File name:

NjRat-0.7D-Green-Edition-by-im523-1-master.zip

Full analysis: https://app.any.run/tasks/1fa716fb-8e32-43d2-b348-970fb6aab502
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 23, 2023, 13:34:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
securityxploded
rat
njrat
bladabindi
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

77DDAB4D4D6660D37E196938A5CC8979

SHA1:

1401C14FC8B6E1CFD3D27AE1221E3868F5D0BCEA

SHA256:

EB37F92D1B15E9FEFD836B1DABAC9EAD57EB279B1744F9CA51622BB608B05F86

SSDEEP:

98304:g0s3Ju7tMtCimcE5Ec5Fk27hejiIV15kdb/yuSRAop6F4GZiAuV1d1YjeucCzf5+:P+9Ue

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • server.exe (PID: 2060)
      • server.exe (PID: 4092)

    • NJRAT has been detected (YARA)

      • server.exe (PID: 2060)
      • server.exe (PID: 4092)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 948)
      • server.exe (PID: 2060)

    • NjRAT is detected

      • server.exe (PID: 2060)
      • Server.exe (PID: 3684)
      • server.exe (PID: 4092)

    • Steals credentials from Web Browsers

      • server.exe (PID: 2060)
      • vbc.exe (PID: 948)

    • Starts CMD.EXE for self-deleting

      • server.exe (PID: 2060)

    • Changes the autorun value in the registry

      • server.exe (PID: 2060)
      • server.exe (PID: 4092)

  • SUSPICIOUS

    • Reads the Internet Settings

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • Server.exe (PID: 2292)
      • vbc.exe (PID: 948)
      • Server.exe (PID: 3684)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • server.exe (PID: 2060)
      • server.exe (PID: 4092)

    • The process creates files with name similar to system file names

      • server.exe (PID: 2060)

    • The process executes VB scripts

      • server.exe (PID: 2060)

    • Starts CMD.EXE for commands execution

      • server.exe (PID: 2060)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • server.exe (PID: 2060)

  • INFO

    • Checks supported languages

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • ilasm.exe (PID: 2428)
      • Server.exe (PID: 2292)
      • server.exe (PID: 2060)
      • vbc.exe (PID: 948)
      • Server.exe (PID: 3684)
      • server.exe (PID: 4092)

    • Reads the computer name

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • Server.exe (PID: 2292)
      • server.exe (PID: 2060)
      • vbc.exe (PID: 948)
      • Server.exe (PID: 3684)
      • server.exe (PID: 4092)

    • Reads the machine GUID from the registry

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • server.exe (PID: 2060)
      • Server.exe (PID: 2292)
      • vbc.exe (PID: 948)
      • server.exe (PID: 4092)
      • Server.exe (PID: 3684)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 124)
      • ilasm.exe (PID: 2428)
      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • Server.exe (PID: 2292)
      • server.exe (PID: 2060)
      • Server.exe (PID: 3684)
      • server.exe (PID: 4092)

    • SecurityXploded is detected

      • WinRAR.exe (PID: 124)
      • vbc.exe (PID: 948)

    • Create files in a temporary directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • Server.exe (PID: 2292)
      • vbc.exe (PID: 948)
      • server.exe (PID: 2060)
      • Server.exe (PID: 3684)

    • Manual execution by a user

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • Server.exe (PID: 2292)
      • Server.exe (PID: 3684)
      • taskmgr.exe (PID: 3272)

    • Reads Environment values

      • NjRat 0.7D Green Edition by im523.exe (PID: 1576)
      • server.exe (PID: 2060)
      • server.exe (PID: 4092)

    • Starts itself from another location

      • Server.exe (PID: 2292)
      • Server.exe (PID: 3684)

    • Steals credentials

      • vbc.exe (PID: 948)

    • Creates files or folders in the user directory

      • server.exe (PID: 2060)
      • server.exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2060) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
(PID) Process(4092) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2021:11:12 09:05:52
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: NjRat-0.7D-Green-Edition-by-im523-1-master/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
14
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe no specs njrat 0.7d green edition by im523.exe ilasm.exe no specs server.exe #NJRAT server.exe netsh.exe no specs #SECURITYXPLODED vbc.exe netsh.exe no specs cmd.exe no specs ping.exe no specs taskmgr.exe no specs #NJRAT server.exe #NJRAT server.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NjRat-0.7D-Green-Edition-by-im523-1-master.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
948"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\admin\AppData\Local\Temp\4670034"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1576"C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-1-master\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\NjRat-0.7D-Green-Edition-by-im523-1-master\NjRat 0.7D Green Edition by im523.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
NjRat 0.7D Green Edition by im523
Exit code:
0
Version:
0.0.0.7
Modules
Images
c:\users\admin\desktop\njrat-0.7d-green-edition-by-im523-1-master\njrat 0.7d green edition by im523.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2060"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
Server.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2060) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
2292"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2428"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe—NjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2884netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3168netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe"C:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3180cmd.exe /k ping 0 & del "C:\Users\admin\AppData\Local\Temp\server.exe" & exitC:\Windows\System32\cmd.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3232ping 0 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
11 000
Read events
10 427
Write events
567
Delete events
6

Modification events

(PID) Process:(124) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
16
Suspicious files
32
Text files
88
Unknown types
0

Dropped files

PID
Process
Filename
Type
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\.gitignoretext
MD5:F4D61F06FF1F26F8A4BFD8CE606936CF
SHA256:FDC17FD35182CA77A4888C8682F48BA5B57463CA5865B96EB8A652BA15C63664
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\NjRat 0.7D Green Edition by im523.exeexecutable
MD5:1033C448810D3B507423546432E2F502
SHA256:F0C85722B88D1E7A1941BA17551CD5C29AEF99FAD86D78A5631A0F5446B3F580
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\Plugin\sc2.dllexecutable
MD5:19967E886EDCD2F22F8D4A58C8EA3773
SHA256:3E5141C75B7746C0EB2B332082A165DEACB943CEF26BD84668E6B79B47BDFD93
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\Plugin\mic.dllexecutable
MD5:D4C5DDC00F27162FC0947830E0E762B7
SHA256:B6FB6B66821E70A27A4750B0CD0393E4EE2603A47FEAC48D6A3D66D1C1CB56D5
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\LICENSEtext
MD5:D88E9E08385D2A17052DAC348BDE4BC1
SHA256:6B0382B16279F26FF69014300541967A356A666EB0B91B422F6862F6B7DAD17E
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\Plugin\ch.dllexecutable
MD5:73C8A5CD64FCF87186A6A9AC870DF509
SHA256:7722206DBA0CFB290F33093F9430CB770A160947001715AE11E6DBBFAEF1C0EE
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\src\NjRat 0.7D Green Edition by im523\About.Designer.vbtext
MD5:806D869B1E39BDC82D61638829F9D95C
SHA256:2E1CA3ED75057613B7BDF660D16726CFA22DEF020CAEE212308C10838F401450
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa124.45927\NjRat-0.7D-Green-Edition-by-im523-1-master\src\NjRat 0.7D Green Edition by im523\About.resourcesbinary
MD5:C69CF18E024AB2A5D704C7806C425CF5
SHA256:AC0832D4E920E03C2A9160DAB51E6545F42785C34EF4671317F77C42FF463D79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRat-0.7D-Green-Edition-by-im523-1-master.zip