File name:

big tits sex.zip

Full analysis: https://app.any.run/tasks/57ab2b6e-ac01-4a6c-af74-ee7851dc82d4
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 02, 2024, 11:12:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

4DA1D03A22B91E7E129599A312BC75B5

SHA1:

550D1816B56A7FA1E45B52EF8C4F912126DBD887

SHA256:

F33E9C52B284F054B3C67E9E90C06A949645B86FCB1D70A172E45A5DDBF19B75

SSDEEP:

384:X4hJf55TVqrmlwLcLBwCONYlbQxWgznYYs5YC2YWUDcj4eTuzMqI:IhJRiilwQFw1NYlbQWyYYsPWUDr14

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • finalround.exe (PID: 1820)

    • NjRAT is detected

      • better.exe (PID: 1624)
      • finalround.exe (PID: 1820)

    • NJRAT has been detected (YARA)

      • finalround.exe (PID: 1820)

    • Changes the autorun value in the registry

      • finalround.exe (PID: 1820)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • finalround.exe (PID: 1820)

    • Reads the Internet Settings

      • better.exe (PID: 1624)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • finalround.exe (PID: 1820)

  • INFO

    • Checks supported languages

      • better.exe (PID: 2204)
      • finalround.exe (PID: 1820)
      • better.exe (PID: 1624)

    • Reads the computer name

      • better.exe (PID: 2204)
      • better.exe (PID: 1624)
      • finalround.exe (PID: 1820)

    • Manual execution by a user

      • better.exe (PID: 1624)

    • Drops the executable file immediately after the start

      • better.exe (PID: 1624)
      • finalround.exe (PID: 1820)
      • WinRAR.exe (PID: 2124)

    • Creates files or folders in the user directory

      • finalround.exe (PID: 1820)

    • Starts itself from another location

      • better.exe (PID: 1624)

    • Reads the machine GUID from the registry

      • better.exe (PID: 2204)
      • better.exe (PID: 1624)
      • finalround.exe (PID: 1820)

    • Reads Environment values

      • finalround.exe (PID: 1820)

    • NJRAT has been detected (SURICATA)

      • finalround.exe (PID: 1820)

    • Connects to unusual port

      • finalround.exe (PID: 1820)

    • Connects to the CnC server

      • finalround.exe (PID: 1820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1820) finalround.exe
C280.246.70.38
Ports45
Botnetproblast
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\2ab8c5833320728337fe88f537ae5d6c
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x00000000
ZipCompressedSize: 17448
ZipUncompressedSize: 37888
ZipFileName: better.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs better.exe no specs #NJRAT better.exe #NJRAT finalround.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1624"C:\Users\admin\Desktop\better.exe" C:\Users\admin\Desktop\better.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\better.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1820"C:\Windows\finalround.exe" C:\Windows\finalround.exe
better.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\finalround.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1820) finalround.exe
C280.246.70.38
Ports45
Botnetproblast
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\2ab8c5833320728337fe88f537ae5d6c
Splitter|'|'|
Versionim523
2124"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\big tits sex.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2168netsh firewall add allowedprogram "C:\Windows\finalround.exe" "finalround.exe" ENABLEC:\Windows\System32\netsh.exe—finalround.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2204"C:\Users\admin\AppData\Local\Temp\Rar$EXb2124.42343\better.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2124.42343\better.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2124.42343\better.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
3 286
Read events
2 686
Write events
600
Delete events
0

Modification events

(PID) Process:(2124) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
5
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1624better.exeC:\Windows\finalround.exeexecutable
MD5:321798C3CC55842F3734C791CE3A4685
SHA256:ABFD199993BF157E715B38B597954A2B5ED4B6DCCB2C4A0F3FB0FAC40B42007F
1820finalround.exeC:\autorun.infbinary
MD5:5B0B50BADE67C5EC92D42E971287A5D9
SHA256:04DDE2489D2D2E6846D42250D813AB90B5CA847D527F8F2C022E6C327DC6DB53
1820finalround.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2ab8c5833320728337fe88f537ae5d6c.exeexecutable
MD5:321798C3CC55842F3734C791CE3A4685
SHA256:ABFD199993BF157E715B38B597954A2B5ED4B6DCCB2C4A0F3FB0FAC40B42007F
2124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2124.42343\better.exeexecutable
MD5:321798C3CC55842F3734C791CE3A4685
SHA256:ABFD199993BF157E715B38B597954A2B5ED4B6DCCB2C4A0F3FB0FAC40B42007F
2124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2124.43715\better.exeexecutable
MD5:321798C3CC55842F3734C791CE3A4685
SHA256:ABFD199993BF157E715B38B597954A2B5ED4B6DCCB2C4A0F3FB0FAC40B42007F
1820finalround.exeC:\svchost.exeexecutable
MD5:321798C3CC55842F3734C791CE3A4685
SHA256:ABFD199993BF157E715B38B597954A2B5ED4B6DCCB2C4A0F3FB0FAC40B42007F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1820
finalround.exe
80.246.70.38:45
—
Rostelecom
RU
unknown

DNS requests

No data

Threats

PID
Process
Class
Message
1820
finalround.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
big tits sex.zip