analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

NjRat 0.7D Original.zip

Full analysis: https://app.any.run/tasks/54ade333-6e2d-46eb-bbad-babb70336c7d
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: November 16, 2019, 11:53:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

11241DF31EF43FCF87B2AAAC9BEE8E3F

SHA1:

F65CCB1C9EACE279E75B0AFC4B07F4F2D287F98E

SHA256:

5DE4D558D0A0FD47A63BE59A454CC6C7E20931FFC555CF0B9F8208F7614C00D0

SSDEEP:

24576:MPUTdAxl7MtTB+0effocgIWXOy5mXMwA8Gq8pBn974iaMGHKhyAUK:Ms2D7Mv+0efhgIGmfA8H8p/74w8ru

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • njRAT v0.7d.exe (PID: 2304)
      • SearchProtocolHost.exe (PID: 3528)

    • Application was dropped or rewritten from another process

      • njRAT v0.7d.exe (PID: 2304)
      • Server.exe (PID: 3784)
      • server.exe (PID: 3760)

    • NJRAT was detected

      • server.exe (PID: 3760)

    • Changes the autorun value in the registry

      • server.exe (PID: 3760)

    • Writes to a start menu file

      • server.exe (PID: 3760)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2108)
      • ilasm.exe (PID: 3004)
      • njRAT v0.7d.exe (PID: 2304)
      • Server.exe (PID: 3784)
      • server.exe (PID: 3760)

    • Creates files in the user directory

      • Server.exe (PID: 3784)
      • server.exe (PID: 3760)

    • Starts itself from another location

      • Server.exe (PID: 3784)

    • Uses NETSH.EXE for network configuration

      • server.exe (PID: 3760)

  • INFO

    • Manual execution by user

      • njRAT v0.7d.exe (PID: 2304)
      • Server.exe (PID: 3784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2019:11:11 14:35:24
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: NjRat 0.7D Original/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs njrat v0.7d.exe ilasm.exe server.exe #NJRAT server.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2108"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat 0.7D Original.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3528"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2304"C:\Users\admin\Desktop\NjRat 0.7D Original\njRAT v0.7d.exe" C:\Users\admin\Desktop\NjRat 0.7D Original\njRAT v0.7d.exe
explorer.exe
User:
admin
Company:
njq8
Integrity Level:
MEDIUM
Description:
njRAT
Version:
0.7.0.0
3004"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\NjRat 0.7D Original\Server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
njRAT v0.7d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
3784"C:\Users\admin\Desktop\NjRat 0.7D Original\Server.exe" C:\Users\admin\Desktop\NjRat 0.7D Original\Server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3760"C:\Users\admin\AppData\Roaming\server.exe" C:\Users\admin\AppData\Roaming\server.exe
Server.exe
User:
admin
Integrity Level:
MEDIUM
2768netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\server.exe" "server.exe" ENABLEC:\Windows\system32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 896
Read events
1 727
Write events
0
Delete events
0

Modification events

No data
Executable files
12
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3004ilasm.exeC:\Users\admin\Desktop\NjRat 0.7D Original\Server.pdb —
MD5:—
SHA256:—
2304njRAT v0.7d.exeC:\Users\admin\Desktop\NjRat 0.7D Original\RCX53E3.tmp —
MD5:—
SHA256:—
3004ilasm.exeC:\Users\admin\Desktop\NjRat 0.7D Original\Server.exeexecutable
MD5:EB2386ED50823D12E12530AB22A80417
SHA256:320988C1661D33CDDE55F75C27847FF8D94B64476515025141D57727FFE807D5
3760server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0932343ebc836c39c857a65dc20ea0fb.exeexecutable
MD5:EB2386ED50823D12E12530AB22A80417
SHA256:320988C1661D33CDDE55F75C27847FF8D94B64476515025141D57727FFE807D5
2304njRAT v0.7d.exeC:\Users\admin\Desktop\NjRat 0.7D Original\Server.exeexecutable
MD5:EB2386ED50823D12E12530AB22A80417
SHA256:320988C1661D33CDDE55F75C27847FF8D94B64476515025141D57727FFE807D5
2108WinRAR.exeC:\Users\admin\Desktop\NjRat 0.7D Original\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
3784Server.exeC:\Users\admin\AppData\Roaming\server.exeexecutable
MD5:EB2386ED50823D12E12530AB22A80417
SHA256:320988C1661D33CDDE55F75C27847FF8D94B64476515025141D57727FFE807D5
2304njRAT v0.7d.exeC:\Users\admin\AppData\Local\Temp\stub.iltext
MD5:3B1F515633710788E5BC53BD1177ED63
SHA256:B3CDEEB7047C5D111C859D038F93C9DD53572ED00BB6CDA7C570EAAA71ED5668
2108WinRAR.exeC:\Users\admin\Desktop\NjRat 0.7D Original\Plugin\ch.dllexecutable
MD5:E747FA3339C1F138B6BFCE707B541D03
SHA256:6E31148CC1B3235B71731C3944A7B06F861E104E978708D12C695EC09B5B3760
2108WinRAR.exeC:\Users\admin\Desktop\NjRat 0.7D Original\Plugin\pw.dllexecutable
MD5:DB87DAF76C15F3808CEC149F639AA64F
SHA256:A3E4BEE1B6944AA9266BD58DE3F534A4C1896DF621881A5252A0D355A6E67C70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRat 0.7D Original.zip