download:

/simalei/njRAT/releases/download/v0.7D/NjRat.0.7D.Danger.Edition.zip

Full analysis: https://app.any.run/tasks/6cebc6e4-af22-494b-9729-83786782ecdd
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 01, 2024, 11:16:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
njrat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

18B9E23E509FF221EBB1B8A0CE4BC82B

SHA1:

BACAB6A415515E94B3083C4F7EBDA6A82E1D4C7F

SHA256:

4B649C32035E383706673FFE6471D6C711989A206D6F96FDD905DDA207A5F0CB

SSDEEP:

393216:miHDYl/45B6Jh6jtGFHAeFWs2AUSTPnUGeOiw6hlVoTzQaGQLMGqE5i:DYl/4r3g6C1UGGw6hlZrQLTqSi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NJRAT has been detected (YARA)

      • Server.exe (PID: 2884)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 128)

    • Reads the Internet Settings

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Server.exe (PID: 2884)

    • Suspicious files were dropped or overwritten

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Starts application with an unusual extension

      • Server.exe (PID: 2884)

    • Executing commands from a ".bat" file

      • Server.exe (PID: 2884)

    • Starts CMD.EXE for commands execution

      • Server.exe (PID: 2884)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 128)
      • ilasm.exe (PID: 2808)
      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 128)

    • Reads the computer name

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)
      • tmpFFAF.tmp.bat (PID: 3016)
      • tmp6918.tmp.bat (PID: 3212)

    • Manual execution by a user

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Reads Environment values

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Reads the machine GUID from the registry

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)
      • tmp6918.tmp.bat (PID: 3212)
      • tmpFFAF.tmp.bat (PID: 3016)

    • Checks supported languages

      • ilasm.exe (PID: 2808)
      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)
      • tmpFFAF.tmp.bat (PID: 3016)
      • tmp6918.tmp.bat (PID: 3212)

    • Create files in a temporary directory

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Creates files or folders in the user directory

      • Server.exe (PID: 2884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2884) Server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\defdb9704043a1f0f9a4a4d56b063e7b
Splitter|'|'|
Version0.7d
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:10:23 14:50:06
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ER/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs njrat 0.7d danger edition.exe ilasm.exe no specs #NJRAT server.exe netsh.exe no specs tmpffaf.tmp.bat no specs tmp6918.tmp.bat no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat.0.7D.Danger.Edition.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
584"C:\Users\admin\Desktop\NjRat 0.7D Danger Edition.exe" C:\Users\admin\Desktop\NjRat 0.7D Danger Edition.exe
explorer.exe
User:
admin
Company:
CTRIK BY Fransesco
Integrity Level:
HIGH
Description:
CTRIK BY Fransesco
Exit code:
0
Version:
0.0.0.7
Modules
Images
c:\users\admin\desktop\njrat 0.7d danger edition.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1812netsh firewall add allowedprogram "C:\Users\admin\Desktop\Server.exe" "Server.exe" ENABLEC:\Windows\System32\netsh.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2808"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe—NjRat 0.7D Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2884"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2884) Server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\defdb9704043a1f0f9a4a4d56b063e7b
Splitter|'|'|
Version0.7d
3016"C:\Users\admin\AppData\Local\Temp\tmpFFAF.tmp.bat" C:\Users\admin\AppData\Local\Temp\tmpFFAF.tmp.bat—Server.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Andex
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\tmpffaf.tmp.bat
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3128C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.bat" "C:\Windows\System32\cmd.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3212"C:\Users\admin\AppData\Local\Temp\tmp6918.tmp.bat" C:\Users\admin\AppData\Local\Temp\tmp6918.tmp.bat—Server.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Andex
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\tmp6918.tmp.bat
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 813
Read events
4 673
Write events
135
Delete events
5

Modification events

(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
47
Suspicious files
3
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\laxer.dlltext
MD5:E67EE9FA20340544E65BC2CFBA5D8192
SHA256:21AB187279045E81F550C170FDC8B73117F4E4DC2E608BDB80865540264FDAB6
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\logoff.dlltext
MD5:3D79995C5AF417FB5B26F78B02000F49
SHA256:2036A894B2C0EAEB684A56B5DA1E2BBF992FF50FBA536E606FB1ADADF6CDEC4C
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\maltExe.dlltext
MD5:94070806E01C1AE7FE2AAE46D929387A
SHA256:4F553023C9FDFEA5F806C86D6BDD40D94348843D4A4EFD91DC952A53229A4358
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\dromous.dlltext
MD5:1CC401169EF8CF1E8977F4E92DFE72C7
SHA256:32C699EBB7394DDB2D56F092EF10FDE4D9F4BCF808DBE11BAD777E7BC73F7AAE
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\destedmous.dlltext
MD5:86DB8AAA81D53BA3647175FA02AEC88D
SHA256:B7DFC64C735CB92F98937B9BB77CBEA0F8BC6BC94E3EF14155B2611A36482E25
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\windefnder.dlltext
MD5:E7470172EED4177D0044118746564736
SHA256:467C340BF310CEC9FA62EB6D9BC86592366BCD6CBC373977E1589357B5623AE7
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Bipe.dlltext
MD5:4992E2814A8597FB20B5282E568A032D
SHA256:C1C8AFDE84694F203EBB49766454CE17179E32C06A0BBDD272BF598C0D9B7C0E
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\prar.dlltext
MD5:ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA256:F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Delet A.dlltext
MD5:B256A2A73F8436243481712965F3FD48
SHA256:FD8802C66F18B5D7175BD3EAF628C652525605BE88B8149A37E7EC731F3AB963
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\infctcmd.dlltext
MD5:B72C081752F133CF07327F33FA4F819F
SHA256:E677FB6D2DA669557DF503EB45DE14C3D3ACF5509BB2005FCC4BE39AC975F2AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/simalei/njRAT/releases/download/v0.7D/NjRat.0.7D.Danger.Edition.zip