File name:

XEN 1.0.4 [ FUD Crypter ].rar

Full analysis: https://app.any.run/tasks/d8afadbe-ff6e-4929-b3b6-9128a66d4a54
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 29, 2020, 22:17:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
stealer
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1E8123D9329FB2ED123CED86C5E95DCB

SHA1:

DF7B6D460F19015140AC9ECD38B245D260AA9F07

SHA256:

7A3DAE1FADAD89A3EACC2E79DA5C7D844C083DD272CB13562AD7A3467C1BCED9

SSDEEP:

12288:tQSss2oytmEG2ypoLtfehF4ufg7IBTvp4+4G+iyfReYNT:WSss2oyY72QQtRufg7IBT2+yY2T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • simple server.exe (PID: 3424)
      • XEN Crypter.exe (PID: 3456)
      • XEN Crypter.exe (PID: 3340)
      • Server.exe (PID: 948)
      • XEN Crypter.exe (PID: 3948)
      • XEN.exe (PID: 2316)
      • windows firewall.exe (PID: 3644)
      • Server3.exe (PID: 2376)
      • FUD Server.exe (PID: 4048)
      • Server.exe (PID: 2460)
      • svhost3.exe (PID: 4036)
      • svhost.exe (PID: 3728)
      • Server5.exe (PID: 2852)
      • svhost.exe (PID: 3212)
      • svhost5.exe (PID: 2204)
      • WUDFHost.exe (PID: 2312)

    • Disables Windows Defender

      • WScript.exe (PID: 2240)
      • WScript.exe (PID: 2692)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3012)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2464)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3240)

    • Loads dropped or rewritten executable

      • vbc.exe (PID: 3240)

    • Stealing of credential data

      • vbc.exe (PID: 3240)

    • Changes the autorun value in the registry

      • svhost5.exe (PID: 2204)
      • svhost3.exe (PID: 4036)
      • svhost.exe (PID: 3728)

    • NJRAT was detected

      • svhost3.exe (PID: 4036)
      • svhost5.exe (PID: 2204)
      • svhost.exe (PID: 3728)

    • Writes to a start menu file

      • svhost5.exe (PID: 2204)
      • svhost3.exe (PID: 4036)
      • svhost.exe (PID: 3728)

  • SUSPICIOUS

    • Starts itself from another location

      • XEN Crypter.exe (PID: 3948)
      • Server3.exe (PID: 2376)
      • FUD Server.exe (PID: 4048)
      • Server5.exe (PID: 2852)

    • Executable content was dropped or overwritten

      • XEN Crypter.exe (PID: 3340)
      • simple server.exe (PID: 3424)
      • XEN Crypter.exe (PID: 3948)
      • XEN.exe (PID: 2316)
      • vbc.exe (PID: 3240)
      • Server.exe (PID: 948)
      • Server3.exe (PID: 2376)
      • FUD Server.exe (PID: 4048)
      • Server5.exe (PID: 2852)
      • svhost5.exe (PID: 2204)
      • svhost3.exe (PID: 4036)
      • svhost.exe (PID: 3728)

    • Executes scripts

      • simple server.exe (PID: 3424)
      • WScript.exe (PID: 2088)
      • windows firewall.exe (PID: 3644)
      • WScript.exe (PID: 3008)
      • XEN.exe (PID: 2316)

    • Application launched itself

      • WScript.exe (PID: 2088)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2240)
      • WScript.exe (PID: 2692)

    • Starts CMD.EXE for commands execution

      • XEN.exe (PID: 2316)

    • Creates files in the user directory

      • vbc.exe (PID: 3240)
      • XEN.exe (PID: 2316)
      • powershell.exe (PID: 2260)
      • powershell.exe (PID: 3596)
      • powershell.exe (PID: 2620)
      • powershell.exe (PID: 3288)
      • powershell.exe (PID: 3940)
      • powershell.exe (PID: 944)
      • powershell.exe (PID: 3204)
      • powershell.exe (PID: 2744)
      • powershell.exe (PID: 2928)
      • powershell.exe (PID: 2708)
      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 956)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 2648)
      • powershell.exe (PID: 3984)
      • powershell.exe (PID: 3688)
      • powershell.exe (PID: 2820)
      • powershell.exe (PID: 1004)
      • powershell.exe (PID: 3068)
      • powershell.exe (PID: 1344)
      • powershell.exe (PID: 3672)
      • powershell.exe (PID: 3980)
      • svhost3.exe (PID: 4036)
      • svhost5.exe (PID: 2204)
      • svhost.exe (PID: 3728)

    • Reads the cookies of Mozilla Firefox

      • vbc.exe (PID: 3240)

    • Reads the cookies of Google Chrome

      • vbc.exe (PID: 3240)

    • Checks for external IP

      • vbc.exe (PID: 3240)

    • Executed via Task Scheduler

      • WUDFHost.exe (PID: 2312)

    • Uses NETSH.EXE for network configuration

      • svhost3.exe (PID: 4036)
      • svhost5.exe (PID: 2204)
      • svhost.exe (PID: 3728)

