File name:

Cobra Crypter 2019.zip

Full analysis: https://app.any.run/tasks/8896212e-12ee-4ac9-8e50-92bd776d72e5
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: September 07, 2019, 18:42:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0B53220BF4DBE6BA60E0F26CBA88EA93

SHA1:

B68B1EF55C041C375EF627E89AF29B1A84C2D8E9

SHA256:

3C0CB0FE3E3A8ACC447B4CF9BC2C042A2A73BC38FD2C2C93D53095F5E22B7290

SSDEEP:

49152:9ouOsHrseCJDBVt+pe+ZDKrJdP9R4EKeWi9VxLgnjAG+q1eS1YwgoOJeVmt5:73HweODBVtO78lR4iWoKjAjq1T9g0on

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Cobra Crypter 2019.exe (PID: 3228)
      • Cobra-Crypter.exe (PID: 2492)
      • Cobra Crypter 2019.exe (PID: 2752)
      • AgJeB.exe (PID: 2544)
      • AgJeB.exe (PID: 1440)
      • AgJeB.exe (PID: 2344)
      • AgJeB.exe (PID: 3672)
      • AgJeB.exe (PID: 3848)
      • QzKyR.exe (PID: 3960)
      • AgJeB.exe (PID: 3368)
      • QzKyR.exe (PID: 3800)
      • Interface Microsoft Windows Search.exe (PID: 3972)
      • QzKyR.exe (PID: 2064)
      • TempInterface Microsoft Windows Search.exe (PID: 3908)
      • TempInterface Microsoft Windows Search.exe (PID: 3016)
      • Interface Microsoft Windows Search.exe (PID: 3576)

    • Disables Windows Defender

      • Cobra-Crypter.exe (PID: 2492)

    • Starts Visual C# compiler

      • Cobra Crypter 2019.exe (PID: 2752)

    • Writes to a start menu file

      • Interface Microsoft Windows Search.exe (PID: 3972)

    • Connects to CnC server

      • Interface Microsoft Windows Search.exe (PID: 3972)

    • Changes the autorun value in the registry

      • Interface Microsoft Windows Search.exe (PID: 3972)

    • NJRAT was detected

      • Interface Microsoft Windows Search.exe (PID: 3972)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3604)
      • Cobra Crypter 2019.exe (PID: 3228)
      • csc.exe (PID: 3372)
      • Cobra Crypter 2019.exe (PID: 2752)
      • csc.exe (PID: 2528)
      • TempInterface Microsoft Windows Search.exe (PID: 3016)
      • Interface Microsoft Windows Search.exe (PID: 3972)

    • Executes PowerShell scripts

      • Cobra-Crypter.exe (PID: 2492)

    • Creates files in the user directory

      • powershell.exe (PID: 2232)
      • Interface Microsoft Windows Search.exe (PID: 3972)

    • Application launched itself

      • AgJeB.exe (PID: 1440)
      • AgJeB.exe (PID: 3848)
      • QzKyR.exe (PID: 3960)
      • TempInterface Microsoft Windows Search.exe (PID: 3908)
      • Interface Microsoft Windows Search.exe (PID: 3576)

    • Starts itself from another location

      • TempInterface Microsoft Windows Search.exe (PID: 3016)

    • Uses NETSH.EXE for network configuration

      • Interface Microsoft Windows Search.exe (PID: 3972)

