| File name: | S-400 RAT v3.0 ( Leaked Free ).zip |
| Full analysis: | https://app.any.run/tasks/dd5bd028-0e7f-4719-be39-8d19c9694d7f |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | June 24, 2023, 11:58:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 4C2EE4262316DB8F6889B38CA0EF78F4 |
| SHA1: | B4A577389B106805B7585602D352A05C7143B95E |
| SHA256: | A6F5B600F595EF4ECD9F4E9F72AF172DDAF7097067B996D3B433E659F18B8B82 |
| SSDEEP: | 393216:zd/U47tTPNG/DOGeIA7V1GAjCCqkFbTeNabtszL:pj7tpGSI5AmCqgbTeN4ts3 |
MALICIOUS
Loads dropped or rewritten executable
- S-400 RAT v3.0.exe (PID: 3020)
Application was dropped or rewritten from another process
- asdf.exe (PID: 3460)
- aaaa.exe (PID: 2736)
- S-400 RAT v3.0.exe (PID: 3020)
NjRAT is detected
- aaaa.exe (PID: 2736)
Create files in the Startup directory
- aaaa.exe (PID: 2736)
Steals credentials from Web Browsers
- aaaa.exe (PID: 2736)
Steals credentials
- aaaa.exe (PID: 2736)
BLACKGUARD detected by memory dumps
- aaaa.exe (PID: 2736)
Actions looks like stealing of personal data
- aaaa.exe (PID: 2736)
SUSPICIOUS
Executable content was dropped or overwritten
- S-400 RAT v3.0.exe (PID: 3020)
- vbc.exe (PID: 3116)
- asdf.exe (PID: 3460)
Reads the Internet Settings
- asdf.exe (PID: 3460)
- S-400 RAT v3.0.exe (PID: 3020)
Starts itself from another location
- asdf.exe (PID: 3460)
Uses NETSH.EXE to add a firewall rule or allowed programs
- aaaa.exe (PID: 2736)
Reads browser cookies
- aaaa.exe (PID: 2736)
The process executes VB scripts
- S-400 RAT v3.0.exe (PID: 3020)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3028)
Reads the computer name
- S-400 RAT v3.0.exe (PID: 3020)
- asdf.exe (PID: 3460)
- aaaa.exe (PID: 2736)
Create files in a temporary directory
- S-400 RAT v3.0.exe (PID: 3020)
- vbc.exe (PID: 3116)
- cvtres.exe (PID: 2116)
- asdf.exe (PID: 3460)
- aaaa.exe (PID: 2736)
The process checks LSA protection
- vbc.exe (PID: 3116)
- cvtres.exe (PID: 2116)
- asdf.exe (PID: 3460)
- aaaa.exe (PID: 2736)
- netsh.exe (PID: 1392)
- netsh.exe (PID: 2976)
- S-400 RAT v3.0.exe (PID: 3020)
Reads the machine GUID from the registry
- S-400 RAT v3.0.exe (PID: 3020)
- vbc.exe (PID: 3116)
- cvtres.exe (PID: 2116)
- asdf.exe (PID: 3460)
- aaaa.exe (PID: 2736)
Manual execution by a user
- S-400 RAT v3.0.exe (PID: 3020)
- asdf.exe (PID: 3460)
Checks supported languages
- vbc.exe (PID: 3116)
- asdf.exe (PID: 3460)
- aaaa.exe (PID: 2736)
- S-400 RAT v3.0.exe (PID: 3020)
- cvtres.exe (PID: 2116)
[YARA] Firewall manipulation strings were found
- S-400 RAT v3.0.exe (PID: 3020)
- aaaa.exe (PID: 2736)
Creates files or folders in the user directory
- aaaa.exe (PID: 2736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | API.dll |
|---|---|
| ZipUncompressedSize: | 52736 |
| ZipCompressedSize: | 24187 |
| ZipCRC: | 0x0d148695 |
| ZipModifyDate: | 2023:06:17 16:41:30 |
| ZipCompression: | Deflated |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 20 |
Total processes
52
Monitored processes
9
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1392 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\aaaa\aaaa.exe" "aaaa.exe" ENABLE | C:\Windows\System32\netsh.exe | — | aaaa.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2116 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESAEC6.tmp" "C:\Users\admin\AppData\Local\Temp\vbcBB1413C4970D4C05B6BAA6D09F80FA25.TMP" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | — | vbc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 12.00.51209.34209 built by: FX452RTMGDR Modules
| |||||||||||||||
| 2180 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
