analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

NjRat-0.7D-Green-Edition-by-im523-master.rar

Full analysis: https://app.any.run/tasks/dd02e926-c7af-49ab-a7cf-e31600bb705b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Analysis date: January 25, 2022, 20:33:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
SecurityXploded
stealer
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3CBE0EAE30415447844F92CBCA82EECF

SHA1:

FC2E068EF3889645E22199F5E1405E28F95AE0C1

SHA256:

8B897AF4C8E96ED3021E79A309C3365E63B7A445FEC79F0BBF2C966763EBD9AC

SSDEEP:

98304:POaZQX4u0vvIEvdNXWe3Kq0vvPNYEIuUgOfcsHQdrLqBeCtqJ0ybqGyDHqAJH7No:3KX4uMjH3KqbBuNOfcMQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Stealing of credential data

      • WinRAR.exe (PID: 1220)
    • Detected SecurityXploded stealer

      • WinRAR.exe (PID: 1220)
    • Changes the autorun value in the registry

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • NJRAT was detected

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Writes to a start menu file

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2844)
    • Connects to CnC server

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Reads the computer name

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 1220)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1220)
    • Executable content was dropped or overwritten

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
      • WinRAR.exe (PID: 1220)
    • Uses NETSH.EXE for network configuration

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Creates files in the user directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Reads Environment values

      • netsh.exe (PID: 760)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
  • INFO

    • Manual execution by user

      • NjRat 0.7D Green Edition by im523.exe (PID: 3244)
    • Checks supported languages

      • netsh.exe (PID: 760)
    • Reads the computer name

      • netsh.exe (PID: 760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe #NJRAT njrat 0.7d green edition by im523.exe netsh.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1220"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat-0.7D-Green-Edition-by-im523-master.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
3244"C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
760netsh firewall add allowedprogram "C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exe" "NjRat 0.7D Green Edition by im523.exe" ENABLEC:\Windows\system32\netsh.exeNjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2844"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Total events
2 908
Read events
2 779
Write events
0
Delete events
0

Modification events

No data
Executable files
17
Suspicious files
56
Text files
174
Unknown types
3

Dropped files

PID
Process
Filename
Type
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\README.mdtext
MD5:2999E59653DEDF4A4C40E5BFBB1A2042
SHA256:558764CCCAC241A500BABC05E8070C385D198727D737E3598F1FAD6555889C71
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\NjRat 0.7D Green Edition by im523.exeexecutable
MD5:4A37F27ADD70336A1FAE70D59237696F
SHA256:146EA0FD48FE2BCFF0817DBC70642445289F878F7743C1D7495642DBF9A5405D
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\About.Designer.vbtext
MD5:806D869B1E39BDC82D61638829F9D95C
SHA256:2E1CA3ED75057613B7BDF660D16726CFA22DEF020CAEE212308C10838F401450
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\Builder.Designer.vbtext
MD5:339D5A562476B91EFEDE1BFADCB892F2
SHA256:E4D11E6FE53DCB1C9DA9A62B399C4B89A77EAED6770FECC710731458CF3C0C13
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\pw.dllexecutable
MD5:872401528FC94C90F3DE6658E776CC36
SHA256:3A1CC072EFFD8C38406A6FDDF4D8F49C5366BB0E32071311D90DB669940987CE
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\.gitignoretext
MD5:F4D61F06FF1F26F8A4BFD8CE606936CF
SHA256:FDC17FD35182CA77A4888C8682F48BA5B57463CA5865B96EB8A652BA15C63664
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\Plugin\mic.dllexecutable
MD5:D4C5DDC00F27162FC0947830E0E762B7
SHA256:B6FB6B66821E70A27A4750B0CD0393E4EE2603A47FEAC48D6A3D66D1C1CB56D5
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\Builder.vbtext
MD5:EF98A97EB7974E5E034D06E7DB1E941B
SHA256:0A1F8A351B76391C88A37AE2AA16A6F68326438EC41D712F43D73899D58BB239
1220WinRAR.exeC:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-master\NjRat-0.7D-Green-Edition-by-im523-master\src\NjRat 0.7D Green Edition by im523\About.vbtext
MD5:E15D133B2499183FDD90125BBF1AA09F
SHA256:22E33DD5AC0977A62861B7391FAB3B70C99288DB68A527B25A0E7E2784558C8A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3244
NjRat 0.7D Green Edition by im523.exe
194.38.20.82:1470
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3244
NjRat 0.7D Green Edition by im523.exe
A Network Trojan was detected
ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)
3244
NjRat 0.7D Green Edition by im523.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
6 ETPRO signatures available at the full report
No debug info