analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1.zip

Full analysis: https://app.any.run/tasks/10600e25-6340-484d-92da-54efb81ea2c1
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 15, 2019, 16:52:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

6960EBD053FB5FC2D8792F0145A06A7D

SHA1:

53CD23F05518EAF160B8CCBB523E5236C3B75E2B

SHA256:

F1E61057605A38C6A9BF92F6E6671681E429F83DF050770C172097FE0871EFCC

SSDEEP:

3072:R1TenRzQZsOwfO9LZv3AHBN4jA8iV1aQaHPXP1IYW:R0RQ2OjAHv4jAbVKHPuZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • FortSlurper.exe (PID: 3816)
      • System_manager.exe (PID: 324)
      • tmp8101.tmp.exe (PID: 4036)
      • System_manager.exe (PID: 3068)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1256)

    • Writes to a start menu file

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • Changes the autorun value in the registry

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • Connects to CnC server

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • NJRAT was detected

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FortSlurper.exe (PID: 3816)
      • WinRAR.exe (PID: 2964)
      • System_manager.exe (PID: 324)
      • tmp8101.tmp.exe (PID: 4036)
      • System_manager.exe (PID: 3068)

    • Creates files in the user directory

      • FortSlurper.exe (PID: 3816)
      • System_manager.exe (PID: 324)
      • tmp8101.tmp.exe (PID: 4036)
      • System_manager.exe (PID: 3068)

    • Uses NETSH.EXE for network configuration

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • Starts itself from another location

      • FortSlurper.exe (PID: 3816)
      • tmp8101.tmp.exe (PID: 4036)

    • Starts CMD.EXE for commands execution

      • System_manager.exe (PID: 324)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 588)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Fortnite Slurper Checker/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:05:15 16:58:08
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
16
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe searchprotocolhost.exe no specs fortslurper.exe #NJRAT system_manager.exe netsh.exe no specs tmp8101.tmp.exe netsh.exe no specs cmd.exe no specs ping.exe no specs #NJRAT system_manager.exe netsh.exe no specs regedit.exe no specs regedit.exe cmd.exe netstat.exe no specs netstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1256"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3816"C:\Users\admin\Desktop\Fortnite Slurper Checker\FortSlurper.exe" C:\Users\admin\Desktop\Fortnite Slurper Checker\FortSlurper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
324"C:\Users\admin\AppData\Roaming\System_manager.exe" C:\Users\admin\AppData\Roaming\System_manager.exe
FortSlurper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3968netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\System_manager.exe" "System_manager.exe" ENABLEC:\Windows\system32\netsh.exe—System_manager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4036"C:\Users\admin\AppData\Local\Temp\tmp8101.tmp.exe" ..C:\Users\admin\AppData\Local\Temp\tmp8101.tmp.exe
System_manager.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
676netsh firewall delete allowedprogram "C:\Users\admin\AppData\Roaming\System_manager.exe"C:\Windows\system32\netsh.exe—System_manager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2404cmd.exe /c ping 0 -n 2 & del "C:\Users\admin\AppData\Roaming\System_manager.exe"C:\Windows\system32\cmd.exe—System_manager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2668ping 0 -n 2 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3068"C:\Users\admin\AppData\Roaming\System_manager.exe" C:\Users\admin\AppData\Roaming\System_manager.exe
tmp8101.tmp.exe
User:
admin
Integrity Level:
HIGH
Total events
2 538
Read events
1 949
Write events
586
Delete events
3

Modification events

(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2964) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\1.zip
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3816) FortSlurper.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3816) FortSlurper.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
8
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
324System_manager.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6069c10fb03a92473633134bb7e91c38.exeexecutable
MD5:C6682DDCE7D11373FC0654CE6A29CA51
SHA256:31DEEBDEDB7F917AA30EFB6CF8F12F48DBE34DE07896DCAD874FBA29CCE48A19
4036tmp8101.tmp.exeC:\Users\admin\AppData\Roaming\System_manager.exeexecutable
MD5:6FF7BC5D33BB6118D9EB664C303EB604
SHA256:499A8F81BDC69B31A86D1606796E872DD6BABE0242A7900F67AB50451F05EF85
3068System_manager.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19e0e82edf35be9fb14741ee8dfb00a8.exeexecutable
MD5:6FF7BC5D33BB6118D9EB664C303EB604
SHA256:499A8F81BDC69B31A86D1606796E872DD6BABE0242A7900F67AB50451F05EF85
324System_manager.exeC:\Users\admin\AppData\Local\Temp\tmp8101.tmp.exeexecutable
MD5:6FF7BC5D33BB6118D9EB664C303EB604
SHA256:499A8F81BDC69B31A86D1606796E872DD6BABE0242A7900F67AB50451F05EF85
3816FortSlurper.exeC:\Users\admin\AppData\Roaming\System_manager.exeexecutable
MD5:C6682DDCE7D11373FC0654CE6A29CA51
SHA256:31DEEBDEDB7F917AA30EFB6CF8F12F48DBE34DE07896DCAD874FBA29CCE48A19
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.19657\Fortnite Slurper Checker\FortSlurper.exeexecutable
MD5:C6682DDCE7D11373FC0654CE6A29CA51
SHA256:31DEEBDEDB7F917AA30EFB6CF8F12F48DBE34DE07896DCAD874FBA29CCE48A19
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.19657\Fortnite Slurper Checker\xNet.dllexecutable
MD5:AC1DCEDDBC66A1AB7915AC9931F0CFEC
SHA256:CC949931EF9533ADCED83F3D58862E9732E5DB7AD17B5FD4CB9D209A99EDB592
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.19657\Fortnite Slurper Checker\Bunifu_UI_v1.5.3.dllexecutable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
System_manager.exe
197.25.152.77:1177
forupload.ddns.net
Tunisia BackBone AS
TN
malicious
3068
System_manager.exe
197.25.152.77:1177
forupload.ddns.net
Tunisia BackBone AS
TN
malicious

DNS requests

Domain
IP
Reputation
forupload.ddns.net
  • 197.25.152.77
malicious
linkobenz.ddns.net
  • 197.25.152.77
malicious

Threats

PID
Process
Class
Message
324
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
324
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Capture)
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
21 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1.zip