analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Facebook Group Autopost v1.1.rar

Full analysis: https://app.any.run/tasks/e7bdab26-bebc-4176-9275-138778fdda4f
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 07:00:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
miner
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9BB097AE7D83BEBE8CD745B357C23E36

SHA1:

AD1AB5272D33765CB9E5B936F4B49DD9A3093764

SHA256:

DF6A1E642512DDB0693B138E3F12F25EFC61EED55502F4F22BDBF3F4AED50639

SSDEEP:

196608:1gy23DDZEM1TdSJLo+ASFtkPu1wCHfIBwDqQtNR03sxRbJHy:ey23DRdH+wurHww9b379Hy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Facebook Group Autopost v1.1.exe (PID: 2548)
      • bohemian.sfx.exe (PID: 3800)
      • n.exe (PID: 2788)
      • L.exe (PID: 2976)
      • nj.exe (PID: 3324)
      • bohemian.exe (PID: 2980)
      • LL.exe (PID: 2352)
      • ILCADXLAX.exe (PID: 3832)
      • Facebook Group Autopost v1.1.exe (PID: 3872)
      • data.exe (PID: 1660)
      • service.exe (PID: 3616)

    • Changes the autorun value in the registry

      • bohemian.exe (PID: 2980)
      • data.exe (PID: 1660)

    • Uses Task Scheduler to run other applications

      • bohemian.exe (PID: 2980)
      • L.exe (PID: 2976)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3068)
      • schtasks.exe (PID: 3204)
      • schtasks.exe (PID: 4092)

    • Connects to CnC server

      • ILCADXLAX.exe (PID: 3832)

    • MINER was detected

      • ILCADXLAX.exe (PID: 3832)

    • Writes to a start menu file

      • data.exe (PID: 1660)

    • NJRAT was detected

      • data.exe (PID: 1660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Facebook Group Autopost v1.1.exe (PID: 2548)
      • WinRAR.exe (PID: 3280)
      • bohemian.sfx.exe (PID: 3800)
      • bohemian.exe (PID: 2980)
      • nj.exe (PID: 3324)
      • data.exe (PID: 1660)
      • L.exe (PID: 2976)

    • Connects to unusual port

      • ILCADXLAX.exe (PID: 3832)
      • data.exe (PID: 1660)

    • Creates files in the user directory

      • nj.exe (PID: 3324)
      • data.exe (PID: 1660)
      • L.exe (PID: 2976)

    • Starts itself from another location

      • nj.exe (PID: 3324)
      • L.exe (PID: 2976)

    • Uses NETSH.EXE for network configuration

      • data.exe (PID: 1660)

  • INFO

    • Application was crashed

      • Facebook Group Autopost v1.1.exe (PID: 3872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
16
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe facebook group autopost v1.1.exe bohemian.sfx.exe l.exe ll.exe no specs n.exe no specs nj.exe facebook group autopost v1.1.exe bohemian.exe schtasks.exe no specs schtasks.exe no specs #MINER ilcadxlax.exe #NJRAT data.exe netsh.exe no specs schtasks.exe no specs service.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3280"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Facebook Group Autopost v1.1.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2548"C:\Users\admin\Desktop\Facebook Group Autopost v1.1.exe" C:\Users\admin\Desktop\Facebook Group Autopost v1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3800"C:\Users\admin\AppData\Local\Temp\bohemian.sfx.exe" C:\Users\admin\AppData\Local\Temp\bohemian.sfx.exe
Facebook Group Autopost v1.1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2976"C:\Users\admin\AppData\Local\Temp\L.exe" C:\Users\admin\AppData\Local\Temp\L.exe
Facebook Group Autopost v1.1.exe
User:
admin
Integrity Level:
HIGH
Description:
Vis
Exit code:
0
Version:
1.0.0.0
2352"C:\Users\admin\AppData\Local\Temp\LL.exe" C:\Users\admin\AppData\Local\Temp\LL.exe—Facebook Group Autopost v1.1.exe
User:
admin
Integrity Level:
HIGH
Description:
Winx
Exit code:
0
Version:
1.3.1.1
2788"C:\Users\admin\AppData\Local\Temp\n.exe" C:\Users\admin\AppData\Local\Temp\n.exe—Facebook Group Autopost v1.1.exe
User:
admin
Integrity Level:
HIGH
Description:
Vis
Exit code:
0
Version:
1.0.0.0
3324"C:\Users\admin\AppData\Local\Temp\nj.exe" C:\Users\admin\AppData\Local\Temp\nj.exe
Facebook Group Autopost v1.1.exe
User:
admin
Integrity Level:
HIGH
Description:
Winx
Exit code:
0
Version:
1.3.1.1
3872"C:\Users\admin\AppData\Local\Temp\Facebook Group Autopost v1.1.exe" C:\Users\admin\AppData\Local\Temp\Facebook Group Autopost v1.1.exe
Facebook Group Autopost v1.1.exe
User:
admin
Integrity Level:
HIGH
Description:
Facebook Group Autopost
Version:
1.0.0.0
2980"C:\Users\admin\AppData\Local\Temp\bohemian.exe" C:\Users\admin\AppData\Local\Temp\bohemian.exe
bohemian.sfx.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
3068schtasks.exe /create /tn VFFWUNWSNPLW /tr C:\Users\admin\AppData\Local\XGCQDOKWGZNZKZR\SystemProcess.exe /sc minute /mo 1C:\Windows\system32\schtasks.exe—bohemian.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 128
Read events
2 010
Write events
0
Delete events
0

