download: | Deezer+Brute+And+Checker.rar |
Full analysis: | https://app.any.run/tasks/a56f698c-4515-43bf-b62e-99d55431dfb8 |
Verdict: | Malicious activity |
Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
Analysis date: | February 18, 2019, 15:44:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/html |
File info: | HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators |
MD5: | 2FBDE6745C0A87A9F16E2472896794C3 |
SHA1: | 81F178074309B2D2696387D32B05FE3D94B81957 |
SHA256: | DCA851D14A8AE50F3CAE1D37A31C6A3C8F13A70A8730D4F2804B9FB9401F3111 |
SSDEEP: | 3072:k1NgAkHnj9Q6KSeX3w7EWhxu9tSEOLhDL4MfY:MgAkHnj9QBSeXg749tSDx2 |
.html | | | HyperText Markup Language (100) |
---|
twitterDescription: | - |
---|---|
twitterImage: | //static.mediafire.com/images/filetype/download/zip.jpg |
twitterTitle: | Deezer Brute And Checker |
twitterUrl: | http://www.mediafire.com/file/9ycp1pgflscyc23/Deezer_Brute_And_Checker.rar/file |
twitterSite: | @MediaFire |
twitterCard: | summary_large_image |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2972 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Deezer+Brute+And+Checker.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 1 Version: 5.60.0 | ||||
2892 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 3221225547 Version: 68.0.3440.106 | ||||
3644 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x70fe00b0,0x70fe00c0,0x70fe00cc | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
2872 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2896 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
1520 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,10943740888169369047,3949466770422008629,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=77D25A4A968C644AC1D450C78F368528 --mojo-platform-channel-handle=1016 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
2840 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10943740888169369047,3949466770422008629,131072 --enable-features=PasswordImport --service-pipe-token=0EE61E277DE903B0355EC39FBC126F6C --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=0EE61E277DE903B0355EC39FBC126F6C --renderer-client-id=5 --mojo-platform-channel-handle=1904 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
3308 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10943740888169369047,3949466770422008629,131072 --enable-features=PasswordImport --service-pipe-token=27B5AD3B34ED16122F38B17D4BE94206 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=27B5AD3B34ED16122F38B17D4BE94206 --renderer-client-id=3 --mojo-platform-channel-handle=2100 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
3464 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10943740888169369047,3949466770422008629,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=122F21BF98BFFFD34D1E1FBEE99FCFE1 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=122F21BF98BFFFD34D1E1FBEE99FCFE1 --renderer-client-id=6 --mojo-platform-channel-handle=3600 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
2228 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10943740888169369047,3949466770422008629,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=ED611340A3B95B04E7986F84C9240268 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=ED611340A3B95B04E7986F84C9240268 --renderer-client-id=7 --mojo-platform-channel-handle=3700 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
2980 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,10943740888169369047,3949466770422008629,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=20606FE20A1489E2F174BF5C57735207 --mojo-platform-channel-handle=4052 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\6a05961f-a2b4-41e0-bb8a-a571ded80307.tmp | — | |
MD5:— | SHA256:— | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f5a385df-a81f-4ac3-a78e-da4b44ee22b2.tmp | — | |
MD5:— | SHA256:— | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:92BE6B127E72365885AD4C3FB6534EE2 | SHA256:54302A2573ACC775720E7DB0AD85873276713302B4F72596A8DCC44B01C70E51 | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old~RF251410.TMP | text | |
