analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

virus.001

Full analysis: https://app.any.run/tasks/5d4ecce7-824b-4668-9db0-47b8afc5334e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: September 18, 2019, 15:43:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
loader
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E40AE2617AAD3BD4B10506CB4591CE25

SHA1:

9E2B771E86DAF5ABD1E5118CBA137DAC36159902

SHA256:

02795C416B5642646F1CCB41A5C4A82B250596A80DC2B1E58C2493FD7F1529D3

SSDEEP:

1536:rtfU3eoPgWgK/68mK9+k+IbL1WwYWST8mLE:rt6gWgK+K9qIf1WwYWSTvE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Док-ты на возврат за август.exe (PID: 2724)
      • Док-ты на возврат за август.exe (PID: 3900)
    • Connects to CnC server

      • Док-ты на возврат за август.exe (PID: 2724)
    • Downloads executable files from the Internet

      • Док-ты на возврат за август.exe (PID: 2724)
    • Detected Pony/Fareit Trojan

      • Док-ты на возврат за август.exe (PID: 2724)
    • Downloads executable files from IP

      • Док-ты на возврат за август.exe (PID: 2724)
    • Actions looks like stealing of personal data

      • Док-ты на возврат за август.exe (PID: 2724)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2860)
    • Searches for installed software

      • Док-ты на возврат за август.exe (PID: 2724)
    • Starts CMD.EXE for commands execution

      • Док-ты на возврат за август.exe (PID: 2724)
    • Connects to server without host name

      • Док-ты на возврат за август.exe (PID: 2724)
    • Starts CMD.EXE for self-deleting

      • Док-ты на возврат за август.exe (PID: 2724)
  • INFO

    • Manual execution by user

      • Док-ты на возврат за август.exe (PID: 3900)
    • Application was crashed

      • Док-ты на возврат за август.exe (PID: 3900)
      • Док-ты на возврат за август.exe (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe док-ты на возврат за август.exe #PONY док-ты на возврат за август.exe cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2860"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\virus.001"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3900"C:\Users\admin\Desktop\Док-ты на возврат за август.exe" C:\Users\admin\Desktop\Док-ты на возврат за август.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
2724"C:\Users\admin\Desktop\Док-ты на возврат за август.exe" dfsrC:\Users\admin\Desktop\Док-ты на возврат за август.exe
Док-ты на возврат за август.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
3204cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\admin\Desktop\Док-ты на возврат за август.exe"C:\Windows\system32\cmd.exeДок-ты на возврат за август.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1720ping 127.0.0.1 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
540
Read events
499
Write events
41
Delete events
0

Modification events

(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2860) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\virus.001
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2860) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2724) Док-ты на возврат за август.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\???-?? ?? ??????? ?? ??????_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2860WinRAR.exeC:\Users\admin\Desktop\Док-ты на возврат за август.exeexecutable
MD5:A6C8BD1F343D4F4DFE14F3CDC97AB3CB
SHA256:7A737C1640FC0A636D5093D70320A12B45F866C970A7DA61368C584713F480B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2724
Док-ты на возврат за август.exe
POST
172.105.69.5:80
http://172.105.69.5/g_38472341.php
US
malicious
2724
Док-ты на возврат за август.exe
POST
172.105.69.5:80
http://172.105.69.5/g_38472341.php
US
malicious
2724
Док-ты на возврат за август.exe
GET
200
172.105.69.5:80
http://172.105.69.5/index.php?id=0&un=61646d696e&cn=555345522d5043
US
executable
97.0 Kb
malicious
2724
Док-ты на возврат за август.exe
POST
172.105.69.5:80
http://172.105.69.5/g_38472341.php
US
malicious
2724
Док-ты на возврат за август.exe
GET
200
172.105.69.5:80
http://172.105.69.5/index.php?id=0&un=61646d696e&cn=555345522d5043
US
executable
97.0 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2724
Док-ты на возврат за август.exe
104.16.54.3:443
blockchain.info
Cloudflare Inc
US
shared
2724
Док-ты на возврат за август.exe
172.105.69.5:80
US
malicious
2724
Док-ты на возврат за август.exe
3.225.205.112:443
api.blockcypher.com
US
malicious

DNS requests

Domain
IP
Reputation
blockchain.info
  • 104.16.54.3
  • 104.16.55.3
shared
api.blockcypher.com
  • 3.225.205.112
  • 52.86.198.63
whitelisted

Threats

PID
Process
Class
Message
2724
Док-ты на возврат за август.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET CURRENT_EVENTS WinHttpRequest Downloading EXE
2724
Док-ты на возврат за август.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET TROJAN Pony DLL Download M2
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET CURRENT_EVENTS WinHttpRequest Downloading EXE
2724
Док-ты на возврат за август.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET TROJAN Pony DLL Download M2
2724
Док-ты на возврат за август.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
No debug info