File name: | 4.rar |
Full analysis: | https://app.any.run/tasks/cf822c12-b4cd-412d-9e0b-83134e2556e5 |
Verdict: | Malicious activity |
Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
Analysis date: | July 18, 2019, 06:41:06 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | E26FD22B1C02D5FBE1240CFF4928249A |
SHA1: | 882648C19AF0154EB4306E3DFFE9F6F138390EE5 |
SHA256: | 9CCDB6F1F64BB12FDDCD339318894EE927A53342B11E41ABE243BCF3AA36276A |
SSDEEP: | 49152:HTxCg7RNdfATScYZIDtg4cdD8iyAT/lF4:Mg7LdrIDw8iyAT92 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3520 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2728 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1.EXE" "C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1\" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3732 | "C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1\chrome.exe" | C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1\chrome.exe | explorer.exe | |
User: admin Company: Microsoft Integrity Level: MEDIUM Description: chrome Version: 1.0.0.0 | ||||
3200 | netsh firewall add allowedprogram "C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1\chrome.exe" "chrome.exe" ENABLE | C:\Windows\system32\netsh.exe | — | chrome.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
944 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4088 | "C:\Windows\System32\cmd.exe" | C:\Windows\System32\cmd.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2760 | netstat -nb | C:\Windows\system32\NETSTAT.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: TCP/IP Netstat Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3520 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3520.9255\Redeye's Netflix Checker 1.1\combo_example.txt | — | |
MD5:— | SHA256:— | |||
3520 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3520.9255\Redeye's Netflix Checker 1.1\proxy_example.txt | — | |
MD5:— | SHA256:— | |||
3520 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3520.9255\Redeye's Netflix Checker 1.1\Read Me!.txt | — | |
MD5:— | SHA256:— | |||
3520 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3520.9255\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1.EXE | — | |
MD5:— | SHA256:— | |||
2728 | WinRAR.exe | C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1\REDEYE~1.EXE | executable | |
MD5:E051848AA9CB1309D279F6052C038C4C | SHA256:647410BF1C8F4C8DB165F0065FE685CB966DAEB1FD9858179B552CC8A458D6DF | |||
3732 | chrome.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ahmedatef.exe | executable | |
MD5:F1432AE2D69CFB9339384B99AD07D68D | SHA256:660094F645921772825766C533F89F4C79A088ECDA048365E5934FAC590CADD6 | |||
2728 | WinRAR.exe | C:\Users\admin\Desktop\Redeye's Netflix Checker 1.1\Redeye Netflix Checker1\chrome.exe | executable | |
MD5:F1432AE2D69CFB9339384B99AD07D68D | SHA256:660094F645921772825766C533F89F4C79A088ECDA048365E5934FAC590CADD6 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3732 | chrome.exe | 104.20.209.21:443 | pastebin.com | Cloudflare Inc | US | shared |
3732 | chrome.exe | 41.142.235.7:1177 | soolbin02.hopto.org | MT-MPLS | MA | unknown |
— | — | 41.142.235.7:1177 | soolbin02.hopto.org | MT-MPLS | MA | unknown |
Domain | IP | Reputation |
---|---|---|
pastebin.com |
| shared |
soolbin02.hopto.org |
| malicious |
dns.msftncsi.com |
| shared |