File name:

funny-warez.7z

Full analysis: https://app.any.run/tasks/3f08dfba-c2a4-45b0-8f2d-80dbc1e7b61c
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: February 10, 2024, 18:56:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

2C3F245A5A389B4E78684C770FD228F6

SHA1:

9D00A717E2292D8686BE182AD92335C6695D67B2

SHA256:

97639634FA14825E108461B2991CE7541EDA2542407425FD3F09B8E4B1969CA7

SSDEEP:

98304:SZhN16dnLYyaN+eO1IqFAzGI6sKAviFZ/BhASClB3xd1drPgAagIZmERh5WGIkLs:k/DCqpZrhjPd6LwABySrcMfA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3672)
      • hack paypal 2014.exe (PID: 2328)
      • fifa 15 Crack.exe (PID: 3428)
      • pass facebook.scr (PID: 2772)
      • Trojan.exe (PID: 2956)

    • NjRAT is detected

      • fifa 15 Crack.exe (PID: 3428)
      • chorme.exe (PID: 1740)
      • Trojan.exe (PID: 2956)

    • Changes the autorun value in the registry

      • chorme.exe (PID: 1740)
      • Trojan.exe (PID: 2956)

    • NJRAT has been detected (YARA)

      • chorme.exe (PID: 1740)
      • league of legend Hack tool 2014.exe (PID: 1816)

    • Create files in the Startup directory

      • Trojan.exe (PID: 2956)

  • SUSPICIOUS

    • Reads the Internet Settings

      • hack paypal 2014.exe (PID: 2328)
      • fifa 15 Crack.exe (PID: 3428)
      • league of legend Hack tool 2014.exe (PID: 1816)

    • Executable content was dropped or overwritten

      • hack paypal 2014.exe (PID: 2328)
      • fifa 15 Crack.exe (PID: 3428)
      • pass facebook.scr (PID: 2772)
      • Trojan.exe (PID: 2956)

    • Reads security settings of Internet Explorer

      • hack paypal 2014.exe (PID: 2328)
      • fifa 15 Crack.exe (PID: 3428)
      • league of legend Hack tool 2014.exe (PID: 1816)

    • Starts itself from another location

      • fifa 15 Crack.exe (PID: 3428)
      • pass facebook.scr (PID: 2772)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • chorme.exe (PID: 1740)
      • Trojan.exe (PID: 2956)

    • Connects to unusual port

      • chorme.exe (PID: 1740)
      • Trojan.exe (PID: 2956)

    • Starts CMD.EXE for commands execution

      • Moderator Hack.exe (PID: 844)

  • INFO

    • Create files in a temporary directory

      • hack paypal 2014.exe (PID: 2328)
      • hack paypal 2014.exe (PID: 3304)
      • fifa 15 Crack.exe (PID: 3428)
      • pass facebook.scr (PID: 2772)

    • Checks supported languages

      • hack paypal 2014.exe (PID: 3304)
      • hack paypal 2014.exe (PID: 2328)
      • fifa 15 Crack.exe (PID: 3428)
      • chorme.exe (PID: 1740)
      • HACK PAYPAL 2015 by hackers.exe (PID: 1888)
      • Minecraft-Unban-Admin-Tool.exe (PID: 2488)
      • Minecraft Admin Forcer.exe (PID: 2804)
      • league of legend Hack tool 2014.exe (PID: 1816)
      • hack facrbook 2015 v0.3.5.Scr (PID: 3984)
      • dw20.exe (PID: 3976)
      • pass facebook.scr (PID: 2772)
      • Moderator Hack.exe (PID: 844)
      • hack wifi 2014.exe (PID: 480)
      • Hack Facebook Tool.exe (PID: 2344)
      • Trojan.exe (PID: 2956)
      • Crossfire.exe1_5F5D516183D54369893BD0FB3980553A.exe (PID: 3360)
      • Ak RecoilScriptsMacrosCheatsNoRecoilAimbotWallHAckFlyHack.exe (PID: 2828)
      • clash of clans hack tool 2014.exe (PID: 3644)

    • Manual execution by a user

      • hack paypal 2014.exe (PID: 2328)
      • hack paypal 2014.exe (PID: 3304)
      • explorer.exe (PID: 4008)
      • Minecraft-Unban-Admin-Tool.exe (PID: 2488)
      • Minecraft Admin Forcer.exe (PID: 2804)
      • league of legend Hack tool 2014.exe (PID: 1816)
      • hack facrbook 2015 v0.3.5.Scr (PID: 3984)
      • pass facebook.scr (PID: 2772)
      • Moderator Hack.exe (PID: 844)
      • hack wifi 2014.exe (PID: 480)
      • Hack Facebook Tool.exe (PID: 2052)
      • Hack Facebook Tool.exe (PID: 2344)
      • Ak RecoilScriptsMacrosCheatsNoRecoilAimbotWallHAckFlyHack.exe (PID: 2828)
      • csrstub.exe (PID: 3048)
      • Crossfire.exe1_5F5D516183D54369893BD0FB3980553A.exe (PID: 1192)
      • Crossfire.exe1_5F5D516183D54369893BD0FB3980553A.exe (PID: 3360)
      • clash of clans hack tool 2014.exe (PID: 3644)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3672)

