analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2.zip

Full analysis: https://app.any.run/tasks/74d58fab-84d3-447e-99f4-0b8e8822711d
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: July 17, 2019, 16:09:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

BFF64AE2ECDB03822F2AA6489FB42E5B

SHA1:

1B88DAE0B6E52B1273117159268B5EF06CA88519

SHA256:

8F7110579DE6C24BEA85AF6CDD26E945B6A370A857B935A6649146050042DE28

SSDEEP:

6144:a0LyNamPrZJdLMORUr0ua6FQCuojj38YIKq4WdW1Wjr3ij+oWRm6aWNLD7QMBSuY:a5bgc6qCuovZMHjD0attPLEuY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1244)

    • Application was dropped or rewritten from another process

      • System_security.exe (PID: 4032)
      • Rockstar Social Club Checker.exe (PID: 412)
      • tmp9ABC.tmp.exe (PID: 2868)
      • System_manager.exe (PID: 3948)

    • Writes to a start menu file

      • System_security.exe (PID: 4032)
      • System_manager.exe (PID: 3948)

    • Connects to CnC server

      • System_security.exe (PID: 4032)
      • System_manager.exe (PID: 3948)

    • Changes the autorun value in the registry

      • System_security.exe (PID: 4032)
      • System_manager.exe (PID: 3948)

    • NJRAT was detected

      • System_security.exe (PID: 4032)
      • System_manager.exe (PID: 3948)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Rockstar Social Club Checker.exe (PID: 412)
      • WinRAR.exe (PID: 3244)
      • System_security.exe (PID: 4032)
      • tmp9ABC.tmp.exe (PID: 2868)
      • System_manager.exe (PID: 3948)

    • Creates files in the user directory

      • Rockstar Social Club Checker.exe (PID: 412)
      • System_security.exe (PID: 4032)
      • tmp9ABC.tmp.exe (PID: 2868)
      • System_manager.exe (PID: 3948)

    • Starts itself from another location

      • Rockstar Social Club Checker.exe (PID: 412)
      • tmp9ABC.tmp.exe (PID: 2868)

    • Uses NETSH.EXE for network configuration

      • System_security.exe (PID: 4032)
      • System_manager.exe (PID: 3948)

    • Starts CMD.EXE for self-deleting

      • System_security.exe (PID: 4032)

    • Starts CMD.EXE for commands execution

      • System_security.exe (PID: 4032)

  • INFO

    • Manual execution by user

      • Rockstar Social Club Checker.exe (PID: 412)
      • regedit.exe (PID: 2960)
      • regedit.exe (PID: 3160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Rockstar Social Club Checker/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:07:17 16:37:29
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe searchprotocolhost.exe no specs rockstar social club checker.exe #NJRAT system_security.exe netsh.exe no specs regedit.exe no specs regedit.exe tmp9abc.tmp.exe netsh.exe no specs cmd.exe no specs ping.exe no specs #NJRAT system_manager.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3244"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1244"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
412"C:\Users\admin\Desktop\Rockstar Social Club Checker\Rockstar Social Club Checker.exe" C:\Users\admin\Desktop\Rockstar Social Club Checker\Rockstar Social Club Checker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4032"C:\Users\admin\AppData\Roaming\System_security.exe" C:\Users\admin\AppData\Roaming\System_security.exe
Rockstar Social Club Checker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3632netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\System_security.exe" "System_security.exe" ENABLEC:\Windows\system32\netsh.exe—System_security.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2960"C:\Windows\regedit.exe" C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3160"C:\Windows\regedit.exe" C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2868"C:\Users\admin\AppData\Local\Temp\tmp9ABC.tmp.exe" ..C:\Users\admin\AppData\Local\Temp\tmp9ABC.tmp.exe
System_security.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2884netsh firewall delete allowedprogram "C:\Users\admin\AppData\Roaming\System_security.exe"C:\Windows\system32\netsh.exe—System_security.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3092cmd.exe /c ping 0 -n 2 & del "C:\Users\admin\AppData\Roaming\System_security.exe"C:\Windows\system32\cmd.exe—System_security.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
2 373
Read events
1 927
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2868tmp9ABC.tmp.exeC:\Users\admin\AppData\Roaming\System_manager.exeexecutable
MD5:AD6247818D7BA67CC51264C3CBC8149C
SHA256:3E17BDBF53283579D81C696C6EEEA343ABC5DB223382155F11300D1D56D86DAA
3244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3244.29947\Rockstar Social Club Checker\Rockstar Social Club Checker.exeexecutable
MD5:6771E3C6513F7EE8A8FD7AB8FEC8AB37
SHA256:BB0ACB9556526202B9B799DB50FCBA1C8281F5514F943B17911261925C049B82
4032System_security.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3ac146ba4bfa02a51d6288fb3aadd76.exeexecutable
MD5:6771E3C6513F7EE8A8FD7AB8FEC8AB37
SHA256:BB0ACB9556526202B9B799DB50FCBA1C8281F5514F943B17911261925C049B82
4032System_security.exeC:\Users\admin\AppData\Local\Temp\tmp9ABC.tmp.exeexecutable
MD5:AD6247818D7BA67CC51264C3CBC8149C
SHA256:3E17BDBF53283579D81C696C6EEEA343ABC5DB223382155F11300D1D56D86DAA
412Rockstar Social Club Checker.exeC:\Users\admin\AppData\Roaming\System_security.exeexecutable
MD5:6771E3C6513F7EE8A8FD7AB8FEC8AB37
SHA256:BB0ACB9556526202B9B799DB50FCBA1C8281F5514F943B17911261925C049B82
3948System_manager.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b479a6af7b95a11171858e5e1e9de0e4.exeexecutable
MD5:AD6247818D7BA67CC51264C3CBC8149C
SHA256:3E17BDBF53283579D81C696C6EEEA343ABC5DB223382155F11300D1D56D86DAA
3244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3244.29947\Rockstar Social Club Checker\xNet.dllexecutable
MD5:3DF8D87A482EFAD957D83819ADB3020F
SHA256:2AC175B4D44245EE8E7AEE9CC36DF86925EF903D8516F20A2C51D84E35F23DA4
3244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3244.29947\Rockstar Social Club Checker\SkinSoft.VisualStyler.dllexecutable
MD5:2D84A619D4BD339F860CB48AF0C9B6C8
SHA256:365FFDE7DF914840EB21C96F34C39912A4B031E3814B8E902B67ACEE6DFF65A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3948
System_manager.exe
41.225.59.123:1177
forupload4.ddns.net
GLOBALNET-AS
TN
malicious
4032
System_security.exe
41.225.59.123:1177
forupload4.ddns.net
GLOBALNET-AS
TN
malicious

DNS requests

Domain
IP
Reputation
forupload4.ddns.net
  • 41.225.59.123
malicious

Threats

PID
Process
Class
Message
4032
System_security.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
4032
System_security.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3948
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
10 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2.zip