File name:

clarity_v2_crack.rar

Full analysis: https://app.any.run/tasks/dfd5cf1f-0f33-4f77-8968-01d4cd7641f6
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: October 12, 2023, 15:14:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1D0C56C856C9A263340B25D55B5C7B74

SHA1:

EC55E3D01F11FFE57DEEC9DC96C6C9064A99510A

SHA256:

D27E8360699730FE3CB9AAB2A825FDBDB0B85FBF1F4924CD9A8CB95F54AD7D78

SSDEEP:

24576:ifHg9QTuh1R67bGrwnItrTNBzikmx5YClC5yD26d/J1zmI9GQHD/6Go:ifA9e77q8I5TD0x6ClC5L6d/+I3H7o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Clarityv2 Injector.exe (PID: 4016)
      • Clarityv2 Injector.exe (PID: 1432)

    • Drops the executable file immediately after the start

      • Clarityv2 Injector.exe (PID: 4016)
      • Clarityv2 Injector.exe (PID: 1432)

    • NjRAT is detected

      • Clarityv2 Injector.exe (PID: 1432)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1764)

    • Uses RUNDLL32.EXE to load library

      • Clarityv2 Injector.exe (PID: 4016)
      • Clarityv2 Injector.exe (PID: 1432)

    • Reads the Internet Settings

      • Clarityv2 Injector.exe (PID: 4016)
      • rundll32.exe (PID: 2816)
      • Clarityv2 Injector.exe (PID: 1432)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1764)

    • Manual execution by a user

      • Clarityv2 Injector.exe (PID: 4016)
      • wmpnscfg.exe (PID: 3660)
      • Clarityv2 Injector.exe (PID: 1432)

    • Checks supported languages

      • Clarityv2 Injector.exe (PID: 4016)
      • wmpnscfg.exe (PID: 3660)
      • Clarityv2 Injector.exe (PID: 1432)

    • Reads the computer name

      • Clarityv2 Injector.exe (PID: 4016)
      • wmpnscfg.exe (PID: 3660)
      • Clarityv2 Injector.exe (PID: 1432)

    • Reads the machine GUID from the registry

      • Clarityv2 Injector.exe (PID: 4016)
      • wmpnscfg.exe (PID: 3660)
      • Clarityv2 Injector.exe (PID: 1432)

    • Create files in a temporary directory

      • Clarityv2 Injector.exe (PID: 4016)
      • Clarityv2 Injector.exe (PID: 1432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs searchprotocolhost.exe no specs clarityv2 injector.exe no specs rundll32.exe no specs notepad.exe no specs wmpnscfg.exe no specs #NJRAT clarityv2 injector.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1432"C:\Users\admin\Desktop\Clarityv2 Injector.exe" C:\Users\admin\Desktop\Clarityv2 Injector.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\clarityv2 injector.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1764"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\clarity_v2_crack.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2124"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\SystemC:\Windows\System32\notepad.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
2816"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\SystemC:\Windows\System32\rundll32.exe—Clarityv2 Injector.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\advapi32.dll
3660"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3860"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\SystemC:\Windows\System32\rundll32.exe—Clarityv2 Injector.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
4016"C:\Users\admin\Desktop\Clarityv2 Injector.exe" C:\Users\admin\Desktop\Clarityv2 Injector.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\clarityv2 injector.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 215
Read events
4 114
Write events
98
Delete events
3

Modification events

(PID) Process:(1764) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(1764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
4
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1764.18727\clarityv2 crack\Clarityv2 Injector.exeexecutable
MD5:B33266402FC0E44929DFE32CAFFBD634
SHA256:DD7F779087BD410F055E31D2BA1A0F7B09037A74BF68458FAAC73A36E8A296C3
1432Clarityv2 Injector.exeC:\Users\admin\AppData\Local\Temp\Systemexecutable
MD5:B33266402FC0E44929DFE32CAFFBD634
SHA256:DD7F779087BD410F055E31D2BA1A0F7B09037A74BF68458FAAC73A36E8A296C3
1764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1764.18727\clarityv2 crack\clarity v2.dllexecutable
MD5:C05744DB2DAD288DDA70D04A8FAD5C28
SHA256:2AB4EB2B48A1A75B78CAE55A744F15F71842BF415DD7B56FE45D62D032D65004
4016Clarityv2 Injector.exeC:\Users\admin\AppData\Local\Temp\Systemexecutable
MD5:B33266402FC0E44929DFE32CAFFBD634
SHA256:DD7F779087BD410F055E31D2BA1A0F7B09037A74BF68458FAAC73A36E8A296C3
1764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1764.18727\clarityv2 crack\steamvacbypass.dlltext
MD5:3575ABF7AB346EC4039138FAD1FAB4B7
SHA256:ED79411707D5A9925F1146E595983804E4EEAFE35E72EB51703908EFF13CC073
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
clarity_v2_crack.rar