  • INFO

    • Manual execution by user

      • Cobra Crypter 2019.exe (PID: 3228)
      • AgJeB.exe (PID: 2544)
      • AgJeB.exe (PID: 1440)
      • AgJeB.exe (PID: 3672)
      • QzKyR.exe (PID: 3800)
      • QzKyR.exe (PID: 3960)
      • AgJeB.exe (PID: 3848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2019:06:24 01:00:08
ZipCRC: 0x9db09254
ZipCompressedSize: 2531529
ZipUncompressedSize: 2813952
ZipFileName: Cobra Crypter 2019.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
23
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winrar.exe cobra crypter 2019.exe cobra-crypter.exe no specs cobra crypter 2019.exe powershell.exe no specs csc.exe cvtres.exe no specs agjeb.exe no specs agjeb.exe agjeb.exe no specs csc.exe agjeb.exe no specs agjeb.exe agjeb.exe no specs cvtres.exe no specs qzkyr.exe no specs qzkyr.exe qzkyr.exe no specs tempinterface microsoft windows search.exe no specs tempinterface microsoft windows search.exe interface microsoft windows search.exe no specs #NJRAT interface microsoft windows search.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1440"C:\Users\admin\Desktop\AgJeB.exe" C:\Users\admin\Desktop\AgJeB.exe
explorer.exe
User:
admin
Company:
Cobra Inc.
Integrity Level:
HIGH
Description:
Setup
Exit code:
0
Version:
2.21.19.529
Modules
Images
c:\users\admin\desktop\agjeb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2064"{path}"C:\Users\admin\Desktop\QzKyR.exe—QzKyR.exe
User:
admin
Company:
Cobra Inc.
Integrity Level:
HIGH
Description:
Setup
Exit code:
3221225784
Version:
2.21.19.529
Modules
Images
c:\users\admin\desktop\qzkyr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2232"powershell" Get-MpPreference -verboseC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Cobra-Crypter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2344"{path}"C:\Users\admin\Desktop\AgJeB.exe—AgJeB.exe
User:
admin
Company:
Cobra Inc.
Integrity Level:
HIGH
Description:
Setup
Exit code:
0
Version:
2.21.19.529
Modules
Images
c:\users\admin\desktop\agjeb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2492"C:\Users\admin\AppData\Local\Temp\Cobra-Crypter.exe" 0C:\Users\admin\AppData\Local\Temp\Cobra-Crypter.exe—Cobra Crypter 2019.exe
User:
admin
Company:
Cobra
Integrity Level:
HIGH
Description:
Cobra Crypter 2019
Exit code:
0
Version:
1.2.0.3
Modules
Images
c:\users\admin\appdata\local\temp\cobra-crypter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2528"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\pjxsptdf\pjxsptdf.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
Cobra Crypter 2019.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2544"C:\Users\admin\Desktop\AgJeB.exe" C:\Users\admin\Desktop\AgJeB.exe—explorer.exe
User:
admin
Company:
Cobra Inc.
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
3221226540
Version:
2.21.19.529
Modules
Images
c:\users\admin\desktop\agjeb.exe
c:\systemroot\system32\ntdll.dll
2632C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESB68F.tmp" "c:\Users\admin\Desktop\CSCB68E.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2752"C:\Users\admin\AppData\Local\Temp\Cobra Crypter 2019.exe" 0C:\Users\admin\AppData\Local\Temp\Cobra Crypter 2019.exe
Cobra Crypter 2019.exe
User:
admin
Company:
Cobra Crypter
Integrity Level:
HIGH
Description:
Cobra Crypter
Exit code:
0
Version:
1.1.0.2
Modules
Images
c:\users\admin\appdata\local\temp\cobra crypter 2019.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2784C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES83E2.tmp" "c:\Users\admin\Desktop\CSC83E1.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
Total events
2 571
Read events
2 008
Write events
557
Delete events
6

Modification events

(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Cobra Crypter 2019.zip
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2232) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
10
Suspicious files
2
Text files
7
Unknown types
12

Dropped files

PID
Process
Filename
Type
2232powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U9O92SHZ38LVP001HWU9.temp —
MD5:—
SHA256:—
3372csc.exeC:\Users\admin\Desktop\CSCB68E.tmp —
MD5:—
SHA256:—
2632cvtres.exeC:\Users\admin\AppData\Local\Temp\RESB68F.tmp —
MD5:—
SHA256:—
3372csc.exeC:\Users\admin\AppData\Local\Temp\qbmcqg1p\qbmcqg1p.out —
MD5:—
SHA256:—
2752Cobra Crypter 2019.exeC:\Users\admin\AppData\Local\Temp\pjxsptdf\pjxsptdf.0.cs —
MD5:—
SHA256:—
3604WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3604.29217\Cobra Crypter 2019.exeexecutable
MD5:—
SHA256:—
2528csc.exeC:\Users\admin\Desktop\CSC83E1.tmp —
MD5:—
SHA256:—
2784cvtres.exeC:\Users\admin\AppData\Local\Temp\RES83E2.tmp —
MD5:—
SHA256:—
1440AgJeB.exeC:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1log
MD5:—
SHA256:—
2528csc.exeC:\Users\admin\AppData\Local\Temp\pjxsptdf\pjxsptdf.out —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
11

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3972
Interface Microsoft Windows Search.exe
79.134.225.122:10140
fal92.duckdns.org
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

Domain
IP
Reputation
fal92.duckdns.org
  • 79.134.225.122
malicious

Threats

PID
Process
Class
Message
1060
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT/Bladabindi
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Capture)
3972
Interface Microsoft Windows Search.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
3 ETPRO signatures available at the full report
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Cobra Crypter 2019.zip