analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Fast Netflix Checker (TMP).zip

Full analysis: https://app.any.run/tasks/ac0b2918-fc9e-4235-92e3-8ecabf765a1c
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: November 08, 2018, 09:05:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

1F61EF15EF25C90955BCA37476FB9D6E

SHA1:

698DAFC799DF3C1FA86455D3C210F013B9B2613F

SHA256:

00ACDFD169B0015D5D913C5E2F2F2A6685588FE756C3AF27665727D438232EFD

SSDEEP:

12288:/9/7F+rKGLBANpREctGkyaK7UXp0r7I97Y6+DVqHEVH:N7FvGoREctGkyaUUXp0w9E6mIHEVH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Netflix.exe (PID: 2112)
    • Changes the autorun value in the registry

      • Netflix.exe (PID: 2112)
    • NanoCore was detected

      • Netflix.exe (PID: 2112)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Netflix.exe (PID: 2112)
    • Creates files in the program directory

      • Netflix.exe (PID: 2112)
    • Creates files in the user directory

      • Netflix.exe (PID: 2112)
    • Connects to unusual port

      • Netflix.exe (PID: 2112)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Fast Netflix Checker/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2018:09:21 12:00:16
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #NANOCORE netflix.exe

Process information

PID
CMD
Path
Indicators
Parent process
3904"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fast Netflix Checker (TMP).zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2112"C:\Users\admin\Desktop\Fast Netflix Checker\Netflix.exe" C:\Users\admin\Desktop\Fast Netflix Checker\Netflix.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Total events
467
Read events
447
Write events
20
Delete events
0

Modification events

(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3904) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Fast Netflix Checker (TMP).zip
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\README.txt
MD5:
SHA256:
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\SkinSoft.VisualStyler.dll
MD5:
SHA256:
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\xNet.dll
MD5:
SHA256:
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\Netflix.exe
MD5:
SHA256:
2112Netflix.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:C7574F06CEE94EB67B64A14F4380C1F4
SHA256:D7BD09F1C799FF0E643AF245F60E6E5CF5B040892B22E7A9618ED9F8490C4C55
2112Netflix.exeC:\Program Files\TCP Monitor\tcpmon.exeexecutable
MD5:271C771B2529C70058CF18800CB6F320
SHA256:355A6528CD2D41E4637E5D02BB896E998B09B57A4855127C082EB1D967788DF8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
18
DNS requests
9
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2112
Netflix.exe
37.235.1.174:53
ANEXIA Internetdienstleistungs GmbH
AT
suspicious
2112
Netflix.exe
104.238.46.159:1604
givemeurtoaster.ddns.net
QuadraNet, Inc
US
unknown

DNS requests

Domain
IP
Reputation
givemeurtoaster.ddns.net
  • 104.238.46.159
malicious

Threats

PID
Process
Class
Message
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
2112
Netflix.exe
A Network Trojan was detected
SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain
No debug info