File name:

Minecraft Checker v2.rar

Full analysis: https://app.any.run/tasks/604c53ec-4080-4479-b860-ca1428378942
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 10:09:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

AFB5323189D4BCCE9B48F23B753531DD

SHA1:

4C312764C14100B88A92BE61ABBF396AD553F9F2

SHA256:

EC959907F0F8959D388C24F9B0ED2478159F0F1F4E6DE75F31A5A5EC9DEB925D

SSDEEP:

6144:lu/MIeXU/Iw8c7/p6RxT6iB7W9j8DfFSXAXg6YuffWqgpr3b4ZXKl4d01sxaULi3:l/IeXAtIT6ip+QwyuqgpDEZXS4dMmLi3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • VIP72.exe (PID: 3132)

    • Application was dropped or rewritten from another process

      • Minecraft Checker.exe (PID: 3396)
      • VIP72.exe (PID: 3132)

    • NJRAT was detected

      • VIP72.exe (PID: 3132)

    • Changes the autorun value in the registry

      • VIP72.exe (PID: 3132)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Minecraft Checker.exe (PID: 3396)
      • VIP72.exe (PID: 3132)
      • WinRAR.exe (PID: 2520)

    • Creates files in the user directory

      • VIP72.exe (PID: 3132)
      • Minecraft Checker.exe (PID: 3396)

    • Uses NETSH.EXE for network configuration

      • VIP72.exe (PID: 3132)

    • Starts itself from another location

      • Minecraft Checker.exe (PID: 3396)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe minecraft checker.exe #NJRAT vip72.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2520"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Minecraft Checker v2.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3108netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\VIP72.exe" "VIP72.exe" ENABLEC:\Windows\system32\netsh.exe—VIP72.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3132"C:\Users\admin\AppData\Roaming\VIP72.exe" C:\Users\admin\AppData\Roaming\VIP72.exe
Minecraft Checker.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\vip72.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3396"C:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\Minecraft Checker.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\Minecraft Checker.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2520.43489\minecraft checker v2\minecraft checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
909
Read events
825
Write events
84
Delete events
0

Modification events

(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2520) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Minecraft Checker v2.rar
(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2520) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(3396) Minecraft Checker.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
Executable files
6
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2520WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\Minecraft Checker.exeexecutable
MD5:—
SHA256:—
2520WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\pdbz.datbinary
MD5:—
SHA256:—
2520WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\Read before using.txttext
MD5:—
SHA256:—
3396Minecraft Checker.exeC:\Users\admin\AppData\Roaming\VIP72.exeexecutable
MD5:—
SHA256:—
2520WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\MetroSuite 2.0.dllexecutable
MD5:0D30A398CEC0FF006B6EA2B52D11E744
SHA256:8604BF2A1FE2E94DC1EA1FBD0CF54E77303493B93994DF48479DC683580AA654
2520WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\Qoollo.Turbo.dllexecutable
MD5:4E8246DF4EE956EC273C4BAA2054593C
SHA256:1172732FD0FE6B679F5C6BF750598133DC815622C55EF1FA84087087BF42B495
2520WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2520.43489\Minecraft Checker v2\xNet.dllexecutable
MD5:158DEFD55A804AA8D4D67BFDF7A4AF9C
SHA256:6C7EC4CC31A2CE0B97703B7A42E3448E9B87D96DDA12761CA24D8787AC27CFF1
3132VIP72.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63951ff13995ee572862321383fecced.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3132
VIP72.exe
3.134.252.206:2255
recreciptor.hopto.org
—
US
malicious

DNS requests

Domain
IP
Reputation
recreciptor.hopto.org
  • 3.134.252.206
malicious

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.hopto .org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Minecraft Checker v2.rar