File name:

test007.exe

Full analysis: https://app.any.run/tasks/0ca5b79a-5bed-4c9c-bc40-edb37321b757
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: March 02, 2025, 13:13:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

0431311B5F024D6E66B90D59491F2563

SHA1:

E9FF4DA7E3F2199CBC16D37D8935CB1B0567AC2A

SHA256:

FD624AA205517580E83FAD7A4CE4D64863E95F62B34AC72647B1974A52822199

SSDEEP:

12288:+O9vE3J7JO+xEPuc//9wivAmv6SAbnzmip2hGnadlFM4ZHOT2g:+eXuczPCSGnzVjad1g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • windows.exe (PID: 5324)

    • NJRAT has been detected (YARA)

      • test007.exe (PID: 6184)

    • NjRAT is detected

      • windows.exe (PID: 5324)

    • Changes the autorun value in the registry

      • windows.exe (PID: 5324)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • test007.exe (PID: 6184)
      • njq8.exe (PID: 1452)
      • windows.exe (PID: 5324)

    • Reads security settings of Internet Explorer

      • test007.exe (PID: 6184)
      • njq8.exe (PID: 1452)

    • Creates file in the systems drive root

      • test007.exe (PID: 6184)
      • njq8.exe (PID: 1452)
      • njRAT.exe (PID: 4180)

    • Starts itself from another location

      • njq8.exe (PID: 1452)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • windows.exe (PID: 5324)

  • INFO

    • Checks supported languages

      • test007.exe (PID: 6184)
      • njq8.exe (PID: 1452)
      • njRAT.exe (PID: 4180)
      • windows.exe (PID: 5324)

    • Reads the computer name

      • test007.exe (PID: 6184)
      • njq8.exe (PID: 1452)
      • njRAT.exe (PID: 4180)
      • windows.exe (PID: 5324)

    • Process checks computer location settings

      • test007.exe (PID: 6184)
      • njq8.exe (PID: 1452)

    • Reads the machine GUID from the registry

      • test007.exe (PID: 6184)
      • windows.exe (PID: 5324)

    • Create files in a temporary directory

      • njq8.exe (PID: 1452)
      • windows.exe (PID: 5324)

    • Creates files or folders in the user directory

      • windows.exe (PID: 5324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:09:27 08:00:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 959488
InitializedDataSize: 21504
UninitializedDataSize: -
EntryPoint: 0xec3de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.6.4.0
ProductVersionNumber: 0.6.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: njRAT
CompanyName: njq8
FileDescription: njRAT
FileVersion: 0.6.4.0
InternalName: EnKSaR.HaCKeR.exe
LegalCopyright: Copyright © njq8 2013
LegalTrademarks: njRAT
OriginalFileName: EnKSaR.HaCKeR.exe
ProductName: njRAT
ProductVersion: 0.6.4.0
AssemblyVersion: 0.6.4.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT test007.exe njrat.exe no specs njq8.exe #NJRAT windows.exe netsh.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs svchost.exe test007.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\njq8.exe" C:\njq8.exe
test007.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\njq8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4120"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4180"C:\njRAT.exe" C:\njRAT.exe—test007.exe
User:
admin
Company:
njq8
Integrity Level:
HIGH
Description:
njRAT
Version:
0.6.4.0
Modules
Images
c:\njrat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5324"C:\Users\admin\AppData\Local\Temp\windows.exe" C:\Users\admin\AppData\Local\Temp\windows.exe
njq8.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5332netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLEC:\Windows\SysWOW64\netsh.exe—windows.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5960"C:\Users\admin\AppData\Local\Temp\test007.exe" C:\Users\admin\AppData\Local\Temp\test007.exe—explorer.exe
User:
admin
Company:
njq8
Integrity Level:
MEDIUM
Description:
njRAT
Exit code:
3221226540
Version:
0.6.4.0
Modules
Images
c:\users\admin\appdata\local\temp\test007.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6184"C:\Users\admin\AppData\Local\Temp\test007.exe" C:\Users\admin\AppData\Local\Temp\test007.exe
explorer.exe
User:
admin
Company:
njq8
Integrity Level:
HIGH
Description:
njRAT
Version:
0.6.4.0
Modules
Images
c:\users\admin\appdata\local\temp\test007.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6744C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
2 145
Read events
2 032
Write events
113
Delete events
0

Modification events

(PID) Process:(5324) windows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ecc7c8c51c0850c1ec247c7fd3602f20
Value:
"C:\Users\admin\AppData\Local\Temp\windows.exe" ..
(PID) Process:(5324) windows.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ecc7c8c51c0850c1ec247c7fd3602f20
Value:
"C:\Users\admin\AppData\Local\Temp\windows.exe" ..
(PID) Process:(5324) windows.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6184test007.exeC:\njq8.exeexecutable
MD5:EDC4F10A5E164DB64BF79ECA207F2749
SHA256:CE6421107031175F39E61D3BCC5A98D1D94190E250034E27CDBEBBADCBA084A4
1452njq8.exeC:\Users\admin\AppData\Local\Temp\windows.exeexecutable
MD5:EDC4F10A5E164DB64BF79ECA207F2749
SHA256:CE6421107031175F39E61D3BCC5A98D1D94190E250034E27CDBEBBADCBA084A4
6184test007.exeC:\njRAT.exeexecutable
MD5:08F223AC15E2E92561ED310AE71415C1
SHA256:51F2AEC8B6DE1E49B1CA74203AFD380484932B07067A91F027548BC20B8967EC
5324windows.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exeexecutable
MD5:EDC4F10A5E164DB64BF79ECA207F2749
SHA256:CE6421107031175F39E61D3BCC5A98D1D94190E250034E27CDBEBBADCBA084A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
19
DNS requests
19
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7572
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7572
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5256
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7572
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.128
  • 40.126.31.3
  • 40.126.31.1
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.4
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
zaaptoo.zapto.org
  • —
malicious
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
test007.exe