File name:

738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zip

Full analysis: https://app.any.run/tasks/97dae46b-b3be-4203-8fe1-31b58ebb9b87
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 04:11:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
rat
njrat
bladabindi
remote
backdoor
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

31EE9EEC2E14D2034E60B97295C581BD

SHA1:

D848A75494752653E375F735E5E94FED3C7E246E

SHA256:

27E718684FF0F3E57DE11F270CE854CE0227858CCA44FC7746CD4FC15C2DE76B

SSDEEP:

384:uhsLUWmcg/gMsOdP3B9prX4KziBVb2Hw2B3sT1WVPzjcPkwqq9QRzeL75OmaL9z1:uhZWJg/ndP3RVGbIjCc8kiOKu9z7Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 3884)

    • Uses Task Scheduler to run other applications

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • NJRAT mutex has been found

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)
      • Server.exe (PID: 720)

    • Create files in the Startup directory

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • NJRAT has been detected (SURICATA)

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Connects to the CnC server

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • NJRAT has been detected (YARA)

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Changes the autorun value in the registry

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3884)

    • Executable content was dropped or overwritten

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Connects to unusual port

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Contacting a server suspected of hosting an CnC

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • The process executes via Task Scheduler

      • Server.exe (PID: 720)

  • INFO

    • Checks supported languages

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)
      • Server.exe (PID: 720)

    • Reads the computer name

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)
      • Server.exe (PID: 720)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3884)

    • Create files in a temporary directory

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Creates files or folders in the user directory

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Reads the machine GUID from the registry

      • 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe (PID: 1280)

    • Reads the software policy settings

      • slui.exe (PID: 7148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1280) 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
C2213.209.150.210
Ports7773
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:13 07:18:36
ZipCRC: 0x6e901c3c
ZipCompressedSize: 18143
ZipUncompressedSize: 44032
ZipFileName: 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #NJRAT 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe schtasks.exe no specs conhost.exe no specs slui.exe no specs #NJRAT server.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Users\admin\AppData\Local\Temp/Server.exe"C:\Users\admin\AppData\Local\Temp\Server.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Users\admin\AppData\Local\Temp\Rar$EXb3884.31477\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3884.31477\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3884.31477\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
NjRat
(PID) Process(1280) 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
C2213.209.150.210
Ports7773
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
1348C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3884"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5376schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\admin\AppData\Local\Temp/Server.exeC:\Windows\SysWOW64\schtasks.exe—738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5956C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7148"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 256
Read events
3 159
Write events
97
Delete events
0

Modification events

(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(1280) 738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1280738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exeexecutable
MD5:53F7FEBA7E2C1D0C4CDEC05C0EFFDE75
SHA256:738CDD5B562A3FBBE9A625DD47BA1225764AF8F8EBC44B85EF88CA3615C6C784
3884WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3884.31477\738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeexecutable
MD5:53F7FEBA7E2C1D0C4CDEC05C0EFFDE75
SHA256:738CDD5B562A3FBBE9A625DD47BA1225764AF8F8EBC44B85EF88CA3615C6C784
1280738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exeC:\Users\admin\AppData\Local\Temp\Server.exeexecutable
MD5:53F7FEBA7E2C1D0C4CDEC05C0EFFDE75
SHA256:738CDD5B562A3FBBE9A625DD47BA1225764AF8F8EBC44B85EF88CA3615C6C784
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4120
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4120
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4120
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.28
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.0
  • 40.126.31.131
  • 40.126.31.67
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
1280
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
1280
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
1280
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
738cdd5b562a3fbbe9a625dd47ba1225764af8f8ebc44b85ef88ca3615c6c784.zip