File name:

njRAT v0.7d Danger Edition.rar

Full analysis: https://app.any.run/tasks/358a36f8-78dd-400e-b878-7881304f282a
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: March 26, 2023, 13:59:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0702009D9ADF4EE4C1ECBCF84E530B3A

SHA1:

FDF8EA6C0110B01586D08637E00176D381FBBFBE

SHA256:

FFF7F41551E1CF33AD805F3DBB3FC84BA39FB77DAF9DB1D98721BE2CE9B1BD95

SSDEEP:

98304:6cRtxz0qUkR9jPzkp7GunIw3WIAXM1VbuPr:6SxgqUk7jzkpauIw3HAXM1Yr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • mpress.exe (PID: 1012)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • NjRAT is detected

      • Patsh.exe (PID: 980)

  • SUSPICIOUS

    • Reads the Internet Settings

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • rundll32.exe (PID: 3408)
      • Patsh.exe (PID: 980)

    • Executable content was dropped or overwritten

      • ilasm.exe (PID: 2780)
      • mpress.exe (PID: 1012)
      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • ilasm.exe (PID: 2800)
      • Patsh.exe (PID: 980)

    • Starts CMD.EXE for commands execution

      • njRAT v0.7d Danger Edition.exe (PID: 1764)

    • Uses RUNDLL32.EXE to load library

      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2824)

    • Reads the machine GUID from the registry

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • Checks supported languages

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • ilasm.exe (PID: 2780)
      • mpress.exe (PID: 1012)
      • ilasm.exe (PID: 2800)
      • Patsh.exe (PID: 980)
      • server.exe (PID: 3520)

    • Reads the computer name

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • The process checks LSA protection

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • rundll32.exe (PID: 1760)
      • Patsh.exe (PID: 980)
      • rundll32.exe (PID: 3408)

    • Reads Environment values

      • njRAT v0.7d Danger Edition.exe (PID: 1764)

    • Manual execution by a user

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)

    • Create files in a temporary directory

      • njRAT v0.7d Danger Edition.exe (PID: 1764)
      • mpress.exe (PID: 1012)
      • server.exe (PID: 3520)
      • Patsh.exe (PID: 980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
11
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe njrat v0.7d danger edition.exe ilasm.exe cmd.exe no specs mpress.exe server.exe rundll32.exe no specs ilasm.exe #NJRAT patsh.exe rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
980"C:\Users\admin\Desktop\Patsh.exe" C:\Users\admin\Desktop\Patsh.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\patsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1012UPX\mpress.exe -s "C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\UPX\mpress.exe
cmd.exe
User:
admin
Company:
MATCODE Software
Integrity Level:
MEDIUM
Description:
Matcode comPRESSor
Exit code:
0
Version:
2.19
Modules
Images
c:\users\admin\desktop\njrat v0.7d danger edition\upx\mpress.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\patshC:\Windows\System32\rundll32.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1764"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\njRAT v0.7d Danger Edition.exe" C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\njRAT v0.7d Danger Edition.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\njrat v0.7d danger edition\njrat v0.7d danger edition.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
2780"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
njRAT v0.7d Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2800"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Patsh.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
njRAT v0.7d Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2824"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\njRAT v0.7d Danger Edition.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
2968cmd.exe /C UPX\mpress.exe -s "C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe"C:\Windows\System32\cmd.exe—njRAT v0.7d Danger Edition.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3408"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\patshC:\Windows\System32\rundll32.exe—Patsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
3520"C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe" C:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\njrat v0.7d danger edition\server.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
18 154
Read events
17 772
Write events
366
Delete events
16

Modification events

(PID) Process:(2824) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
42
Suspicious files
2
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Plugin\ch.dllexecutable
MD5:E747FA3339C1F138B6BFCE707B541D03
SHA256:6E31148CC1B3235B71731C3944A7B06F861E104E978708D12C695EC09B5B3760
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\njRAT v0.7d Danger Edition.exeexecutable
MD5:85CFE00567DB5B2DF0648D8943D1CC94
SHA256:AAF1D1465D24C051F9077FE5264C478E21FE3F62FF38196FE4622D09733B523E
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Icon4.icoimage
MD5:E09F61099CCC8F5AC1302B7C644F2E13
SHA256:CE7330076C11919A86067DC528E34100B66935C2F432F83042383D4D15A31027
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Plugin\pw.dllexecutable
MD5:872401528FC94C90F3DE6658E776CC36
SHA256:3A1CC072EFFD8C38406A6FDDF4D8F49C5366BB0E32071311D90DB669940987CE
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Plugin\sc2.dllexecutable
MD5:19967E886EDCD2F22F8D4A58C8EA3773
SHA256:3E5141C75B7746C0EB2B332082A165DEACB943CEF26BD84668E6B79B47BDFD93
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\Plugin\plg.dllexecutable
MD5:0CBC2D9703FEEAD9783439E551C2B673
SHA256:EA9ECF8723788FEEF6492BF938CDFAB1266A1558DFFE75E1F78A998320F96E39
2780ilasm.exeC:\Users\admin\Desktop\njRAT v0.7d Danger Edition\server.pdbpdb
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.15500\njRAT v0.7d Danger Edition\NjRat 0.7D.resources.dllexecutable
MD5:87007C82A741E7F5E7AB4A7F55CBB65A
SHA256:808776A276F01826E3557D59E03513BA9F266FF69006B5CEEFF00C9D9EB7B44C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
njRAT v0.7d Danger Edition.rar