MD5:1AA66EFDB743FB0A8DCC1CD79B0B6542 | SHA256:28D56532CCED7375A2A1C7731E57C1A1C2EC1AC9827F3E5BEEE7F8069A5F87DD | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old | text | |
MD5:1AA66EFDB743FB0A8DCC1CD79B0B6542 | SHA256:28D56532CCED7375A2A1C7731E57C1A1C2EC1AC9827F3E5BEEE7F8069A5F87DD | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:C10EBD4DB49249EFC8D112B2920D5F73 | SHA256:90A1B994CAFE902F22A88A22C0B6CC9CB5B974BF20F8964406DD7D6C9B8867D1 | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e6622492fa163609ddd4212f54512baa07929ed3\caecb3bd-7969-4305-84d6-3a376453ec73\index-dir\temp-index | — | |
MD5:— | SHA256:— | |||
2892 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF251410.TMP | text | |
MD5:197882774A7ECEC9046BC48F63189B66 | SHA256:27377B0D5F989997C2C3F74ACF163EED44B60631DDAA768F6655D7BE555742B2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://2.bp.blogspot.com/-tAL9Ahh2xSI/XA1UZD8qOhI/AAAAAAAAAMQ/TS6f5dgIX-wLuAYRgt1NGbtcWG-43fjuwCK4BGAYYCw/s72-c/3-744439.jpg | US | image | 1.82 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 148.251.13.139:80 | http://ad.a-ads.com/824329?size=728x90 | DE | html | 1.87 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.207.33:80 | http://hack-crack9.blogspot.com/ | US | html | 35.9 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://1.bp.blogspot.com/-yH_5izewSJM/XA1UzXpUXKI/AAAAAAAAANQ/aoE1x6GLFWkQDJolPE4J7P4yNFr11jSjgCK4BGAYYCw/s72-c/7-749642.jpg | US | image | 3.76 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://1.bp.blogspot.com/-1SixxkJVpCA/XA1UfvEry6I/AAAAAAAAAMg/tagaxZaCYE0ViyfoTvaOe-BTBjCfwMsNwCK4BGAYYCw/s72-c/5-769964.jpg | US | image | 2.56 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://2.bp.blogspot.com/-w-vkQxuHx7c/XA1Un7WPhCI/AAAAAAAAAM0/MdyhLEvZkhA0KNci84isvvl99jhC6V_JwCK4BGAYYCw/s72-c/1-703510.jpg | US | image | 1.76 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 148.251.13.139:80 | http://ad.a-ads.com/824313?size=728x90 | DE | html | 1.90 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://2.bp.blogspot.com/-TTaAqGfZLUk/XA1UtYIldCI/AAAAAAAAANA/t0rXYwF7YMM8D-0kY3fvtMiwrxZ6ASpDgCK4BGAYYCw/s72-c/4-725292.jpg | US | image | 892 b | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://3.bp.blogspot.com/-aSA3HQL7SnE/XA1UfM9f9-I/AAAAAAAAAMY/c9p8hNrjmWQjDc-H8vQtRfkLViFOFmE0gCK4BGAYYCw/s72-c/6-768124.jpg | US | image | 1.74 Kb | whitelisted |
2892 | chrome.exe | GET | 200 | 216.58.206.1:80 | http://1.bp.blogspot.com/-dwsdkKBDbGs/XA1VBpIX4dI/AAAAAAAAANg/FSqAWuW3T3YHyepMQdCdmRY1UwWVtdliwCK4BGAYYCw/s72-c/9-706193.jpg | US | image | 2.49 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2892 | chrome.exe | 172.217.23.164:443 | www.google.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 172.217.16.195:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 216.58.205.234:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 172.217.18.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 216.58.207.33:80 | hack-crack9.blogspot.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 172.217.22.67:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 172.217.16.142:443 | apis.google.com | Google Inc. | US | whitelisted |
2892 | chrome.exe | 172.217.16.131:443 | www.google.de | Google Inc. | US | whitelisted |
2892 | chrome.exe | 209.197.3.15:80 | maxcdn.bootstrapcdn.com | Highwinds Network Group, Inc. | US | whitelisted |
2892 | chrome.exe | 172.217.16.201:443 | www.blogger.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.gstatic.com |
| whitelisted |
www.google.de |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
www.google.com |
| whitelisted |
www.google.fr |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2892 | chrome.exe | Generic Protocol Command Decode | SURICATA HTTP unable to match response to request |
2892 | chrome.exe | Generic Protocol Command Decode | SURICATA HTTP unable to match response to request |
2480 | svchost.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan.DownLoader22.55152 (Backdoor.Bladabindi/Variant) |
3876 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |
3876 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |
3876 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |
3876 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |