File name:

NjRat-Gold-Edition-For-Scool-project-master.zip

Full analysis: https://app.any.run/tasks/60548c6d-5a39-4e4c-94c4-be213587bac0
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 07, 2024, 01:11:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
securityxploded
njrat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

C1E7E3FF2D8700F5FA43E5F20BFE9F39

SHA1:

BBA014B17A47AA26A72343326A873026AA07A871

SHA256:

4B7C4524002AB26E034B3EAFB7DD7726763BFC58B0F1BDCAA2AB04E1A0BCC441

SSDEEP:

98304:j0s3Ju7tMtCimcE5Ec5Fk2VuSku+2A1C+CaJbMXWq3oq7fbh9G59m1d1YjeucCz4:u/Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NJRAT has been detected (YARA)

      • Server.exe (PID: 1900)

  • SUSPICIOUS

    • Reads the Internet Settings

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)

  • INFO

    • Manual execution by a user

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)
      • Server.exe (PID: 1900)

    • Checks supported languages

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)
      • Server.exe (PID: 1900)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 120)
      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)

    • SecurityXploded is detected

      • WinRAR.exe (PID: 120)

    • Reads the computer name

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)
      • Server.exe (PID: 1900)

    • Reads Environment values

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)

    • Create files in a temporary directory

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)

    • Reads the machine GUID from the registry

      • NjRat 0.7D Golden Edition - Rus.exe (PID: 2420)
      • Server.exe (PID: 1900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1900) Server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2022:03:25 08:05:12
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: NjRat-Gold-Edition-For-Scool-project-master/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe no specs njrat 0.7d golden edition - rus.exe no specs #NJRAT server.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\NjRat-Gold-Edition-For-Scool-project-master.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1900"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1900) Server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
2420"C:\Users\admin\Desktop\NjRat-Gold-Edition-For-Scool-project-master\NjRat 0.7D Golden Edition - Rus.exe" C:\Users\admin\Desktop\NjRat-Gold-Edition-For-Scool-project-master\NjRat 0.7D Golden Edition - Rus.exe—explorer.exe
User:
admin
Company:
Njrat 0.7d Golden Edition
Integrity Level:
MEDIUM
Description:
Njrat 0.7d Golden Edition
Exit code:
0
Version:
7.1.0.0
Modules
Images
c:\users\admin\desktop\njrat-gold-edition-for-scool-project-master\njrat 0.7d golden edition - rus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
5 792
Read events
5 736
Write events
53
Delete events
3

Modification events

(PID) Process:(120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2420) NjRat 0.7D Golden Edition - Rus.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
17
Suspicious files
1
Text files
16
Unknown types
1

Dropped files

PID
Process
Filename
Type
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\README.mdtext
MD5:9B0B840DF29039E50BE43BE8D328A877
SHA256:D9E2508D65923A160C21BE74A0FAF7210392C167F8F2DE0AFEFB17158B6F3C7E
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\Plugin\mic.dllexecutable
MD5:1607999C56366FC2096A27A8BD237B98
SHA256:7D327985D7E4F83ADFFBDF831C1E999C68CB90238790B63260AF19D24BFA66B8
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\Plugin\ch.dllexecutable
MD5:2490EDA5B4450138BA79F39FCC90048A
SHA256:3BC2898DA9CD9E202B7795B330FA3DAFF81A4B02AB4ECFE47FDD712C53252F12
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\Plugin\AntiProcess.dllexecutable
MD5:B21947A28760750689F46E071D575D07
SHA256:F643AB116E7BD8515032A502B8700AFB5BDBFC08FC1CAA08817B3061E98B763E
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\Mono.Cecil.dllexecutable
MD5:851EC9D84343FBD089520D420348A902
SHA256:CDADC26C09F869E21053EE1A0ACF3B2D11DF8EDD599FE9C377BD4D3CE1C9CDA9
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\InjectIcon.dllexecutable
MD5:83921E813F885AE1669AA0EFA21F8695
SHA256:98348FFE70A68F69D934118A2D14B86B382D698601827A4C1D322D878D36BBDC
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\NjRat 0.7D Golden Edition - Rus.exeexecutable
MD5:8D540934A359A0480DE188A748B3D573
SHA256:C81D701C3A4D6B7BCAA40F9C92A1BCFDF2F829954CF1CA15556712FBDC792834
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\Plugin\plg.dllexecutable
MD5:04CB30A874EE349721B0398594DE65FE
SHA256:6F8770A35EC0845226A28DD57C8AE414DC8814A6871BD0BB818BB13CA3B82106
120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa120.36190\NjRat-Gold-Edition-For-Scool-project-master\Plugin\pw.dllexecutable
MD5:872401528FC94C90F3DE6658E776CC36
SHA256:3A1CC072EFFD8C38406A6FDDF4D8F49C5366BB0E32071311D90DB669940987CE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRat-Gold-Edition-For-Scool-project-master.zip