analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

GC.rar

Full analysis: https://app.any.run/tasks/7d6efd9a-8368-4c2b-bbf7-8a36be858d57
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 11:47:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
miner
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0DD6E9D44A15600AC39509BCC6A2CB97

SHA1:

74D2343B2D6EBAF3E808D330AE539EAE20AB436E

SHA256:

9E2FB447A50E1456B12FC708D8048AC6745794D1433D8DF3A85A3F75F888A8BD

SSDEEP:

196608:xdtA3R/tNwCjMeca1xHU1gQ60H8jGO48xC1MZOZKdAMQ:xDQR/tuW3I/1H8Sn8g1MZOjV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • EMP.EXE (PID: 2168)
      • vsll.exe (PID: 4028)
      • SoldierCards.exe (PID: 3888)
      • EMP.sfx.exe (PID: 2412)
      • vsnj.exe (PID: 2932)
      • AAYPSVOQA.exe (PID: 3600)
      • visnj.exe (PID: 3284)
      • data.exe (PID: 3616)
      • service.exe (PID: 2704)
      • SystemProcess.exe (PID: 3188)

    • Changes the autorun value in the registry

      • EMP.EXE (PID: 2168)
      • data.exe (PID: 3616)

    • Uses Task Scheduler to run other applications

      • EMP.EXE (PID: 2168)
      • vsll.exe (PID: 4028)
      • SystemProcess.exe (PID: 3188)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 2900)
      • schtasks.exe (PID: 3268)
      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 2696)

    • Connects to CnC server

      • AAYPSVOQA.exe (PID: 3600)

    • MINER was detected

      • AAYPSVOQA.exe (PID: 3600)

    • Writes to a start menu file

      • data.exe (PID: 3616)

    • NJRAT was detected

      • data.exe (PID: 3616)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EMP.sfx.exe (PID: 2412)
      • SoldierCards.exe (PID: 2612)
      • EMP.EXE (PID: 2168)
      • vsnj.exe (PID: 2932)
      • vsll.exe (PID: 4028)
      • data.exe (PID: 3616)

    • Connects to unusual port

      • AAYPSVOQA.exe (PID: 3600)
      • data.exe (PID: 3616)
      • service.exe (PID: 2704)

    • Starts itself from another location

      • vsnj.exe (PID: 2932)
      • vsll.exe (PID: 4028)

    • Creates files in the user directory

      • vsnj.exe (PID: 2932)
      • vsll.exe (PID: 4028)
      • data.exe (PID: 3616)

    • Uses NETSH.EXE for network configuration

      • data.exe (PID: 3616)

    • Reads Environment values

      • service.exe (PID: 2704)

