File name:

NjRat-0.7D-Green-Edition-by-im523-master.rar

Full analysis: https://app.any.run/tasks/dd02e926-c7af-49ab-a7cf-e31600bb705b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Analysis date: January 25, 2022, 20:33:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
SecurityXploded
stealer
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3CBE0EAE30415447844F92CBCA82EECF

SHA1:

FC2E068EF3889645E22199F5E1405E28F95AE0C1

SHA256:

8B897AF4C8E96ED3021E79A309C3365E63B7A445FEC79F0BBF2C966763EBD9AC

SSDEEP:

98304:POaZQX4u0vvIEvdNXWe3Kq0vvPNYEIuUgOfcsHQdrLqBeCtqJ0ybqGyDHqAJH7No:3KX4uMjH3KqbBuNOfcMQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Stealing of credential data

      • WinRAR.exe (PID: 1220)
    • Detected SecurityXploded stealer

      • WinRAR.exe (PID: 1220)
    • Changes the autorun value in the registry

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • NJRAT was detected

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2844)
    • Connects to CnC server

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Writes to a start menu file

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Reads the computer name

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1220)
    • Uses NETSH.EXE for network configuration

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Creates files in the user directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Reads Environment values

      • netsh.exe (PID: 760)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
  • INFO

    • Manual execution by user

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Checks supported languages

      • netsh.exe (PID: 760)
    • Reads the computer name

      • netsh.exe (PID: 760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe #NJRAT njrat 0.7d green edition by im523.exe netsh.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
760netsh firewall add allowedprogram "C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe" "NjRat 0.7D Green Edition by im523.exe" ENABLEC:\Windows\system32\netsh.exeNjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1220"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat-0.7D-Green-Edition-by-im523-master.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\usp10.dll
2844"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3244"C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\njrat-0.7d-green-edition-by-im523-master\njrat 0.7d green edition by im523.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 908
Read events
2 779
Write events
129
Delete events
0

Modification events

(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1220) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NjRat-0.7D-Green-Edition-by-im523-master.rar
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1220) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
17
Suspicious files
56
Text files
174
Unknown types
3

Dropped files

PID
Process
Filename
Type
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exeexecutable
MD5:
SHA256:
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\LICENSEtext
MD5:D88E9E08385D2A17052DAC348BDE4BC1
SHA256:6B0382B16279F26FF69014300541967A356A666EB0B91B422F6862F6B7DAD17E
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\ch.dllexecutable
MD5:73C8A5CD64FCF87186A6A9AC870DF509
SHA256:7722206DBA0CFB290F33093F9430CB770A160947001715AE11E6DBBFAEF1C0EE
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\plg.dllexecutable
MD5:0CBC2D9703FEEAD9783439E551C2B673
SHA256:EA9ECF8723788FEEF6492BF938CDFAB1266A1558DFFE75E1F78A998320F96E39
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\About.vbtext
MD5:E15D133B2499183FDD90125BBF1AA09F
SHA256:22E33DD5AC0977A62861B7391FAB3B70C99288DB68A527B25A0E7E2784558C8A
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\Cam.Designer.vbtext
MD5:C148D0A2E2ABDE1B9B9E44C799D128F6
SHA256:34B95416A150CFC9899FCB4AC6A66332F1DA0DE117218674633E915A6E923DCE
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\About.resourcesbinary
MD5:C69CF18E024AB2A5D704C7806C425CF5
SHA256:AC0832D4E920E03C2A9160DAB51E6545F42785C34EF4671317F77C42FF463D79
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Sound\Sound.wavwav
MD5:562FB3B4B1B1EAFD2CF107F2E92E0670
SHA256:5FF592B183B2C990448F1DCD842A29CFE17A3EAA9956E0135C945C578676344A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3244
NjRat 0.7D Green Edition by im523.exe
194.38.20.82:1470
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3244
NjRat 0.7D Green Edition by im523.exe
A Network Trojan was detected
ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)
3244
NjRat 0.7D Green Edition by im523.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
6 ETPRO signatures available at the full report
No debug info