    • Reads the computer name

      • hack paypal 2014.exe (PID: 2328)
      • fifa 15 Crack.exe (PID: 3428)
      • HACK PAYPAL 2015 by hackers.exe (PID: 1888)
      • chorme.exe (PID: 1740)
      • Minecraft Admin Forcer.exe (PID: 2804)
      • league of legend Hack tool 2014.exe (PID: 1816)
      • dw20.exe (PID: 3976)
      • Minecraft-Unban-Admin-Tool.exe (PID: 2488)
      • hack wifi 2014.exe (PID: 480)
      • pass facebook.scr (PID: 2772)
      • Hack Facebook Tool.exe (PID: 2344)
      • Trojan.exe (PID: 2956)
      • Ak RecoilScriptsMacrosCheatsNoRecoilAimbotWallHAckFlyHack.exe (PID: 2828)
      • clash of clans hack tool 2014.exe (PID: 3644)

    • Reads the machine GUID from the registry

      • fifa 15 Crack.exe (PID: 3428)
      • HACK PAYPAL 2015 by hackers.exe (PID: 1888)
      • chorme.exe (PID: 1740)
      • Minecraft-Unban-Admin-Tool.exe (PID: 2488)
      • Minecraft Admin Forcer.exe (PID: 2804)
      • league of legend Hack tool 2014.exe (PID: 1816)
      • hack facrbook 2015 v0.3.5.Scr (PID: 3984)
      • pass facebook.scr (PID: 2772)
      • Trojan.exe (PID: 2956)
      • Ak RecoilScriptsMacrosCheatsNoRecoilAimbotWallHAckFlyHack.exe (PID: 2828)
      • clash of clans hack tool 2014.exe (PID: 3644)

    • Reads Environment values

      • chorme.exe (PID: 1740)
      • Trojan.exe (PID: 2956)

    • Creates files or folders in the user directory

      • Trojan.exe (PID: 2956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1740) chorme.exe
C2hackers01.no-ip.biz
Ports4070
BotnetHacKed by me
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\d8c39c97b59541a2cd4789c541b75063
Splitter|'|'|
Version0.7d
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
28
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe hack paypal  2014.exe no specs hack paypal  2014.exe #NJRAT fifa 15 crack.exe explorer.exe no specs #NJRAT chorme.exe hack paypal 2015 by hackers.exe no specs netsh.exe no specs minecraft-unban-admin-tool.exe no specs minecraft admin forcer.exe no specs #NJRAT league of legend hack tool 2014.exe no specs hack facrbook  2015  v0.3.5.scr dw20.exe no specs pass facebook.scr moderator hack.exe no specs cmd.exe no specs cmd.exe no specs hack wifi 2014.exe hack facebook tool.exe no specs hack facebook tool.exe #NJRAT trojan.exe netsh.exe no specs ak recoilscriptsmacroscheatsnorecoilaimbotwallhackflyhack.exe no specs csrstub.exe ntvdm.exe no specs crossfire.exe1_5f5d516183d54369893bd0fb3980553a.exe no specs crossfire.exe1_5f5d516183d54369893bd0fb3980553a.exe clash of clans hack tool 2014.exe