  • INFO

    • Application was crashed

      • SystemProcess.exe (PID: 3188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
18
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs soldiercards.exe soldiercards.exe no specs vsll.exe emp.sfx.exe vsnj.exe visnj.exe no specs emp.exe schtasks.exe no specs schtasks.exe no specs #MINER aaypsvoqa.exe #NJRAT data.exe netsh.exe no specs schtasks.exe no specs service.exe systemprocess.exe schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3160"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\GC.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2612"C:\Users\admin\Desktop\GC\SoldierCards.exe" C:\Users\admin\Desktop\GC\SoldierCards.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3888"C:\Users\admin\AppData\Local\Temp\SoldierCards.exe" C:\Users\admin\AppData\Local\Temp\SoldierCards.exe—SoldierCards.exe
User:
admin
Company:
SoldierCrimes
Integrity Level:
HIGH
Description:
SoldierCards
Version:
1.0.0.0
4028"C:\Users\admin\AppData\Local\Temp\vsll.exe" C:\Users\admin\AppData\Local\Temp\vsll.exe
SoldierCards.exe
User:
admin
Integrity Level:
HIGH
Description:
vs
Exit code:
0
Version:
1.0.0.0
2412"C:\Users\admin\AppData\Local\Temp\EMP.sfx.exe" C:\Users\admin\AppData\Local\Temp\EMP.sfx.exe
SoldierCards.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2932"C:\Users\admin\AppData\Local\Temp\vsnj.exe" C:\Users\admin\AppData\Local\Temp\vsnj.exe
SoldierCards.exe
User:
admin
Integrity Level:
HIGH
Description:
vs
Exit code:
0
Version:
1.0.0.0
3284"C:\Users\admin\AppData\Local\Temp\visnj.exe" C:\Users\admin\AppData\Local\Temp\visnj.exe—SoldierCards.exe
User:
admin
Integrity Level:
HIGH
Description:
Vis
Exit code:
0
Version:
1.0.0.0
2168"C:\Users\admin\AppData\Local\Temp\EMP.EXE" C:\Users\admin\AppData\Local\Temp\EMP.EXE
EMP.sfx.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
2900schtasks.exe /create /tn NHHBXFCOVMPT /tr C:\Users\admin\AppData\Local\HKMFRNJQSFYWAKP\SystemProcess.exe /sc minute /mo 1C:\Windows\system32\schtasks.exe—EMP.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2988schtasks.exe /create /tn NHHBXFCOVMPT /tr C:\Users\admin\AppData\Local\HKMFRNJQSFYWAKP\SystemProcess.exe /sc onidle /i 1C:\Windows\system32\schtasks.exe—EMP.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 293
Read events
1 901
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.37958\GC\README.txt —
MD5:—
SHA256:—
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3160.37958\GC\SoldierCards.exe —
MD5:—
SHA256:—
2612SoldierCards.exeC:\Users\admin\AppData\Local\Temp\SoldierCards.exeexecutable
MD5:5F7E5B3AD1686B26BBFB63210828A956
SHA256:6A221D768BEE4012C56148F13FC969C0B0DC982A8F5661ED027DD87412EAF0D8
2612SoldierCards.exeC:\Users\admin\AppData\Local\Temp\vsll.exeexecutable
MD5:0F19B3C29029D08F8A337ADB13891970
SHA256:132A3E17BA038B1B4862AF8280C29DE3A0EDDDD1ACC58C19A0CAC921AD2148C2
2932vsnj.exeC:\Users\admin\AppData\Roaming\data.exeexecutable
MD5:2E265D94E9D5EC05F63A3DB4E9AA5E49
SHA256:61E880B47DAAEB0973E5581C2F06635E00BEA0977DA537464BA9668C0AC4254F
2612SoldierCards.exeC:\Users\admin\AppData\Local\Temp\visnj.exeexecutable
MD5:9E11B467EA1C858AB53D18E7F7D7BCE2
SHA256:767401EC2760A0268E5DE80B09676E3E5046F197C0545C2397645729CD1CFC1C
2612SoldierCards.exeC:\Users\admin\AppData\Local\Temp\EMP.sfx.exeexecutable
MD5:37CB74331A033F341B5DD1A7550A6B58
SHA256:FEC72EDCE9C7CDF2B7C1F8DA039565CCD15F5A829A7B0F3319D502A3D5D76D6C
3616data.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\da3434d6f617c5d897806b653bcb0ded.exeexecutable
MD5:2E265D94E9D5EC05F63A3DB4E9AA5E49
SHA256:61E880B47DAAEB0973E5581C2F06635E00BEA0977DA537464BA9668C0AC4254F
4028vsll.exeC:\Users\admin\AppData\Roaming\System32\service.exeexecutable
MD5:0F19B3C29029D08F8A337ADB13891970
SHA256:132A3E17BA038B1B4862AF8280C29DE3A0EDDDD1ACC58C19A0CAC921AD2148C2
2168EMP.EXEC:\Users\admin\AppData\Local\HKMFRNJQSFYWAKP\SystemProcess.exeexecutable
MD5:DFA9136A1D82A24CEBF74542231D9A23
SHA256:8B7A4728376A9066D378CBC83E3DE4009108F0529CC107C43A48F79A2C1E6E86
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2704
service.exe
104.20.208.21:443
pastebin.com
Cloudflare Inc
US
shared
3616
data.exe
31.4.242.170:5553
redlocal.hopto.org
Vodafone Spain
ES
unknown
2704
service.exe
79.159.172.236:8989
—
Telefonica De Espana
ES
malicious
3600
AAYPSVOQA.exe
80.188.53.27:5555
xmr.bohemianpool.com
O2 Czech Republic, a.s.
CZ
suspicious

DNS requests

Domain
IP
Reputation
xmr.bohemianpool.com
  • 80.188.53.27
suspicious
redlocal.hopto.org
  • 31.4.242.170
malicious
pastebin.com
  • 104.20.208.21
  • 104.20.209.21
shared

Threats

PID
Process
Class
Message
3600
AAYPSVOQA.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
3600
AAYPSVOQA.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
3600
AAYPSVOQA.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3600
AAYPSVOQA.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
3600
AAYPSVOQA.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3600
AAYPSVOQA.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
GC.rar