Malware analysis 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.gz Malicious activity

Add for printing

File name:	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.gz
Full analysis:	https://app.any.run/tasks/d4c0339d-01ec-42e7-a66f-ea508018d216
Verdict:	Malicious activity
Analysis date:	May 15, 2019, 14:56:44
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	evasion
Indicators:
MIME:	application/gzip
File info:	gzip compressed data, max compression, from Unix
MD5:	8E2B3DB0C9E3B725EFA45AF9AF20379F
SHA1:	258B9FFE503B08DEA703D21AE600BDAF60BC480E
SHA256:	0421B90D58D8D47B5FB3656449351BBEA58AA56FA7CB87B5933FF0E5AA295978
SSDEEP:	24576:acN7yi/XDAjx+voqrouFuJtP7y62JoRGZ5QsfMXo7VPHma0v9gwpbKpppn:a2OiroqrouFYtP7y6OoS5dWop/GVbUTn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Loads dropped or rewritten executable
  - SearchProtocolHost.exe (PID: 3572)
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Changes the autorun value in the registry
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Adds new firewall rule via NETSH.EXE
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
SUSPICIOUS
- Reads Environment values
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Uses NETSH.EXE for network configuration
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Creates files in the program directory
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Checks for external IP
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Changes tracing settings of the file or console
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
- Executable content was dropped or overwritten
  - 0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe (PID: 2520)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.z/gz/gzip	\|	GZipped data (100)

EXIF

ZIP

OperatingSystem:	Unix
ExtraFlags:	Maximum Compression
ModifyDate:	0000:00:00 00:00:00
Flags:	(none)
Compression:	Deflated

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2964	"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.gz"	C:\Program Files\WinRAR\WinRAR.exe	—	explorer.exe
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0
2520	"C:\Users\admin\Desktop\0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe"	C:\Users\admin\Desktop\0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe		explorer.exe
User: admin Integrity Level: MEDIUM
3572	"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"	C:\Windows\System32\SearchProtocolHost.exe	—	SearchIndexer.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255)
3908	"netsh.exe" advfirewall firewall add rule name="kraken.exe" profile=any enable=yes DIR=in program="C:\Users\admin\Desktop\0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe" Action=Allow	C:\Windows\system32\netsh.exe	—	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

531

Read events

449

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2964	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa2964.23095\0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin		—
		MD5:—	SHA256:—
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	C:\Users\admin\Desktop\loader.dll		executable
		MD5:CF6A5B1C382C8325E9A21B6C71937DF7	SHA256:99668918590715AB34B9182144ABD54C2E42ECB85164E0AA9484940BB59882A4
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	C:\ProgramData\Isolated Storage\36A92875\90424E7E		binary
		MD5:BF565BDFC5DD1697D8D225BC9DBFFEC0	SHA256:01D8EB441C0B654A122F7A631555D752427E487D2307139E91B1F1E4E77DE93F

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

120

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	GET	200	104.20.16.242:80	http://icanhazip.com/	US	text	12 b	shared

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	139.162.217.110:33445	—	Linode, LLC	GB	unknown
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	185.64.89.42:33445	mrflibble.c4.ee	Pulsant (Scotland) Ltd	GB	unknown
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	108.61.165.198:33445	—	Choopa, LLC	NL	unknown
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	104.20.16.242:80	icanhazip.com	Cloudflare Inc	US	shared
—	—	94.130.54.112:33445	tox.deadteam.org	Hetzner Online GmbH	DE	unknown
—	—	108.61.165.198:33445	—	Choopa, LLC	NL	unknown
—	—	138.94.71.250:33445	home.vikingmakt.com.br	Intervel Informatica Ltda	BR	unknown
—	—	83.137.53.211:1813	d4rk4.ru	SVS Communication	RU	unknown
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	5.180.34.44:33445	biribiri.org	—	—	malicious
—	—	139.162.217.110:33445	—	Linode, LLC	GB	unknown

DNS requests

Domain	IP	Reputation
icanhazip.com	104.20.16.242 104.20.17.242	shared
mrflibble.c4.ee	185.64.89.42	unknown
d4rk4.ru	83.137.53.211	malicious
home.vikingmakt.com.br	138.94.71.250	unknown
tox.deadteam.org	94.130.54.112	unknown
biribiri.org	5.180.34.44	malicious

Threats

PID	Process	Class	Message
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	Attempted Information Leak	ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2520	0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.exe	A Network Trojan was detected	MALWARE [PTsecurity] Kraken

Add for printing

No debug info

General Info

0725b370325fc8144d5af7087cf6a97131e72f6b3dede2b42bb92290e9944a35.bin.gz

8E2B3DB0C9E3B725EFA45AF9AF20379F

258B9FFE503B08DEA703D21AE600BDAF60BC480E

0421B90D58D8D47B5FB3656449351BBEA58AA56FA7CB87B5933FF0E5AA295978

24576:acN7yi/XDAjx+voqrouFuJtP7y62JoRGZ5QsfMXo7VPHma0v9gwpbKpppn:a2OiroqrouFYtP7y6OoS5dWop/GVbUTn

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

Changes the autorun value in the registry

Adds new firewall rule via NETSH.EXE

SUSPICIOUS

Reads Environment values

Uses NETSH.EXE for network configuration

Creates files in the program directory

Checks for external IP

Changes tracing settings of the file or console

Executable content was dropped or overwritten

INFO

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings