File name:

Vape Client 2.47.rar

Full analysis: https://app.any.run/tasks/cccb0657-d22c-4942-8ac0-c39bc0841ec8
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 04, 2020, 13:10:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

280EA85388CEC5A692C13BD17F667FF9

SHA1:

41CE931CED59050D30DD02F382293CE598D13522

SHA256:

697FC955E20AADCB7D54C188B31FB4A333E91E28D7E93A1241BB9D94A1E9924B

SSDEEP:

49152:cC+9rgrOKzdJj+QsJHIf/lsDJNaATTuAMobhuO7ZEDKE09T0XnT7ac8vMVbOUDCA:m9sr/zdR+3mds3bpED3q0ac8vqOU2F+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • VAPE INJECTOR.exe (PID: 1904)
      • svchost.exe (PID: 2884)
      • VAPE INJECTOR.exe (PID: 2484)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 2884)

    • NJRAT was detected

      • svchost.exe (PID: 2884)

    • Writes to a start menu file

      • svchost.exe (PID: 2884)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1600)
      • VAPE INJECTOR.exe (PID: 1904)
      • svchost.exe (PID: 2884)

    • Uses NETSH.EXE for network configuration

      • svchost.exe (PID: 2884)

    • Creates files in the user directory

      • VAPE INJECTOR.exe (PID: 1904)
      • svchost.exe (PID: 2884)

    • Starts itself from another location

      • VAPE INJECTOR.exe (PID: 1904)

    • Creates executable files which already exist in Windows

      • VAPE INJECTOR.exe (PID: 1904)
      • svchost.exe (PID: 2884)

  • INFO

    • Manual execution by user

      • VAPE INJECTOR.exe (PID: 1904)
      • rundll32.exe (PID: 2424)
      • VAPE INJECTOR.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 1787537
UncompressedSize: 2048000
OperatingSystem: Win32
ModifyDate: 2017:05:01 10:33:03
PackingMethod: Normal
ArchivedFileName: Vape Cracked 2.47\1.7.10\d3dx9.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe rundll32.exe no specs vape injector.exe #NJRAT svchost.exe netsh.exe no specs vape injector.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1600"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Vape Client 2.47.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1904"C:\Users\admin\Desktop\Vape Cracked 2.47\1.8.9\VAPE INJECTOR.exe" C:\Users\admin\Desktop\Vape Cracked 2.47\1.8.9\VAPE INJECTOR.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\vape cracked 2.47\1.8.9\vape injector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2424"C:\Windows\System32\rundll32.exe" d3dx9.dll,EntryPointC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2484"C:\Users\admin\Desktop\Vape Cracked 2.47\VAPE INJECTOR.exe" C:\Users\admin\Desktop\Vape Cracked 2.47\VAPE INJECTOR.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\vape cracked 2.47\vape injector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2884"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
VAPE INJECTOR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3288netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLEC:\Windows\system32\netsh.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
878
Read events
794
Write events
84
Delete events
0

Modification events

(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1600) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Vape Client 2.47.rar
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2884) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:23556fb1360f366337f97c924e76ead3
Value:
"C:\Users\admin\AppData\Roaming\svchost.exe" ..
Executable files
8
Suspicious files
0
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\VAPE INJECTOR.exe —
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.8.9\launch_alternate.lnklnk
MD5:—
SHA256:—
1904VAPE INJECTOR.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:—
SHA256:—
2884svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\23556fb1360f366337f97c924e76ead3.exeexecutable
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.7.10\launch.exeexecutable
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.8.9\VAPE INJECTOR.exeexecutable
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.7.10\VAPE INJECTOR.exeexecutable
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.7.10\d3dx9.dllexecutable
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.8.9\d3dx9.dllexecutable
MD5:—
SHA256:—
1600WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1600.48352\Vape Cracked 2.47\1.7.10\launch_alternate.lnklnk
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
hostminecrafting.hopto.org
  • —
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.hopto .org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vape Client 2.47.rar