File name: | Fast Netflix Checker (TMP).zip |
Full analysis: | https://app.any.run/tasks/ac0b2918-fc9e-4235-92e3-8ecabf765a1c |
Verdict: | Malicious activity |
Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
Analysis date: | November 08, 2018, 09:05:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 1F61EF15EF25C90955BCA37476FB9D6E |
SHA1: | 698DAFC799DF3C1FA86455D3C210F013B9B2613F |
SHA256: | 00ACDFD169B0015D5D913C5E2F2F2A6685588FE756C3AF27665727D438232EFD |
SSDEEP: | 12288:/9/7F+rKGLBANpREctGkyaK7UXp0r7I97Y6+DVqHEVH:N7FvGoREctGkyaUUXp0w9E6mIHEVH |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Fast Netflix Checker/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2018:09:21 12:00:16 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3904 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fast Netflix Checker (TMP).zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2112 | "C:\Users\admin\Desktop\Fast Netflix Checker\Netflix.exe" | C:\Users\admin\Desktop\Fast Netflix Checker\Netflix.exe | explorer.exe | |
User: admin Integrity Level: HIGH |
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Fast Netflix Checker (TMP).zip | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
(PID) Process: | (3904) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp |
PID | Process | Filename | Type | |
---|---|---|---|---|
3904 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\README.txt | — | |
MD5:— | SHA256:— | |||
3904 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\SkinSoft.VisualStyler.dll | — | |
MD5:— | SHA256:— | |||
3904 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\xNet.dll | — | |
MD5:— | SHA256:— | |||
3904 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3904.46861\Fast Netflix Checker\Netflix.exe | — | |
MD5:— | SHA256:— | |||
2112 | Netflix.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | text | |
MD5:C7574F06CEE94EB67B64A14F4380C1F4 | SHA256:D7BD09F1C799FF0E643AF245F60E6E5CF5B040892B22E7A9618ED9F8490C4C55 | |||
2112 | Netflix.exe | C:\Program Files\TCP Monitor\tcpmon.exe | executable | |
MD5:271C771B2529C70058CF18800CB6F320 | SHA256:355A6528CD2D41E4637E5D02BB896E998B09B57A4855127C082EB1D967788DF8 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2112 | Netflix.exe | 37.235.1.174:53 | — | ANEXIA Internetdienstleistungs GmbH | AT | suspicious |
2112 | Netflix.exe | 104.238.46.159:1604 | givemeurtoaster.ddns.net | QuadraNet, Inc | US | unknown |
Domain | IP | Reputation |
---|---|---|
givemeurtoaster.ddns.net |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |
2112 | Netflix.exe | A Network Trojan was detected | SC BAD_UNKNOWN DYNAMIC_DNS Query to a Suspicious *.ddns.net Domain |