analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Sporty-God_1_0_0_10.zip

Full analysis: https://app.any.run/tasks/42434ed4-83f1-4332-90bb-a2bd2b2fc61b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: August 13, 2019, 23:11:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

52ADC1809B72AAB3F90FAAEB0047929E

SHA1:

164D0C9A72D2F3E23EE11E97241E547247B9F637

SHA256:

5C172C0D6CF68286885ECF1068F077A5E2C712F3A931DFEC984F8E4AD53625CD

SSDEEP:

98304:/950pFuw0Cgoa+PnRnyD8RndSjh/LFWZljxCLWss95IMV9qn:gVgd2nyYRdAh/5olQLWssjr0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2880)

    • Known privilege escalation attack

      • Sporty-God Cracked.exe (PID: 1876)

    • Application was dropped or rewritten from another process

      • Sporty-God Cracked.exe (PID: 2140)
      • Sporty-God Cracked.exe (PID: 1876)
      • Sporty-God Cracked.exe (PID: 3876)

    • Changes the autorun value in the registry

      • Sporty-God Cracked.exe (PID: 3876)

    • NJRAT was detected

      • RegAsm.exe (PID: 2488)

  • SUSPICIOUS

    • Modifies the open verb of a shell class

      • Sporty-God Cracked.exe (PID: 1876)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2596)
      • Sporty-God Cracked.exe (PID: 2140)
      • Sporty-God Cracked.exe (PID: 3876)

    • Creates files in the Windows directory

      • Sporty-God Cracked.exe (PID: 2140)

    • Creates files in the user directory

      • Sporty-God Cracked.exe (PID: 3876)

    • Uses NETSH.EXE for network configuration

      • RegAsm.exe (PID: 2488)

  • INFO

    • Manual execution by user

      • Sporty-God Cracked.exe (PID: 1876)

    • Reads settings of System Certificates

      • Sporty-God Cracked.exe (PID: 2140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Sporty-God_1_0_0_10/BouncyCastle.Crypto.dll
ZipUncompressedSize: 2371584
ZipCompressedSize: 816486
ZipCRC: 0xbc7abe51
ZipModifyDate: 2019:05:16 13:39:17
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs sporty-god cracked.exe no specs eventvwr.exe no specs eventvwr.exe sporty-god cracked.exe sporty-god cracked.exe #NJRAT regasm.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2596"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sporty-God_1_0_0_10.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2880"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe13_ Global\UsGthrCtrlFltPipeMssGthrPipe13 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
1876"C:\Users\admin\Desktop\Sporty-God_1_0_0_10\Sporty-God Cracked.exe" C:\Users\admin\Desktop\Sporty-God_1_0_0_10\Sporty-God Cracked.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Explorateur Windows
Exit code:
0
Version:
...
3724"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—Sporty-God Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
768"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
Sporty-God Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3876"C:\Users\admin\Desktop\Sporty-God_1_0_0_10\Sporty-God Cracked.exe" C:\Users\admin\Desktop\Sporty-God_1_0_0_10\Sporty-God Cracked.exe
eventvwr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Explorateur Windows
Version:
...
2140"C:\Users\admin\AppData\Local\Temp\Sporty-God Cracked.exe"C:\Users\admin\AppData\Local\Temp\Sporty-God Cracked.exe
Sporty-God Cracked.exe
User:
admin
Integrity Level:
HIGH
Description:
L-Check Reborn
Exit code:
1
Version:
1.0.0.0
2488"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Sporty-God Cracked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2736netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLEC:\Windows\system32\netsh.exe—RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 663
Read events
1 491
Write events
0
Delete events
0

Modification events

No data
Executable files
15
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2596.43970\Sporty-God_1_0_0_10\MimeKit.dll —
MD5:—
SHA256:—
2596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2596.43970\Sporty-God_1_0_0_10\Newtonsoft.Json.dll —
MD5:—
SHA256:—
2596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2596.43970\Sporty-God_1_0_0_10\Sporty-God Cracked.exe —
MD5:—
SHA256:—
2596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2596.43970\Sporty-God_1_0_0_10\xNet.dll —
MD5:—
SHA256:—
2140Sporty-God Cracked.exeC:\Users\admin\AppData\Local\Temp\evb2D6F.tmpexecutable
MD5:03713C0EBC505DCBBB1EFC8609B55FE9
SHA256:EA16884C5C0B617CE937B7D79F83C0910336CF9C27E1DADC8241FDC6D24D07F9
2140Sporty-God Cracked.exeC:\Users\admin\AppData\Local\Temp\evb2D6E.tmpexecutable
MD5:03713C0EBC505DCBBB1EFC8609B55FE9
SHA256:EA16884C5C0B617CE937B7D79F83C0910336CF9C27E1DADC8241FDC6D24D07F9
2140Sporty-God Cracked.exeC:\Users\admin\AppData\Local\Temp\evb2D80.tmpexecutable
MD5:03713C0EBC505DCBBB1EFC8609B55FE9
SHA256:EA16884C5C0B617CE937B7D79F83C0910336CF9C27E1DADC8241FDC6D24D07F9
2140Sporty-God Cracked.exeC:\Users\admin\AppData\Local\Temp\evb2D81.tmpexecutable
MD5:03713C0EBC505DCBBB1EFC8609B55FE9
SHA256:EA16884C5C0B617CE937B7D79F83C0910336CF9C27E1DADC8241FDC6D24D07F9
3876Sporty-God Cracked.exeC:\Users\admin\AppData\Local\Temp\Sporty-God Cracked.exeexecutable
MD5:F6DEFA689CD39E2DA967E97BDB04B573
SHA256:C4E534C31CC1BA6B3BD368136E693067BC5EFBD9CD3006937CB210729A2C6F2B
3876Sporty-God Cracked.exeC:\Users\admin\AppData\Roaming\Update\Windows updateexecutable
MD5:102AA29E11A619E321CE3424F955EE4A
SHA256:8EBE616AB5822A870A330CF7456A34C89B7EA73314905B8F6FA60985A739B112
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2140
Sporty-God Cracked.exe
104.24.1.112:443
cracked.to
Cloudflare Inc
US
shared
—
—
172.111.154.46:5557
ninja5557.ddns.net
AltusHost B.V.
GB
malicious

DNS requests

Domain
IP
Reputation
cracked.to
  • 104.24.1.112
  • 104.24.2.112
whitelisted
ninja5557.ddns.net
  • 172.111.154.46
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Sporty-God_1_0_0_10.zip