Modification events

No data
Executable files
13
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3280WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3280.15466\Facebook Group Autopost v1.1.exeexecutable
MD5:FBF2B80DEB1B7646DBF72EE362007480
SHA256:1B354636ACC34CA7B76E97DDB0526CEF2EB4EFF448E84F75A3823CB8F42E0D1A
3800bohemian.sfx.exeC:\Users\admin\AppData\Local\Temp\bohemian.exeexecutable
MD5:FC110DC6A58E9B34F067610CDF737646
SHA256:04D477992A608322150E4D32E57391CE18CB4502E5A306C83196C41618212357
1660data.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\da3434d6f617c5d897806b653bcb0ded.exeexecutable
MD5:4457F54753901525EFC37E6560FC27C7
SHA256:3952EDCD82C2D798563917BD1BB22BBF9AFAD9364AD73EF8D90EFFB9DB992D22
3324nj.exeC:\Users\admin\AppData\Roaming\data.exeexecutable
MD5:4457F54753901525EFC37E6560FC27C7
SHA256:3952EDCD82C2D798563917BD1BB22BBF9AFAD9364AD73EF8D90EFFB9DB992D22
2548Facebook Group Autopost v1.1.exeC:\Users\admin\AppData\Local\Temp\bohemian.sfx.exeexecutable
MD5:4A73122821CBB9FB48358BB95F36FF3B
SHA256:6709F853E0FA2DF9E5F765D04925D83425A5BF40FD5B7B71C1234DA0DF812848
2548Facebook Group Autopost v1.1.exeC:\Users\admin\AppData\Local\Temp\nj.exeexecutable
MD5:4457F54753901525EFC37E6560FC27C7
SHA256:3952EDCD82C2D798563917BD1BB22BBF9AFAD9364AD73EF8D90EFFB9DB992D22
2548Facebook Group Autopost v1.1.exeC:\Users\admin\AppData\Local\Temp\n.exeexecutable
MD5:61622B92DB7DDD3170CF811873889E71
SHA256:196442CB740327526C6C345C4F42ABB6922313E5E1C794E22A5B27AF9C07C719
3280WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3280.15466\Readme.txttext
MD5:2B34286BC8FF2EC9E52560EA069230A5
SHA256:49C7E7EAA831FDD32FB97B1FC2108BB2F2DF4F16C95F2EB86CD3123BFF4C17E4
2548Facebook Group Autopost v1.1.exeC:\Users\admin\AppData\Local\Temp\LL.exeexecutable
MD5:814F7F24DB56271222A87DB3CDB8501B
SHA256:B3C433EA15A5F94A0A71A4917C9A12E829FB3BA9834645B1443A2F5F41F98BB7
2548Facebook Group Autopost v1.1.exeC:\Users\admin\AppData\Local\Temp\L.exeexecutable
MD5:1FBC0F7560A656070AED2FBC22926905
SHA256:C55CE012AF3FAC4D0B1CFBAAB360C598E6FB847167CD3052DBE38997CF04CA93
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3832
ILCADXLAX.exe
80.188.53.27:5555
xmr.bohemianpool.com
O2 Czech Republic, a.s.
CZ
suspicious
1660
data.exe
79.159.172.236:5553
redlocal.hopto.org
Telefonica De Espana
ES
malicious

DNS requests

Domain
IP
Reputation
xmr.bohemianpool.com
  • 80.188.53.27
suspicious
redlocal.hopto.org
  • 79.159.172.236
malicious

Threats

PID
Process
Class
Message
3832
ILCADXLAX.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
3832
ILCADXLAX.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
3832
ILCADXLAX.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3832
ILCADXLAX.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
3832
ILCADXLAX.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3832
ILCADXLAX.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Facebook Group Autopost v1.1.rar