File name:

NjRat Builder.7z

Full analysis: https://app.any.run/tasks/9ed9de7f-4dfe-4f25-b02b-b77a01b029e0
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 29, 2023, 12:36:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
securityxploded
rat
njrat
bladabindi
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

B80CD3589E08AB120E4CADED272EDCD9

SHA1:

C288255C0E171476974D26D53B508B13710672C0

SHA256:

41542DFC3594967B151C43E18FCE9194B656AB0B6EADA7F4C3C126A5A3EC2197

SSDEEP:

98304:MMtGs/pGWxyfx6LIaANx4ttsafu6bayPlsvMl2FACv0pVuorPltbTIspT+y19A3+:zQ6/PSw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • server.exe (PID: 1192)

    • NjRAT is detected

      • server.exe (PID: 1192)

    • Changes the autorun value in the registry

      • server.exe (PID: 1192)

    • NJRAT has been detected (YARA)

      • server.exe (PID: 1192)

  • SUSPICIOUS

    • Reads the Internet Settings

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • Server.exe (PID: 1956)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • server.exe (PID: 1192)

    • Uses TASKKILL.EXE to kill process

      • server.exe (PID: 1192)

    • The system shut down or reboot

      • server.exe (PID: 1192)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 116)
      • ilasm.exe (PID: 2672)
      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)

    • Reads Environment values

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • server.exe (PID: 1192)

    • Checks supported languages

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • ilasm.exe (PID: 2672)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • Reads the computer name

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • SecurityXploded is detected

      • WinRAR.exe (PID: 116)

    • Manual execution by a user

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • Server.exe (PID: 1956)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)
      • iexplore.exe (PID: 3244)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)

    • Reads the machine GUID from the registry

      • njRAT v0.7d.exe (PID: 2568)
      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • Create files in a temporary directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • Server.exe (PID: 1956)

    • Starts itself from another location

      • Server.exe (PID: 1956)

    • Creates files or folders in the user directory

      • server.exe (PID: 1192)

    • Application launched itself

      • iexplore.exe (PID: 3244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1192) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f8782a013a20610e09216f21b705d856
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe no specs njrat 0.7d green edition by im523.exe no specs njrat v0.7d.exe no specs ilasm.exe no specs server.exe no specs #NJRAT server.exe netsh.exe no specs taskkill.exe no specs shutdown.exe no specs iexplore.exe iexplore.exe no specs njrat 0.7d green edition by im523.exe no specs njrat 0.7d green edition by im523.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\NjRat Builder.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1192"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
Server.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1192) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f8782a013a20610e09216f21b705d856
Splitter|'|'|
Versionim523
1636"C:\Users\admin\Desktop\BuilderNjRat\NjRat.07d\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\BuilderNjRat\NjRat.07d\NjRat 0.7D Green Edition by im523.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NjRat 0.7D Green Edition by im523
Exit code:
0
Version:
0.0.0.7
Modules
Images
c:\users\admin\desktop\buildernjrat\njrat.07d\njrat 0.7d green edition by im523.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1956"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2508netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2568"C:\Users\admin\Desktop\BuilderNjRat\njRAT v0.7\njRAT v0.7d.exe" C:\Users\admin\Desktop\BuilderNjRat\njRAT v0.7\njRAT v0.7d.exe—explorer.exe
User:
admin
Company:
njq8
Integrity Level:
MEDIUM
Description:
njRAT
Exit code:
3221225547
Version:
0.7.0.0
Modules
Images
c:\users\admin\desktop\buildernjrat\njrat v0.7\njrat v0.7d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2672"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe—NjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3060taskkill /F /IM Exsample.exeC:\Windows\System32\taskkill.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3096shutdown -l -t 00C:\Windows\System32\shutdown.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
3244"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
15 791
Read events
15 437
Write events
349
Delete events
5

Modification events

(PID) Process:(116) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1636) NjRat 0.7D Green Edition by im523.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
39
Suspicious files
13
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.6.4\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.6.4\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\LICENSEtext
MD5:D88E9E08385D2A17052DAC348BDE4BC1
SHA256:6B0382B16279F26FF69014300541967A356A666EB0B91B422F6862F6B7DAD17E
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\README.mdtext
MD5:D621EF72336F55A09C80B055A91DD13D
SHA256:4B55045ACC6B7CFE93341DEB62283DAF14EC4C4E7F13DEF8E40E02FA2B3A97CC
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.5.0\Plugin\ch.dllexecutable
MD5:1CB8FA647355805F2AE6A7E6BB71B138
SHA256:89A1BBE42CDE01DDFE531D69DD6EA6575296096010400CB63CBF4999ECA52E52
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\Stub.iltext
MD5:3575ABF7AB346EC4039138FAD1FAB4B7
SHA256:ED79411707D5A9925F1146E595983804E4EEAFE35E72EB51703908EFF13CC073
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\Sound\Sound.wavbinary
MD5:562FB3B4B1B1EAFD2CF107F2E92E0670
SHA256:5FF592B183B2C990448F1DCD842A29CFE17A3EAA9956E0135C945C578676344A
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.5.0\Plugin\cam.dllexecutable
MD5:3572E88B68EBFA1DD46A886E763499DE
SHA256:9097D4EDFDBDAA57F0F1177F325E8C1394D84D402355AECF29BD5C574790D597
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.5.0\Plugin\fm.dllexecutable
MD5:2CB7C35BBCA55CCC50B11FAE2BA37C97
SHA256:BBF43894F913DDF014B09B0EAD4CF9EDBCBF7F1A728884FFFDF2AF8B84BF2F67
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3244
iexplore.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b760a1c8c8f99fe1
unknown
compressed
4.66 Kb
unknown
3244
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
3244
iexplore.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5343d09680a02013
unknown
compressed
4.66 Kb
unknown
3244
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3244
iexplore.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
unknown
3244
iexplore.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3244
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3244
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.179
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.136
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.194
  • 184.24.77.202
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRat Builder.7z