analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Java update.zip

Full analysis: https://app.any.run/tasks/b92ff76d-100f-426e-a114-6938a5e3eb17
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Analysis date: September 18, 2019, 19:57:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
njrat
bladabindi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8886C8A052A1D7CD006FD698F80AA121

SHA1:

9D8751EA63437B9E6F778840737FF5BBB679315A

SHA256:

A6BEB8A409D25E39E13CDF85A7A401E1BC1FA23CDC4A71E403BEE7B44786E1E5

SSDEEP:

384:RAYmJ4JNAheqScQDZjbFSMl+buojvAWHas6TM8kZ7fw+G9e30KWTClxLNp8hD:yYmaVFc0eMYKWuTM8khAbK3xLPM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Java update.exe (PID: 3020)
      • Dllhost.exe (PID: 2972)
    • Writes to a start menu file

      • Dllhost.exe (PID: 2972)
    • NJRAT was detected

      • Dllhost.exe (PID: 2972)
    • Connects to CnC server

      • Dllhost.exe (PID: 2972)
    • Changes the autorun value in the registry

      • Dllhost.exe (PID: 2972)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3512)
      • Java update.exe (PID: 3020)
      • Dllhost.exe (PID: 2972)
    • Creates files in the user directory

      • Java update.exe (PID: 3020)
      • Dllhost.exe (PID: 2972)
    • Starts itself from another location

      • Java update.exe (PID: 3020)
  • INFO

    • Manual execution by user

      • Java update.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Java update.exe
ZipUncompressedSize: 25879
ZipCompressedSize: 22036
ZipCRC: 0xaffa3c08
ZipModifyDate: 2019:09:16 10:57:07
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe java update.exe #NJRAT dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
3512"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Java update.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3020"C:\Users\admin\Desktop\Java update.exe" C:\Users\admin\Desktop\Java update.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2972"C:\Users\admin\AppData\Roaming\Dllhost.exe" C:\Users\admin\AppData\Roaming\Dllhost.exe
Java update.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 102
Read events
825
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3512WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3512.20092\Java update.exeexecutable
MD5:18B1315F4B4158A65216292A0BA8ECC4
SHA256:0690FAD49B9E2EA9F6A7B4AFB2B63CE002570F45DFCE0699CF03AFF975931CA8
3020Java update.exeC:\Users\admin\AppData\Roaming\Dllhost.exeexecutable
MD5:18B1315F4B4158A65216292A0BA8ECC4
SHA256:0690FAD49B9E2EA9F6A7B4AFB2B63CE002570F45DFCE0699CF03AFF975931CA8
2972Dllhost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exeexecutable
MD5:18B1315F4B4158A65216292A0BA8ECC4
SHA256:0690FAD49B9E2EA9F6A7B4AFB2B63CE002570F45DFCE0699CF03AFF975931CA8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
Dllhost.exe
186.170.66.60:5860
cobroserfinansa.com
COLOMBIA TELECOMUNICACIONES S.A. ESP
CO
malicious

DNS requests

Domain
IP
Reputation
cobroserfinansa.com
  • 186.170.66.60
malicious

Threats

PID
Process
Class
Message
2972
Dllhost.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT/Bladabindi
2972
Dllhost.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
2972
Dllhost.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT/Bladabindi
2972
Dllhost.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
7 ETPRO signatures available at the full report
No debug info