analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Visa%20Card%20Generator%20(ZAP).zip

Full analysis: https://app.any.run/tasks/5aeb3356-90b2-45a7-bd50-ed276dcc075b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: November 08, 2018, 18:06:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

8481BA30F4BF5FAA6810E38958E2A6CE

SHA1:

3242891F334F96EE5E39132DB87B331D999D513F

SHA256:

001132B2A3C24B7F1C6CA5D6BBEF1F65125A854CA4B336F4C76A2EC981DC4101

SSDEEP:

12288:Y9/7F+rKGLBANpREctGkyaK7UXd0r7p97Y6+DVqHEVu:27FvGoREctGkyaUUXd0x9E6mIHEVu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Visa Generator (ZAP).exe (PID: 3448)
    • Changes the autorun value in the registry

      • Visa Generator (ZAP).exe (PID: 3448)
    • NanoCore was detected

      • Visa Generator (ZAP).exe (PID: 3448)
  • SUSPICIOUS

    • Creates files in the user directory

      • Visa Generator (ZAP).exe (PID: 3448)
    • Connects to unusual port

      • Visa Generator (ZAP).exe (PID: 3448)
    • Executable content was dropped or overwritten

      • Visa Generator (ZAP).exe (PID: 3448)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Visa Card Generator/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2018:09:21 12:00:15
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #NANOCORE visa generator (zap).exe

Process information

PID
CMD
Path
Indicators
Parent process
3708"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\78cc67b1-749c-4148-be99-fb825c9dc63c.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3448"C:\Users\admin\Desktop\Visa Card Generator\Visa Generator (ZAP).exe" C:\Users\admin\Desktop\Visa Card Generator\Visa Generator (ZAP).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Total events
458
Read events
438
Write events
20
Delete events
0

Modification events

(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3708) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\78cc67b1-749c-4148-be99-fb825c9dc63c.zip
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3708) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.39064\Visa Card Generator\README.txt
MD5:
SHA256:
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.39064\Visa Card Generator\SkinSoft.VisualStyler.dll
MD5:
SHA256:
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.39064\Visa Card Generator\xNet.dll
MD5:
SHA256:
3708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3708.39064\Visa Card Generator\Visa Generator (ZAP).exe
MD5:
SHA256:
3448Visa Generator (ZAP).exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:C5A1F438E546AC5E41D9742EA779EA2D
SHA256:982FA404D6B9F9ABD73247B78BC49F3A00FC071930405D5C39DDFBAE8DF0BAD1
3448Visa Generator (ZAP).exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:271C771B2529C70058CF18800CB6F320
SHA256:355A6528CD2D41E4637E5D02BB896E998B09B57A4855127C082EB1D967788DF8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3448
Visa Generator (ZAP).exe
37.235.1.174:53
ANEXIA Internetdienstleistungs GmbH
AT
suspicious
3448
Visa Generator (ZAP).exe
71.208.62.223:1604
givemeurtoaster.ddns.net
Qwest Communications Company, LLC
US
unknown

DNS requests

Domain
IP
Reputation
givemeurtoaster.ddns.net
  • 71.208.62.223
malicious

Threats

PID
Process
Class
Message
3448
Visa Generator (ZAP).exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
3448
Visa Generator (ZAP).exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
3448
Visa Generator (ZAP).exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
3448
Visa Generator (ZAP).exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
3448
Visa Generator (ZAP).exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
3448
Visa Generator (ZAP).exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
No debug info