analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9.rar

Full analysis: https://app.any.run/tasks/baaaf57e-f2f3-441e-a633-50792648a234
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 21:21:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

97FAA919C34537BEB61438D9B85E70B3

SHA1:

1DF6BD24854FD536EA1C1AEC4A6AAAB8EBA22BBC

SHA256:

94D0D30EDAAA58FA042B53C930FF87F3F7F03587151EB8A40C24FBC5EBF72908

SSDEEP:

98304:PrCopkKVszvw6NHwW9rIN4rwMzt/umNO2kBWwucQv0cEDp9Ho28gajdy9gZgIezr:DF9Vsz9ZwW9r849tORBva01Dk2L9gJsr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • dominos.exe (PID: 2792)
      • svghost.exe (PID: 3576)
      • dominos.exe (PID: 680)
      • dominos.exe (PID: 2388)

    • Writes to a start menu file

      • svghost.exe (PID: 3576)

    • NJRAT was detected

      • svghost.exe (PID: 3576)

  • SUSPICIOUS

    • Creates files in the user directory

      • dominos.exe (PID: 2792)
      • svghost.exe (PID: 3576)
      • dominos.exe (PID: 680)
      • dominos.exe (PID: 2388)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2504)
      • dominos.exe (PID: 2792)
      • svghost.exe (PID: 3576)
      • dominos.exe (PID: 2388)

    • Executes scripts

      • svghost.exe (PID: 3576)

    • Uses NETSH.EXE for network configuration

      • svghost.exe (PID: 3576)

  • INFO

    • Manual execution by user

      • dominos.exe (PID: 2792)
      • dominos.exe (PID: 680)
      • dominos.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe dominos.exe #NJRAT svghost.exe vbc.exe no specs cvtres.exe no specs netsh.exe no specs dominos.exe no specs dominos.exe

Process information

PID
CMD
Path
Indicators
Parent process
2504"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\9.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2792"C:\Users\admin\Desktop\dominos.exe" C:\Users\admin\Desktop\dominos.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3576"C:\Users\admin\AppData\Roaming\svghost.exe" C:\Users\admin\AppData\Roaming\svghost.exe
dominos.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication8
Version:
1.0.0.0
2952"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\admin\AppData\Local\Temp\cawgn1y2.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe—svghost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
14.0.1055.0
2592C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESF2FE.tmp" "C:\Users\admin\AppData\Local\Temp\vbc3767C7D2F51342E4A3DE37B2B272F9D0.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—vbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.52512.0 built by: VSWINSERVICING
3112netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\svghost.exe" "svghost.exe" ENABLEC:\Windows\system32\netsh.exe—svghost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
680"C:\Users\admin\Desktop\dominos.exe" C:\Users\admin\Desktop\dominos.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
255
2388"C:\Users\admin\Desktop\dominos.exe" C:\Users\admin\Desktop\dominos.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
9
Total events
1 587
Read events
1 499
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2504.31014\combos.txt —
MD5:—
SHA256:—
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2504.31014\proxies.txt —
MD5:—
SHA256:—
3576svghost.exeC:\Users\admin\AppData\Local\Temp\cawgn1y2.0.vb —
MD5:—
SHA256:—
2952vbc.exeC:\Users\admin\AppData\Local\Temp\vbc3767C7D2F51342E4A3DE37B2B272F9D0.TMP —
MD5:—
SHA256:—
2592cvtres.exeC:\Users\admin\AppData\Local\Temp\RESF2FE.tmp —
MD5:—
SHA256:—
2952vbc.exeC:\Users\admin\AppData\Local\Temp\cawgn1y2.dll —
MD5:—
SHA256:—
2952vbc.exeC:\Users\admin\AppData\Local\Temp\vbc217D7FEE8D894E21AEDDDE5880EBFCFD.TMP —
MD5:—
SHA256:—
2952vbc.exeC:\Users\admin\AppData\Local\Temp\cawgn1y2.outtext
MD5:EF5441B1809989920A8A5A6711E2B5AD
SHA256:820BD7F696B426F394026307D201ABEF4B0FCD91BF3D9B84675FCF9E3C548377
2792dominos.exeC:\Users\admin\AppData\Roaming\svghost.exeexecutable
MD5:82982E75BF5D048E98FBF98FFF5EC309
SHA256:CBE67F067AB52D8CBB2F25DEB2EDC3AF4AEFF810283D01A79E2FE7958C16F6FB
2388dominos.exeC:\Users\admin\AppData\Roaming\dominos.exeexecutable
MD5:18520B16F6F59963A43BEAF25055190A
SHA256:268EACAC2CCCE8E5AE10A839E09BF8CF04A73041B1E421986C824B7C3A4B2CA6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3576
svghost.exe
197.0.245.188:5552
webcracker.linkpc.net
TOPNET
TN
unknown

DNS requests

Domain
IP
Reputation
webcracker.linkpc.net
  • 197.0.245.188
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9.rar