File name:

TNT-Eyebeam.rar

Full analysis: https://app.any.run/tasks/d8255414-60dc-413a-a41d-69ae92ca998b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: March 26, 2020, 13:44:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D833B31EE4F7676B81D2F53C3457D820

SHA1:

AFE536DEF196BE351B9DE86B9F38B44AD2C4A9AF

SHA256:

AA868D8E77764EBA4715E81228920DC161F187FDA04459CD9940E28402923191

SSDEEP:

98304:xwAVr1WlXKbaAgSBKBuzub13MWTkYcxG0jymrUQ8WCJVQ4ccjuOp8THRRbBq:TVxcBABIb13MWncx9jf49PjccXAbNq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TNT-Eyebeam.exe (PID: 2660)
      • TNT-Eyebeam.exe (PID: 304)
      • Popup Sniper.exe (PID: 2560)
      • hkcmd.exe (PID: 3804)

    • Loads dropped or rewritten executable

      • TNT-Eyebeam.exe (PID: 304)

    • Writes to a start menu file

      • hkcmd.exe (PID: 3804)

    • Changes the autorun value in the registry

      • hkcmd.exe (PID: 3804)

    • NJRAT was detected

      • hkcmd.exe (PID: 3804)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TNT-Eyebeam.exe (PID: 2660)
      • WinRAR.exe (PID: 1516)
      • hkcmd.exe (PID: 3804)
      • Popup Sniper.exe (PID: 2560)

    • Creates files in the user directory

      • Popup Sniper.exe (PID: 2560)
      • hkcmd.exe (PID: 3804)

    • Starts itself from another location

      • Popup Sniper.exe (PID: 2560)

    • Uses NETSH.EXE for network configuration

      • hkcmd.exe (PID: 3804)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe tnt-eyebeam.exe tnt-eyebeam.exe no specs popup sniper.exe #NJRAT hkcmd.exe notepad.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\AppData\Local\Temp\TNT-Eyebeam.exe" C:\Users\admin\AppData\Local\Temp\TNT-Eyebeam.exe—TNT-Eyebeam.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\tnt-eyebeam.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\rar$exa1516.11135\tnt-eyebeam\tnt-eyebeam\aec_pc_dll.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1516"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TNT-Eyebeam.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1780netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\hkcmd.exe" "hkcmd.exe" ENABLEC:\Windows\system32\netsh.exe—hkcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2560"C:\Users\admin\AppData\Local\Temp\Popup Sniper.exe" C:\Users\admin\AppData\Local\Temp\Popup Sniper.exe
TNT-Eyebeam.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Popup Sniper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\popup sniper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2660"C:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\TNT-Eyebeam.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\TNT-Eyebeam.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1516.11135\tnt-eyebeam\tnt-eyebeam\tnt-eyebeam.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2752"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa1516.12035\sireil.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3804"C:\Users\admin\AppData\Roaming\hkcmd.exe" C:\Users\admin\AppData\Roaming\hkcmd.exe
Popup Sniper.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Popup Sniper
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\hkcmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 394
Read events
1 228
Write events
166
Delete events
0

Modification events

(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1516) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TNT-Eyebeam.rar
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
14
Suspicious files
0
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\AEC_PC_DLL.dllexecutable
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\sireil.txttext
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\AMRWBAsDLL.dllexecutable
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\EVRCAsDLL.dllexecutable
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\G729AsDLL.dllexecutable
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\TNT-Eyebeam.exeexecutable
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\unins000.datdat
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\ntuser.initext
MD5:6FC234AD3752E1267B34FB12BCD6718B
SHA256:5AD8F52071D25165E7E68064AB194EC27A074A3846149ED0689AF23E7F7F2D00
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\unins000 ‫‬.exeexecutable
MD5:B915CA9BC03D5904840A2316BF17B310
SHA256:5E88AB6112E059A53A489368DD9E596E11C9100BDFECA46BCEB4A9566F0E3CA1
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1516.11135\TNT-Eyebeam\TNT-Eyebeam\User-agent.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
2
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
server5319.us.to
  • 127.0.0.2
malicious
server3919.mooo.com
  • 127.0.0.2
malicious

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
1052
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TNT-Eyebeam.rar