download:

/simalei/njRAT/releases/download/v0.7D/NjRat.0.7D.Danger.Edition.zip

Full analysis: https://app.any.run/tasks/6cebc6e4-af22-494b-9729-83786782ecdd
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 01, 2024, 11:16:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
njrat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

18B9E23E509FF221EBB1B8A0CE4BC82B

SHA1:

BACAB6A415515E94B3083C4F7EBDA6A82E1D4C7F

SHA256:

4B649C32035E383706673FFE6471D6C711989A206D6F96FDD905DDA207A5F0CB

SSDEEP:

393216:miHDYl/45B6Jh6jtGFHAeFWs2AUSTPnUGeOiw6hlVoTzQaGQLMGqE5i:DYl/4r3g6C1UGGw6hlZrQLTqSi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NJRAT has been detected (YARA)

      • Server.exe (PID: 2884)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 128)

    • Reads the Internet Settings

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Server.exe (PID: 2884)

    • Suspicious files were dropped or overwritten

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Starts CMD.EXE for commands execution

      • Server.exe (PID: 2884)

    • Starts application with an unusual extension

      • Server.exe (PID: 2884)

    • Executing commands from a ".bat" file

      • Server.exe (PID: 2884)

  • INFO

    • Checks supported languages

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • ilasm.exe (PID: 2808)
      • Server.exe (PID: 2884)
      • tmpFFAF.tmp.bat (PID: 3016)
      • tmp6918.tmp.bat (PID: 3212)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 128)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 128)
      • ilasm.exe (PID: 2808)
      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Reads the computer name

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)
      • tmp6918.tmp.bat (PID: 3212)
      • tmpFFAF.tmp.bat (PID: 3016)

    • Reads the machine GUID from the registry

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)
      • tmpFFAF.tmp.bat (PID: 3016)
      • tmp6918.tmp.bat (PID: 3212)

    • Manual execution by a user

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Reads Environment values

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Create files in a temporary directory

      • NjRat 0.7D Danger Edition.exe (PID: 584)
      • Server.exe (PID: 2884)

    • Creates files or folders in the user directory

      • Server.exe (PID: 2884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2884) Server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\defdb9704043a1f0f9a4a4d56b063e7b
Splitter|'|'|
Version0.7d
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:10:23 14:50:06
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ER/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs njrat 0.7d danger edition.exe ilasm.exe no specs #NJRAT server.exe netsh.exe no specs tmpffaf.tmp.bat no specs tmp6918.tmp.bat no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat.0.7D.Danger.Edition.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
584"C:\Users\admin\Desktop\NjRat 0.7D Danger Edition.exe" C:\Users\admin\Desktop\NjRat 0.7D Danger Edition.exe
explorer.exe
User:
admin
Company:
CTRIK BY Fransesco
Integrity Level:
HIGH
Description:
CTRIK BY Fransesco
Exit code:
0
Version:
0.0.0.7
Modules
Images
c:\users\admin\desktop\njrat 0.7d danger edition.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1812netsh firewall add allowedprogram "C:\Users\admin\Desktop\Server.exe" "Server.exe" ENABLEC:\Windows\System32\netsh.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2808"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe—NjRat 0.7D Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2884"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2884) Server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\defdb9704043a1f0f9a4a4d56b063e7b
Splitter|'|'|
Version0.7d
3016"C:\Users\admin\AppData\Local\Temp\tmpFFAF.tmp.bat" C:\Users\admin\AppData\Local\Temp\tmpFFAF.tmp.bat—Server.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Andex
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\tmpffaf.tmp.bat
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3128C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.bat" "C:\Windows\System32\cmd.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3212"C:\Users\admin\AppData\Local\Temp\tmp6918.tmp.bat" C:\Users\admin\AppData\Local\Temp\tmp6918.tmp.bat—Server.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Andex
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\tmp6918.tmp.bat
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 813
Read events
4 673
Write events
135
Delete events
5

Modification events

(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
47
Suspicious files
3
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\User.dlltext
MD5:456C3E1669D900EBE41355349DEB28E0
SHA256:E4125F396993EA0876F3FFA9BFFC46134DD20D7C8E4D077DDADEE67B6CA33ABE
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Delettemp.dlltext
MD5:5FCE1E96BF39CD18EDE1C35B48A90B43
SHA256:5CBEA0F270BC1D57E2231A4D2D5E5D8323710D5757E714D5559E90DC86432C93
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\laxer.dlltext
MD5:E67EE9FA20340544E65BC2CFBA5D8192
SHA256:21AB187279045E81F550C170FDC8B73117F4E4DC2E608BDB80865540264FDAB6
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Abrairnotes.dlltext
MD5:CAD085EB4A51B05D3F2905C9A2996FEC
SHA256:321FCF894E5A1853FFB430624D3085F04025563E8E5D8AE1C9C28DBCE93D5F93
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Abrier.dlltext
MD5:5514B7E5A95E10C6D37278BB973651B2
SHA256:ED0AA6ECBB2D5D6EF3B8431D13D4562D89C2E1C88636C22DBBBBEA81E32F913D
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Apraircam.dlltext
MD5:CC795C9C4A83AA1EDE067F96F1EB8D15
SHA256:37D23694738615464BE8A3234BCC59592987432C8863DB67E30385B8BB3EF450
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\Bipe.dlltext
MD5:4992E2814A8597FB20B5282E568A032D
SHA256:C1C8AFDE84694F203EBB49766454CE17179E32C06A0BBDD272BF598C0D9B7C0E
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\maltExe.dlltext
MD5:94070806E01C1AE7FE2AAE46D929387A
SHA256:4F553023C9FDFEA5F806C86D6BDD40D94348843D4A4EFD91DC952A53229A4358
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\trafs.dlltext
MD5:08C12660D57FB1679A2A881FFEA7A929
SHA256:FC41E3B41DFE50D5CA916EE4800A122DA3744754E6BC16F7AEB8DBFCDB48862E
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa128.29029\ER\logoff.dlltext
MD5:3D79995C5AF417FB5B26F78B02000F49
SHA256:2036A894B2C0EAEB684A56B5DA1E2BBF992FF50FBA536E606FB1ADADF6CDEC4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/simalei/njRAT/releases/download/v0.7D/NjRat.0.7D.Danger.Edition.zip