\Temp/Server.exeC:\Windows\SysWOW64\schtasks.exe—738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
7740\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8144C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8180"C:\Users\admin\AppData\Local\Temp/Server.exe"C:\Users\admin\AppData\Local\Temp\Server.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
3 280
Read events
3 177
Write events
103
Delete events
0

Modification events

(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zip
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7680) 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7680738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeC:\Users\admin\AppData\Local\Temp\Server.exeexecutable
MD5:53F7FEBA7E2C1D0C4CDEC05C0EFFDE75
SHA256:738CDD5B562A3FBBE9A625DD47BA1225764AF8F8EBC44B85EF88CA3615C6C784
7680738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exeexecutable
MD5:53F7FEBA7E2C1D0C4CDEC05C0EFFDE75
SHA256:738CDD5B562A3FBBE9A625DD47BA1225764AF8F8EBC44B85EF88CA3615C6C784
616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb616.49761\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeexecutable
MD5:53F7FEBA7E2C1D0C4CDEC05C0EFFDE75
SHA256:738CDD5B562A3FBBE9A625DD47BA1225764AF8F8EBC44B85EF88CA3615C6C784
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
13
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7924
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.2
  • 40.126.31.131
  • 40.126.31.3
  • 20.190.159.71
  • 40.126.31.2
  • 40.126.31.71
  • 40.126.31.128
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

PID
Process
Class
Message
7680
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
7680
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
7680
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zip