File name:

njRAT v0.7d Danger Edition.rar

Full analysis: https://app.any.run/tasks/358a36f8-78dd-400e-b878-7881304f282a
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: March 26, 2023, 13:59:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0702009D9ADF4EE4C1ECBCF84E530B3A

SHA1:

FDF8EA6C0110B01586D08637E00176D381FBBFBE

SHA256:

FFF7F41551E1CF33AD805F3DBB3FC84BA39FB77DAF9DB1D98721BE2CE9B1BD95

SSDEEP:

98304:6cRtxz0qUkR9jPzkp7GunIw3WIAXM1VbuPr:6SxgqUk7jzkpauIw3HAXM1Yr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • mpress.exe (PID: 1012)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • NjRAT is detected

      • Patsh.exe (PID: 980)

  • SUSPICIOUS

    • Reads the Internet Settings

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • rundll32.exe (PID: 3408)
      • Patsh.exe (PID: 980)

    • Starts CMD.EXE for commands execution

      • njRAT v0.7d Danger Edition.exe (PID: 1764)

    • Executable content was dropped or overwritten

      • mpress.exe (PID: 1012)
      • ilasm.exe (PID: 2780)
      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • ilasm.exe (PID: 2800)
      • Patsh.exe (PID: 980)

    • Uses RUNDLL32.EXE to load library

      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2824)

    • Reads the machine GUID from the registry

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • Reads the computer name

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • Checks supported languages

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • ilasm.exe (PID: 2780)
      • mpress.exe (PID: 1012)
      • ilasm.exe (PID: 2800)
      • Patsh.exe (PID: 980)
      • server.exe (PID: 3520)

    • Reads Environment values

      • njRAT v0.7d Danger Edition.exe (PID: 1764)

    • The process checks LSA protection

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • rundll32.exe (PID: 1760)
      • Patsh.exe (PID: 980)
      • rundll32.exe (PID: 3408)

    • Manual execution by a user

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • Create files in a temporary directory

      • mpress.exe (PID: 1012)
      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
11
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe njrat v0.7d danger edition.exe ilasm.exe cmd.exe no specs mpress.exe server.exe rundll32.exe no specs ilasm.exe #NJRAT patsh.exe rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
980"C:\Users\admin\Desktop\Patsh.exe" C:\Users\admin\Desktop\Patsh.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\patsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1012UPX\mpress.exe -s "C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\UPX\mpress.exe
cmd.exe
User:
admin
Company:
MATCODE Software
Integrity Level:
MEDIUM
Description:
Matcode comPRESSor
Exit code:
0
Version:
2.19
Modules
Images
c:\users\admin\desktop\njrat v0.7d danger edition\upx\mpress.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\patshC:\Windows\System32\rundll32.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1764"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\njRAT v0.7d Danger Edition.exe" C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\njRAT v0.7d Danger Edition.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\njrat v0.7d danger edition\njrat v0.7d danger edition.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
2780"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
njRAT v0.7d Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2800"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Patsh.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
njRAT v0.7d Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2824"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\njRAT v0.7d Danger Edition.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
2968cmd.exe /C UPX\mpress.exe -s "C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe"C:\Windows\System32\cmd.exe—njRAT v0.7d Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3408"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\patshC:\Windows\System32\rundll32.exe—Patsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
3520"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe" C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\njrat v0.7d danger edition\server.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
18 154
Read events
17 772
Write events
366
Delete events
16

Modification events

(PID) Process:(2824) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
42
Suspicious files
2
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\njRAT v0.7d Danger Edition.exeexecutable
MD5:85CFE00567DB5B2DF0648D8943D1CC94
SHA256:AAF1D1465D24C051F9077FE5264C478E21FE3F62FF38196FE4622D09733B523E
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\NjRat 0.7D.resources.dllexecutable
MD5:87007C82A741E7F5E7AB4A7F55CBB65A
SHA256:808776A276F01826E3557D59E03513BA9F266FF69006B5CEEFF00C9D9EB7B44C
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
2780ilasm.exeC:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exeexecutable
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
2780ilasm.exeC:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.pdbpdb
MD5:—
SHA256:—
1764njRAT v0.7d Danger Edition.exeC:\Users\admin\Desktop\njRAT v0.7d Danger Edition\RCXE720.tmpexecutable
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\ar\NjRat 0.7D.resources.dllexecutable
MD5:EAC5655DAC58D912B4D5659621911503
SHA256:7058F20403655057B6C9AE8EF520F817F950FEF281ACE567C43B80A90083C575
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\UPX\Stub.exeexecutable
MD5:46D6DD6FFB10A5D8EB9CDCD85F713486
SHA256:31EFD38C8E6451D661CB09964C14ECA69B4B702A10EDA40762F8F005A500ACA5
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Plugin\mic.dllexecutable
MD5:D4C5DDC00F27162FC0947830E0E762B7
SHA256:B6FB6B66821E70A27A4750B0CD0393E4EE2603A47FEAC48D6A3D66D1C1CB56D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
njRAT v0.7d Danger Edition.rar