analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Y5n.rar

Full analysis: https://app.any.run/tasks/80bc4aa7-9f76-4b27-8f9d-f253be6cb5ea
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 14, 2019, 22:04:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
revenge
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7F61BE018CFFA44ED1090A4B018FAB35

SHA1:

DF7775497DA491E515C0F48AB0C8350967150A29

SHA256:

0027596F7127B90D269F0D42152501AD56D1F1376AA89EA8800681DB77E25A83

SSDEEP:

49152:oyLTgM5dS1JuI2Vsu8pfQyRzAhGaQfFaXuYG4+an5N2Y2RgmlQngJsOnp:oyLTp5dSD20pfQqzf8Xru05NJ26ngOOp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Smart Pastebin Leecher.exe (PID: 2000)
      • Windows Defender Servcies.exe (PID: 3396)
      • Smart Pastebin Leecher.exe (PID: 2268)
      • UAC.exe (PID: 3188)

    • Writes to a start menu file

      • UAC.exe (PID: 3188)

    • Changes the autorun value in the registry

      • UAC.exe (PID: 3188)

    • REVENGE was detected

      • UAC.exe (PID: 3188)

    • Connects to CnC server

      • UAC.exe (PID: 3188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2668)
      • Smart Pastebin Leecher.exe (PID: 2000)
      • Windows Defender Servcies.exe (PID: 3396)

    • Starts itself from another location

      • Windows Defender Servcies.exe (PID: 3396)

    • Creates files in the user directory

      • Windows Defender Servcies.exe (PID: 3396)
      • UAC.exe (PID: 3188)

    • Reads CPU info

      • UAC.exe (PID: 3188)

  • INFO

    • Application was crashed

      • Smart Pastebin Leecher.exe (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe smart pastebin leecher.exe smart pastebin leecher.exe windows defender servcies.exe #REVENGE uac.exe

Process information

PID
CMD
Path
Indicators
Parent process
2668"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Y5n.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2000"C:\Users\admin\AppData\Local\Temp\Y5n\Y5n\Smart Pastebin Leecher.exe" C:\Users\admin\AppData\Local\Temp\Y5n\Y5n\Smart Pastebin Leecher.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Pasebin Leecher
Exit code:
0
Version:
1.2.4.3
2268"C:\Users\admin\AppData\Local\Temp\Smart Pastebin Leecher.exe" C:\Users\admin\AppData\Local\Temp\Smart Pastebin Leecher.exe
Smart Pastebin Leecher.exe
User:
admin
Company:
Pasebin Leecher
Integrity Level:
MEDIUM
Description:
Pasebin Leecher
Exit code:
3762504530
Version:
1.2.4.3
3396"C:\Users\admin\AppData\Local\Temp\Windows Defender Servcies.exe" C:\Users\admin\AppData\Local\Temp\Windows Defender Servcies.exe
Smart Pastebin Leecher.exe
User:
admin
Company:
MS
Integrity Level:
MEDIUM
Description:
Windows Defender Servcies
Exit code:
0
Version:
32.14.21.5
3188"C:\Users\admin\AppData\Roaming\UAC.exe" C:\Users\admin\AppData\Roaming\UAC.exe
Windows Defender Servcies.exe
User:
admin
Company:
MS
Integrity Level:
MEDIUM
Description:
Windows Defender Servcies
Version:
32.14.21.5
Total events
1 238
Read events
1 197
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3188UAC.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Servcies.jstext
MD5:AB472520F3654EC1E739D2441D7CE815
SHA256:951BAEB7122ED6FDD51633C3C74D1E3BD50BE3E2DABE5804709B33CE53FCA3E6
2000Smart Pastebin Leecher.exeC:\Users\admin\AppData\Local\Temp\Windows Defender Servcies.exeexecutable
MD5:8037D94E2FF6D739ADA078E8890FC93A
SHA256:9CEE1C20A612D1F7A7464EC8F63DB5D88A5932D87D254D688EE21FDA4E4104BF
2000Smart Pastebin Leecher.exeC:\Users\admin\AppData\Local\Temp\Smart Pastebin Leecher.exeexecutable
MD5:43018B8329AC5DAE6A7AD3D5D0E78AB2
SHA256:62C9620E8590D315E28B6D66E57F1D60C03B7FD194BB269ED19E6C030415E8FF
2668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Y5n\Y5n\Smart Pastebin Leecher.exeexecutable
MD5:54661B17908C8F92AAA8C2A9B85D05D6
SHA256:70AC848A5EC0EF767192D0926797C94DFDE164AE02F1F6E1EABAFCC3ED444F62
3396Windows Defender Servcies.exeC:\Users\admin\AppData\Roaming\UAC.exeexecutable
MD5:8037D94E2FF6D739ADA078E8890FC93A
SHA256:9CEE1C20A612D1F7A7464EC8F63DB5D88A5932D87D254D688EE21FDA4E4104BF
2668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Y5n\Y5n\SkinSoft.VisualStyler.dllexecutable
MD5:69E6563E0E7EA843E9B37D58819F4136
SHA256:F9FA9F508B9350ED12ED3AA5B7F24AED901A6434B1B02D1F0EE301B8EEA54B06
2668WinRAR.exeC:\Users\admin\AppData\Local\Temp\Y5n\Y5n\xNet.dllexecutable
MD5:BF1F76644BDDD20339548EBACF7A48EB
SHA256:5D9C2B1822BCAA71DDEAA5426D4312D8E174766AE8864C7ADD29D7F44CEA87F2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
18
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3188
UAC.exe
196.117.86.129:2222
uogapk18.ddns.net
ASMedi
MA
malicious
3396
Windows Defender Servcies.exe
199.195.250.222:2222
uogapk7.ddns.net
FranTech Solutions
US
malicious
3188
UAC.exe
199.195.250.222:2222
uogapk7.ddns.net
FranTech Solutions
US
malicious

DNS requests

Domain
IP
Reputation
uogapk3.ddns.net
  • 0.0.0.0
malicious
uogapk4.ddns.net
  • 0.0.0.0
malicious
uogapk5.ddns.net
  • 0.0.0.0
malicious
uogapk6.ddns.net
  • 0.0.0.0
malicious
uogapk7.ddns.net
  • 199.195.250.222
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
uogapk8.ddns.net
  • 0.0.0.0
malicious
uogapk9.ddns.net
  • 0.0.0.0
malicious
uogapk10.ddns.net
  • 0.0.0.0
malicious
uogapk11.ddns.net
  • —
malicious

Threats

PID
Process
Class
Message
3188
UAC.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
3188
UAC.exe
A Network Trojan was detected
MALWARE [PTsecurity] Revenge/hamza-RAT CnC Checkin
3188
UAC.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Maadawy-RAT (njRAT) CnC Response
3188
UAC.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Maadawy-RAT (njRAT) CnC Response
3188
UAC.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Maadawy-RAT (njRAT) CnC Response
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Y5n.rar