File name:

Nouveau dossier.rar

Full analysis: https://app.any.run/tasks/ebd5a020-995a-4b63-888d-3c5dcc49e2aa
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: April 09, 2021, 15:05:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5CC24B5E56E9C9EEAB52818FE2714BC3

SHA1:

447AC04E5D953FB39818AF391D6CB9417D7DA6AD

SHA256:

DE1A8540B12BF19CC46176E02AB947F98C03CB2A1FFCA3F45DF67BEC160EB489

SSDEEP:

196608:Z0wAIlWG7SZyeM1gnlZnowhuYXLbwjM3RZyUaVMLgZCOtACOL/b:Z06WG7SZy1YlZZhuYXLc4uUaVHQUU/b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MBR - Image Builder.exe (PID: 2428)
      • MBR - Note Builder.exe (PID: 3084)
      • ._cache_MBR_BUILDER.exe (PID: 2704)
      • Synaptics.exe (PID: 2976)
      • MBR_BUILDER.exe (PID: 2480)

    • NJRAT was detected

      • Synaptics.exe (PID: 2976)

    • Changes the autorun value in the registry

      • MBR_BUILDER.exe (PID: 2480)

    • Connects to CnC server

      • Synaptics.exe (PID: 2976)

    • Changes settings of System certificates

      • Synaptics.exe (PID: 2976)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 540)
      • MBR_BUILDER.exe (PID: 2480)

    • Executable content was dropped or overwritten

      • MBR_BUILDER.exe (PID: 2480)
      • WinRAR.exe (PID: 540)

    • Creates files in the program directory

      • MBR_BUILDER.exe (PID: 2480)

    • Adds / modifies Windows certificates

      • Synaptics.exe (PID: 2976)

    • Creates files in the user directory

      • Synaptics.exe (PID: 2976)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start drop and start drop and start winrar.exe mbr - image builder.exe no specs mbr - note builder.exe no specs mbr_builder.exe ._cache_mbr_builder.exe no specs #NJRAT synaptics.exe

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Nouveau dossier.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2428"C:\Users\admin\AppData\Local\Temp\Rar$EXa540.11915\Nouveau dossier\MBR - Image Builder.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa540.11915\Nouveau dossier\MBR - Image Builder.exe—WinRAR.exe
User:
admin
Company:
WobbyChip
Integrity Level:
MEDIUM
Description:
Create Custom MBR With Your Image
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa540.11915\nouveau dossier\mbr - image builder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2480"C:\Users\admin\AppData\Local\Temp\Rar$EXa540.13051\Nouveau dossier\MBR_BUILDER.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa540.13051\Nouveau dossier\MBR_BUILDER.exe
WinRAR.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa540.13051\nouveau dossier\mbr_builder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2704"C:\Users\admin\AppData\Local\Temp\Rar$EXa540.13051\Nouveau dossier\._cache_MBR_BUILDER.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa540.13051\Nouveau dossier\._cache_MBR_BUILDER.exe—MBR_BUILDER.exe
User:
admin
Company:
WobbyChip
Integrity Level:
MEDIUM
Description:
Create Custom MBR With Your Text And Colors
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa540.13051\nouveau dossier\._cache_mbr_builder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2976"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
MBR_BUILDER.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3084"C:\Users\admin\AppData\Local\Temp\Rar$EXa540.12536\Nouveau dossier\MBR - Note Builder.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa540.12536\Nouveau dossier\MBR - Note Builder.exe—WinRAR.exe
User:
admin
Company:
WobbyChip
Integrity Level:
MEDIUM
Description:
Create Custom MBR With Your Text And Colors
Exit code:
0
Version:
3.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa540.12536\nouveau dossier\mbr - note builder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
1 085
Read events
992
Write events
93
Delete events
0

Modification events

(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(540) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(540) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Nouveau dossier.rar
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
12
Suspicious files
6
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2480MBR_BUILDER.exeC:\ProgramData\Synaptics\RCX8D5F.tmp —
MD5:—
SHA256:—
2976Synaptics.exeC:\Users\admin\AppData\Local\Temp\Cab80D7.tmp —
MD5:—
SHA256:—
2976Synaptics.exeC:\Users\admin\AppData\Local\Temp\Tar80D8.tmp —
MD5:—
SHA256:—
2976Synaptics.exeC:\Users\admin\AppData\Local\Temp\qhbupb4.ini —
MD5:—
SHA256:—
2976Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:—
SHA256:—
540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa540.13051\Nouveau dossier\MBR - Image Builder.exeexecutable
MD5:E7C5F0910415EDF3AA571E3738B5741E
SHA256:5221A90748195966F5EDA98B3324C518C74E5B0E4C36C4F053B383D3A3E2F535
540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa540.11915\Nouveau dossier\MBR - Note Builder.exeexecutable
MD5:631E45F7BD3D32363362F09CBFBDFBAE
SHA256:FEF9F05FBB339B16A15848A1B4D743857CCCA6E347818CAD687DFC78119803E0
540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa540.11915\Nouveau dossier\MBR_BUILDER.exeexecutable
MD5:C93C2F9BC42C86216EFF6106578204F7
SHA256:322F967526A6AC97FD913B0A7E8055AA6E1E1D45E2B6E9A75208841ADDB57CBA
540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa540.13051\Nouveau dossier\MBR - Note Builder.exeexecutable
MD5:631E45F7BD3D32363362F09CBFBDFBAE
SHA256:FEF9F05FBB339B16A15848A1B4D743857CCCA6E347818CAD687DFC78119803E0
2976Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_5367338CD64305B25C8AF2566DBB5DA6binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
5
DNS requests
5
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2976
Synaptics.exe
GET
—
140.82.59.108:80
http://140.82.59.108/srim2
US
—
—
suspicious
2976
Synaptics.exe
GET
200
216.58.215.67:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCcNBqbB6TzhwMAAAAAy89X
US
der
472 b
whitelisted
2976
Synaptics.exe
GET
200
216.58.215.67:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFW%2FaJnucoBWAwAAAADLz40%3D
US
der
471 b
whitelisted
2976
Synaptics.exe
GET
200
216.58.215.67:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2976
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
Awknet Communications, LLC
US
malicious
2976
Synaptics.exe
142.250.186.174:443
docs.google.com
Google Inc.
US
whitelisted
2976
Synaptics.exe
140.82.59.108:80
—
—
US
suspicious
2976
Synaptics.exe
216.58.215.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
—
—
216.58.209.1:443
doc-14-14-docs.googleusercontent.com
Google Inc.
US
unknown

DNS requests

Domain
IP
Reputation
xred.mooo.com
  • —
suspicious
freedns.afraid.org
  • 69.42.215.252
  • 50.23.197.95
malicious
docs.google.com
  • 142.250.186.174
shared
ocsp.pki.goog
  • 216.58.215.67
whitelisted
doc-14-14-docs.googleusercontent.com
  • 216.58.209.1
shared

Threats

PID
Process
Class
Message
1060
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
2976
Synaptics.exe
A Network Trojan was detected
REMOTE [PTsecurity] njRat style IP-Check
2976
Synaptics.exe
A Network Trojan was detected
ET POLICY Suspicious User-Agent Containing .exe
2976
Synaptics.exe
A Network Trojan was detected
STEALER [PTsecurity] Napwhich
—
—
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
—
—
A Network Trojan was detected
ET POLICY Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
STEALER [PTsecurity] Napwhich
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Nouveau dossier.rar