analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1.rar

Full analysis: https://app.any.run/tasks/bd008a79-cdac-432d-a821-2b63eb404f7e
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: July 17, 2019, 08:53:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

795B0FFFD889412584E797652F5AF509

SHA1:

54E5667B4B3D6E3587225F10F60C8E727F4E218E

SHA256:

9545D083499568470C56E70AD05CAD2339B9DA73B3CD67A90421CD28A6DA0558

SSDEEP:

49152:gFnDUq0X7hNH7YdQgTTw9TSXt33wqcE8MRPR7WLxAD1ReyTooXo47644/WlFKLYJ:gFDUqIhhYd1cmZwqnRZ7WLI1RnT3XBxJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ~SQLi_v_9_8_2.exe (PID: 3800)
      • net2.exe (PID: 2944)
      • net4.exe (PID: 3052)
      • ~SQLi_v_9_8_2.exe (PID: 3408)
      • Tempnet2com.exe (PID: 2756)
      • Tempnet4com.exe (PID: 3912)
      • Microsoft Service.exe (PID: 2864)

    • Writes to a start menu file

      • Microsoft Service.exe (PID: 2864)

    • Changes the autorun value in the registry

      • Microsoft Service.exe (PID: 2864)

    • NJRAT was detected

      • Microsoft Service.exe (PID: 2864)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • net2.exe (PID: 2944)
      • SQLi Dumper 9.8.2.exe (PID: 3396)
      • net4.exe (PID: 3052)
      • Tempnet2com.exe (PID: 2756)
      • Microsoft Service.exe (PID: 2864)

    • Starts CMD.EXE for commands execution

      • SQLi Dumper 9.8.2.exe (PID: 3396)
      • net2.exe (PID: 2944)
      • net4.exe (PID: 3052)

    • Starts CMD.EXE for self-deleting

      • net2.exe (PID: 2944)
      • net4.exe (PID: 3052)

    • Starts itself from another location

      • Tempnet2com.exe (PID: 2756)

    • Uses NETSH.EXE for network configuration

      • Microsoft Service.exe (PID: 2864)

    • Creates files in the user directory

      • Microsoft Service.exe (PID: 2864)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3920)

  • INFO

    • Manual execution by user

      • SQLi Dumper 9.8.2.exe (PID: 3396)
      • ~SQLi_v_9_8_2.exe (PID: 3800)
      • chrome.exe (PID: 3920)

    • Application launched itself

      • chrome.exe (PID: 3920)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 3548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
42
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs ~sqli_v_9_8_2.exe no specs sqli dumper 9.8.2.exe cmd.exe no specs net2.exe net4.exe ~sqli_v_9_8_2.exe no specs tempnet2com.exe cmd.exe no specs ping.exe no specs tempnet4com.exe no specs cmd.exe no specs ping.exe no specs #NJRAT microsoft service.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs netsh.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3552"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3800"C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\~SQLi_v_9_8_2.exe" C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\~SQLi_v_9_8_2.exe—explorer.exe
User:
admin
Company:
SQLi Trush Corp
Integrity Level:
MEDIUM
Description:
SQLi Dumper v9.8
Exit code:
3221225758
Version:
9.8.0.0
3396"C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\SQLi Dumper 9.8.2.exe" C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\SQLi Dumper 9.8.2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
2292"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\2F6A.tmp\2F6B.bat "C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\SQLi Dumper 9.8.2.exe""C:\Windows\system32\cmd.exe—SQLi Dumper 9.8.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2944net2.exe C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\net2.exe
cmd.exe
User:
admin
Company:
Microsoft .Inc
Integrity Level:
MEDIUM
Description:
Microsoft Corporation
Exit code:
0
Version:
1.0.0.0
3052net4.exe C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\net4.exe
cmd.exe
User:
admin
Company:
Microsoft .Inc
Integrity Level:
MEDIUM
Description:
Microsoft Corporation
Exit code:
0
Version:
1.0.0.0
3408~SQLi_v_9_8_2.exe C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\~SQLi_v_9_8_2.exe—cmd.exe
User:
admin
Company:
SQLi Trush Corp
Integrity Level:
MEDIUM
Description:
SQLi Dumper v9.8
Exit code:
3221225758
Version:
9.8.0.0
2756"C:\Users\admin\AppData\Local\Tempnet2com.exe" C:\Users\admin\AppData\Local\Tempnet2com.exe
net2.exe
User:
admin
Company:
Microsoft .Inc
Integrity Level:
MEDIUM
Description:
Microsoft Corporation
Exit code:
0
Version:
1.0.0.0
2928"cmd" /c ping google.com & del "C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\net2.exe"C:\Windows\system32\cmd.exe—net2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2452ping google.com C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 111
Read events
1 722
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
84
Text files
205
Unknown types
16

Dropped files

PID
Process
Filename
Type
3552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3552.12056\SQLi v.9.8.2 PASS 0123\SQLi Dumper 9.8.2.exe —
MD5:—
SHA256:—
3552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3552.12056\SQLi v.9.8.2 PASS 0123\~SQLi_v_9_8_2.exe —
MD5:—
SHA256:—
3396SQLi Dumper 9.8.2.exeC:\Users\admin\AppData\Local\Temp\2F6A.tmp\2F6B.battext
MD5:0DDFAFB46DC1E5A5435A848985FF098E
SHA256:416916C74C4148458ADBA95591BFAB14C949F59506FC9B9A89AEC59A2E159058
2944net2.exeC:\Users\admin\AppData\Local\Tempnet2com.exeexecutable
MD5:F1046FE50F132926172DECBD0B939D47
SHA256:02E13D2CA0780B39FE6D2B15DEB992B2D7736176113B73F2D7D0915C70CB2DFE
3052net4.exeC:\Users\admin\AppData\Local\Tempnet4com.exeexecutable
MD5:00CB69F47BAEF6636265ECB86F8BB6C4
SHA256:B5617D21B9C27C5B4EB0DC389C520420EC51057BDB4C70E74790D44164EFDF20
3552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3552.12056\SQLi v.9.8.2 PASS 0123\Settings.xmlxml
MD5:43774BE875CA2A5DE2CBF128C5392DA6
SHA256:33D53AC3E28E7568B3F58E174E34ACF08CFB0B1B0CA3D361E726B5DC90EBAEC7
3920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF11ee93.TMPtext
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30
SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348
3396SQLi Dumper 9.8.2.exeC:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\net4.exeexecutable
MD5:28E049310F08E1C1F2032B3BA7AB998C
SHA256:D46C26102360C6C5D527CFA4F6834634AF1DFE935046F9A3DC3532B670864B1B
3920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:C4D6CBB269C626168A5D6D0D8CCE6C30
SHA256:B62CDBB758278A0C2E50593357390119441D8DE09428EB29027F3DFD1332E348
3920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:DC32343F45B01764B6267AD36548102A
SHA256:A250F5AD57D4BD58AAE92810D50278E3BE2DBF869F126A3A3519691BCDFC2075
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
82
TCP/UDP connections
71
DNS requests
65
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/themes/twentyfourteen/style.css?ver=5.0.2
US
text
14.4 Kb
suspicious
3548
chrome.exe
GET
302
172.217.22.78:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
521 b
whitelisted
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/page/12/
US
html
23.5 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/uploads/2019/02/error.png
US
image
20.5 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-includes/css/dist/block-library/style.min.css?ver=5.0.2
US
text
4.25 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1
US
text
15.9 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/uploads/2016/08/cropped-icon-192x192.jpg
US
image
6.72 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/themes/twentyfourteen/js/functions.js?ver=20150315
US
text
2.09 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/plugins/shortcodes-ultimate/assets/js/other-shortcodes.js?ver=5.0.1
US
text
2.07 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/plugins/social-polls-by-opinionstage/js/shortcodes.js?ver=18.1.0
US
text
275 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3548
chrome.exe
172.217.16.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.23.131:443
www.gstatic.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.18.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3548
chrome.exe
216.58.207.67:443
www.google.com.ua
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.18.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.18.109:443
accounts.google.com
Google Inc.
US
suspicious
3548
chrome.exe
172.217.21.225:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.22.78:80
redirector.gvt1.com
Google Inc.
US
whitelisted
3548
chrome.exe
216.58.205.238:443
clients2.google.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.23.132:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 172.217.18.109
shared
www.google.com.ua
  • 216.58.207.67
whitelisted
fonts.googleapis.com
  • 172.217.18.10
whitelisted
www.gstatic.com
  • 172.217.23.131
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
apis.google.com
  • 172.217.23.174
whitelisted
www.google.com
  • 172.217.23.132
whitelisted
clients2.google.com
  • 216.58.205.238
whitelisted
www.google.fi
  • 172.217.18.99
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1.rar