    • Searches for installed software

      • vbc.exe (PID: 3240)

  • INFO

    • Manual execution by user

      • XEN Crypter.exe (PID: 3456)
      • XEN Crypter.exe (PID: 3948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
111
Monitored processes
49
Malicious processes
17
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs xen crypter.exe no specs xen crypter.exe xen crypter.exe simple server.exe windows firewall.exe no specs fud server.exe wscript.exe no specs xen.exe server3.exe server5.exe server.exe wscript.exe no specs server.exe no specs wscript.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs vbc.exe powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs #NJRAT svhost3.exe #NJRAT svhost5.exe svhost.exe no specs #NJRAT svhost.exe wudfhost.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
944"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
948"C:\Users\admin\AppData\Local\Temp\Server.exe" C:\Users\admin\AppData\Local\Temp\Server.exe
simple server.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
956"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1004"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1344"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2088"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\script.vbs" C:\Windows\System32\WScript.exe—simple server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204"C:\Users\admin\AppData\Local\Temp\svhost5.exe" C:\Users\admin\AppData\Local\Temp\svhost5.exe
Server5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\svhost5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2240"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\script.vbs" /elevateC:\Windows\System32\WScript.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2260"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2284"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
9 612
Read events
8 019
Write events
1 593
Delete events
0

Modification events

(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2796) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2796) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\XEN 1.0.4 [ FUD Crypter ].rar
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2796) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
17
Suspicious files
35
Text files
4
Unknown types
6

Dropped files

PID
Process
Filename
Type
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2796.48415\XEN 1.0.4 [ FUD Crypter ]\stub.exe —
MD5:—
SHA256:—
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2796.48415\XEN 1.0.4 [ FUD Crypter ]\XEN Crypter.exe —
MD5:—
SHA256:—
3340XEN Crypter.exeC:\Users\admin\AppData\Local\Temp\windows firewall.exeexecutable
MD5:—
SHA256:—
3340XEN Crypter.exeC:\Users\admin\AppData\Local\Temp\FUD Server.exeexecutable
MD5:—
SHA256:—
2260powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OP3RMAUJ0OHJI7ICHQ8E.temp —
MD5:—
SHA256:—
3240vbc.exeC:\Users\admin\AppData\Roaming\kzlglt3e\ohigtcy0.eedtext
MD5:—
SHA256:—
3340XEN Crypter.exeC:\Users\admin\AppData\Local\Temp\XEN.exeexecutable
MD5:—
SHA256:—
3948XEN Crypter.exeC:\Users\admin\AppData\Local\Temp\XEN Crypter.exeexecutable
MD5:—
SHA256:—
2316XEN.exeC:\Users\admin\AppData\Roaming\Notepad++K\WUDFHost.exeexecutable
MD5:—
SHA256:—
3240vbc.exeC:\Users\admin\AppData\Roaming\kzlglt3e\wkp04hnm.nxqsqlite
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
4
DNS requests
6
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3240
vbc.exe
GET
200
5.79.66.145:80
http://mytestftpforme.kl.com.ua/HzwbM.png
NL
binary
370 Kb
malicious
2316
XEN.exe
GET
200
5.79.66.145:80
http://mytestftpforme.kl.com.ua/kek.png
NL
binary
1.02 Mb
malicious
3240
vbc.exe
GET
200
54.225.66.103:80
http://api.ipify.org/
US
text
13 b
shared
3240
vbc.exe
POST
200
5.79.66.145:80
http://mytestftpforme.kl.com.ua/cart.php
NL
html
2.07 Kb
malicious
2316
XEN.exe
GET
200
5.79.66.145:80
http://mytestftpforme.kl.com.ua/cat.png
NL
binary
356 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3240
vbc.exe
5.79.66.145:80
mytestftpforme.kl.com.ua
LeaseWeb Netherlands B.V.
NL
malicious
2316
XEN.exe
5.79.66.145:80
mytestftpforme.kl.com.ua
LeaseWeb Netherlands B.V.
NL
malicious
3240
vbc.exe
54.225.66.103:80
api.ipify.org
Amazon.com, Inc.
US
shared
4036
svhost3.exe
141.255.153.253:6666
hackerguru.duckdns.org
Lost Oasis SARL
NL
malicious

DNS requests

Domain
IP
Reputation
mytestftpforme.kl.com.ua
  • 5.79.66.145
malicious
api.ipify.org
  • 54.225.66.103
  • 23.21.59.179
  • 54.221.234.156
  • 54.225.178.192
  • 54.243.162.249
  • 54.225.191.113
  • 50.19.115.217
  • 54.225.182.172
shared
anonymousbaba460.ddns.net
  • 0.0.0.0
malicious
hackerguru.duckdns.org
  • 141.255.153.253
malicious
hackerguru.ddns.net
  • 0.0.0.0
malicious

Threats

PID
Process
Class
Message
3240
vbc.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
1044
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1044
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1044
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1044
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XEN 1.0.4 [ FUD Crypter ].rar