| 2736 | "C:\Users\admin\AppData\Local\Temp\aaaa\aaaa.exe" | C:\Users\admin\AppData\Local\Temp\aaaa\aaaa.exe | asdf.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2976 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\aaaa\aaaa.exe" "aaaa.exe" ENABLE | C:\Windows\System32\netsh.exe | — | aaaa.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3020 | "C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\S-400 RAT v3.0.exe" | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\S-400 RAT v3.0.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 0.0.0.7 Modules
| |||||||||||||||
| 3028 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free ).zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3116 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\admin\AppData\Local\Temp\5js43t2c.cmdline" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | S-400 RAT v3.0.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 12.0.51209.34209 Modules
| |||||||||||||||
| 3460 | "C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\asdf.exe" | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\asdf.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
8 519
Read events
8 369
Write events
147
Delete events
3
Modification events
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3028) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2180) SearchProtocolHost.exe | Key: | HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\16D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3020) S-400 RAT v3.0.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | NodeSlots |
Value: 020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202 | |||
Executable files
52
Suspicious files
13
Text files
161
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\Anx.dll | executable | |
MD5:0F52530CF216A3CF65FD195C8B29768D | SHA256:40D7C2FAB8C23CB959842C8D74EFF8541A4B1C1DCBEC99806E3C92E7F990D962 | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIComConstants.au3 | text | |
MD5:2FFBA31B7301A02079993CFE9933E55E | SHA256:080DBC5CD1F12AF1E3DEBF0AAB0C282A43767D88E5097C83F0DB97B5F9E8A266 | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIMiscConstants.au3 | text | |
MD5:7BB3767687B60111366F1647AFB7F922 | SHA256:8BF8A4453A7E84D4E775B45CB47F170FF3569719B6BABF0CBDC1A6E2CA3DCF3D | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Aut2Exe\Aut2exe.exe | executable | |
MD5:88D518A90F4187B4542618CD328D7A34 | SHA256:5AFFC1A22D87715D5DA70BFDDB081335CA0A382B9CC4A54E18263047A76D5D81 | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIGdiConstants.au3 | text | |
MD5:CD98396ECA554E67B778AE5B809F277F | SHA256:C6299B0F4AD1D68DD3067DA9F12D1AEDD42E866063F2AB7E038DA765CF60AE6A | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIErrorsConstants.au3 | text | |
MD5:7385CF721E87FAE7918568FBC9BE36DF | SHA256:1AD04A034FDC59A80585A76B830C572CF9FF73479F2864DCD1AD184CA2ABA484 | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APILocaleConstants.au3 | text | |
MD5:C66EF43D2824DA19D6BF12308A0DF1DD | SHA256:1AFB140F81A9520CD945F06312045454CB4E2FD653A7CB94DC2C000DB4FCAADA | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIRegConstants.au3 | text | |
MD5:31F5FED900208C7A46E064BE74C8713F | SHA256:A29117389AC6A118094B74342DAEBF7E4874F17DD758B400EDAD88CB433F46DE | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIResConstants.au3 | text | |
MD5:D752DA81F20869E39832D93097A0ACE3 | SHA256:0DDA6D7654163F19C752A9B571495D14468B59CFC8927E14F39B03F67C13E43B | |||
| 3028 | WinRAR.exe | C:\Users\admin\Desktop\S-400 RAT v3.0 ( Leaked Free )\FC\CVE_Port\AutoIt3\Include\APIDiagConstants.au3 | text | |
MD5:810897EC503DEEB89F85212194F9B6EA | SHA256:7A05710E409039E59ADFF692DBC37343893397501612B059463922647183E90F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2000 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1076 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |