File name:

NjRat-0.7D-Green-Edition-by-im523-master.rar

Full analysis: https://app.any.run/tasks/dd02e926-c7af-49ab-a7cf-e31600bb705b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Analysis date: January 25, 2022, 20:33:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
SecurityXploded
stealer
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3CBE0EAE30415447844F92CBCA82EECF

SHA1:

FC2E068EF3889645E22199F5E1405E28F95AE0C1

SHA256:

8B897AF4C8E96ED3021E79A309C3365E63B7A445FEC79F0BBF2C966763EBD9AC

SSDEEP:

98304:POaZQX4u0vvIEvdNXWe3Kq0vvPNYEIuUgOfcsHQdrLqBeCtqJ0ybqGyDHqAJH7No:3KX4uMjH3KqbBuNOfcMQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Stealing of credential data

      • WinRAR.exe (PID: 1220)
    • Application was dropped or rewritten from another process

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Detected SecurityXploded stealer

      • WinRAR.exe (PID: 1220)
    • Writes to a start menu file

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Changes the autorun value in the registry

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2844)
    • Connects to CnC server

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • NJRAT was detected

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Checks supported languages

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
      • WinRAR.exe (PID: 1220)
    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1220)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Uses NETSH.EXE for network configuration

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Creates files in the user directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Reads Environment values

      • netsh.exe (PID: 760)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
  • INFO

    • Manual execution by user

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Checks supported languages

      • netsh.exe (PID: 760)
    • Reads the computer name

      • netsh.exe (PID: 760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe #NJRAT njrat 0.7d green edition by im523.exe netsh.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
760netsh firewall add allowedprogram "C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe" "NjRat 0.7D Green Edition by im523.exe" ENABLEC:\Windows\system32\netsh.exeNjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1220"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat-0.7D-Green-Edition-by-im523-master.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\usp10.dll
2844"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3244"C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\njrat-0.7d-green-edition-by-im523-master\njrat 0.7d green edition by im523.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 908
Read events
2 779
Write events
129
Delete events
0

Modification events

(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1220) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NjRat-0.7D-Green-Edition-by-im523-master.rar
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
17
Suspicious files
56
Text files
174
Unknown types
3

Dropped files

PID
Process
Filename
Type
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exeexecutable
MD5:
SHA256:
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\.gitignoretext
MD5:F4D61F06FF1F26F8A4BFD8CE606936CF
SHA256:FDC17FD35182CA77A4888C8682F48BA5B57463CA5865B96EB8A652BA15C63664
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\About.resourcesbinary
MD5:C69CF18E024AB2A5D704C7806C425CF5
SHA256:AC0832D4E920E03C2A9160DAB51E6545F42785C34EF4671317F77C42FF463D79
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\Cam.Designer.vbtext
MD5:C148D0A2E2ABDE1B9B9E44C799D128F6
SHA256:34B95416A150CFC9899FCB4AC6A66332F1DA0DE117218674633E915A6E923DCE
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\mic.dllexecutable
MD5:D4C5DDC00F27162FC0947830E0E762B7
SHA256:B6FB6B66821E70A27A4750B0CD0393E4EE2603A47FEAC48D6A3D66D1C1CB56D5
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Sound\Sound.wavwav
MD5:562FB3B4B1B1EAFD2CF107F2E92E0670
SHA256:5FF592B183B2C990448F1DCD842A29CFE17A3EAA9956E0135C945C578676344A
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\Builder.Designer.vbtext
MD5:339D5A562476B91EFEDE1BFADCB892F2
SHA256:E4D11E6FE53DCB1C9DA9A62B399C4B89A77EAED6770FECC710731458CF3C0C13
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\ch.dllexecutable
MD5:73C8A5CD64FCF87186A6A9AC870DF509
SHA256:7722206DBA0CFB290F33093F9430CB770A160947001715AE11E6DBBFAEF1C0EE
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\About.vbtext
MD5:E15D133B2499183FDD90125BBF1AA09F
SHA256:22E33DD5AC0977A62861B7391FAB3B70C99288DB68A527B25A0E7E2784558C8A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3244
NjRat 0.7D Green Edition by im523.exe
194.38.20.82:1470
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3244
NjRat 0.7D Green Edition by im523.exe
A Network Trojan was detected
ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)
3244
NjRat 0.7D Green Edition by im523.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
6 ETPRO signatures available at the full report
No debug info