Process information

PID
CMD
Path
Indicators
Parent process
480"C:\Users\admin\Desktop\hack wifi 2014.exe" C:\Users\admin\Desktop\hack wifi 2014.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3762504530
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\hack wifi 2014.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
844"C:\Users\admin\Desktop\Moderator Hack.exe" C:\Users\admin\Desktop\Moderator Hack.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Modules
Images
c:\users\admin\desktop\moderator hack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1192"C:\Users\admin\Desktop\Crossfire.exe1_5F5D516183D54369893BD0FB3980553A.exe" C:\Users\admin\Desktop\Crossfire.exe1_5F5D516183D54369893BD0FB3980553A.exe—explorer.exe
User:
admin
Company:
Macrovision Corporation
Integrity Level:
MEDIUM
Description:
InstallShield
Exit code:
3221226540
Version:
12.0.49974
Modules
Images
c:\users\admin\desktop\crossfire.exe1_5f5d516183d54369893bd0fb3980553a.exe
c:\windows\system32\ntdll.dll
1540C:\Windows\system32\cmd.exe /c color aC:\Windows\System32\cmd.exe—Moderator Hack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1740"C:\Users\admin\AppData\Local\Temp\chorme.exe" C:\Users\admin\AppData\Local\Temp\chorme.exe
fifa 15 Crack.exe
User:
admin
Integrity Level:
MEDIUM
Description:
chanayder
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\chorme.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1740) chorme.exe
C2hackers01.no-ip.biz
Ports4070
BotnetHacKed by me
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\d8c39c97b59541a2cd4789c541b75063
Splitter|'|'|
Version0.7d
1816"C:\Users\admin\Desktop\league of legend Hack tool 2014.exe" C:\Users\admin\Desktop\league of legend Hack tool 2014.exe
explorer.exe
User:
admin
Company:
delortelo
Integrity Level:
MEDIUM
Description:
league of legend Hack tool 2014
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\league of legend hack tool 2014.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1888"C:\Extracted\HACK PAYPAL 2015 by hackers.exe" C:\Extracted\HACK PAYPAL 2015 by hackers.exe—hack paypal 2014.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HACK PAYPAL 2015
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\extracted\hack paypal 2015 by hackers.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2052"C:\Users\admin\Desktop\Hack Facebook Tool.exe" C:\Users\admin\Desktop\Hack Facebook Tool.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\hack facebook tool.exe
c:\windows\system32\ntdll.dll
2328"C:\Users\admin\Desktop\hack paypal 2014.exe" C:\Users\admin\Desktop\hack paypal 2014.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hack paypal 2014.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2344"C:\Users\admin\Desktop\Hack Facebook Tool.exe" C:\Users\admin\Desktop\Hack Facebook Tool.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\hack facebook tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
13 905
Read events
13 649
Write events
256
Delete events
0

Modification events

(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\funny-warez.7z
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
25
Suspicious files
3
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\clash of clans hack tool 2014.exeexecutable
MD5:28311B3CAC1CC5CA9358B43E54357CCA
SHA256:F6300D442F5A46BE7AB5C46D3188772AA9984D690186A547902E96F4A282FF07
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\Crossfire.exe1_5F5D516183D54369893BD0FB3980553A.exeexecutable
MD5:21ABF88390478FBA5011CE283BD84013
SHA256:3C3EFAA45404B43C4D5C25B7DA7E43780A0C31426421347241804D61E02F7331
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\pass facebook.screxecutable
MD5:CE5ADD18348171121BA8CD1C85A03BE1
SHA256:45E6CEB58EF50E0AA14BF61765600F8413D5E4E8E8ADB8938F58820A247D1078
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\Ak RecoilScriptsMacrosCheatsNoRecoilAimbotWallHAckFlyHack.exeexecutable
MD5:6CC583A1F3F4500A524B61255F1D2710
SHA256:1CBAA4D4C817743A7EC88BDC3F8D15200E543A86E0B3374C6D05A15A0762970F
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\hack instagram.rarcompressed
MD5:B4021E435D09B587BCF708A46D29EFCD
SHA256:1FA6FB1E0BF25B8C7456B4F5D045464E60E2BD9139603691499DBF48E71A0755
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\AIMBOT.exe.battext
MD5:0DDC187A02EF790D440FC4953952EC2C
SHA256:5AA369AAFE17EE03C848DAC672CCFBEA4FEB9533D708B92FBBB3FF0186E3106C
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\Instagram Hack 2016.zipcompressed
MD5:F293F9AD2C87931F4851132E34B3A59E
SHA256:E81EF659C78A991D9CE981848662C8175C14B98C82E980FC097EF1291236B64D
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\hack facrbook 2015 v0.3.5.Screxecutable
MD5:71C7B31F60BC87076EF7C87EB775139F
SHA256:7998555A18CD1D65F928FD85B433E369CAFA3CA7BF61A731888D2BF12A8F49E4
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\hack instagram 100%.rarcompressed
MD5:BE4BFAD0EF72C306C6AB52E32472B85D
SHA256:62D0D25DD7FD75EFE2A5B6A986766C76AE9E2EC9F84F272ED8BC5A1019ECC684
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.37355\Hack Accounts FaceBook_exe.Screxecutable
MD5:D279D19FFFBE0DD2D91AE790791C09A2
SHA256:44BFD6A71A4F204734CA195A8D2A600F3A039F35371A49249E57FF361BEFF908
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
4
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1740
chorme.exe
78.159.135.230:4070
hackers01.no-ip.biz
—
BG
unknown
2956
Trojan.exe
139.99.66.103:8188
dykh.linkpc.net
OVH SAS
SG
unknown

DNS requests

Domain
IP
Reputation
hackers01.no-ip.biz
  • 78.159.135.230
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
dykh.linkpc.net
  • 139.99.66.103
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to DynDNS Domain (linkpc .net)
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
funny-warez.7z