File name: | 4.zip |
Full analysis: | https://app.any.run/tasks/b62c23b4-d5b2-455f-b538-a386e38d06f0 |
Verdict: | Malicious activity |
Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
Analysis date: | January 23, 2019, 08:16:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 2B9FC7205E9B40AE9A864829645A8E3B |
SHA1: | 799B6300955B51C06F8CC7A147D4B965000B4654 |
SHA256: | 05D1420FC515CDC1ACA4C33F5E606FD99B67FBBA947E1A6A46DB48F606D5E49E |
SSDEEP: | 3072:dC/bL08bFXrBKlwXTfCm/u5mrnaDA1/VUNLiVdb9iuw0wIRyIdrK9Pq32yEHOZJ:dCbbFXrd+mTrnaDk6NLiVdbyTMyIdOPg |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:01:22 17:09:15 |
ZipCRC: | 0xc90d9c10 |
ZipCompressedSize: | 161163 |
ZipUncompressedSize: | 207872 |
ZipFileName: | Netflix Checker (latest).exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2984 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2852 | "C:\Users\admin\Desktop\Netflix Checker (latest).exe" | C:\Users\admin\Desktop\Netflix Checker (latest).exe | explorer.exe | |
User: admin Integrity Level: MEDIUM | ||||
3944 | "C:\Users\admin\Desktop\Netflix Checker (latest).exe" | C:\Users\admin\Desktop\Netflix Checker (latest).exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\4.zip | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
(PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp |
PID | Process | Filename | Type | |
---|---|---|---|---|
2984 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2984.43977\Netflix Checker (latest).exe | — | |
MD5:— | SHA256:— | |||
2852 | Netflix Checker (latest).exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | text | |
MD5:EE7B8B7C32AC7AF3D307A4B38730D400 | SHA256:92C229AB9196A0DDB706398EC8558C2D63682184992C32CD29C0F7B110ABA6A8 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2852 | Netflix Checker (latest).exe | 71.208.54.143:1604 | — | Qwest Communications Company, LLC | US | malicious |
2852 | Netflix Checker (latest).exe | 8.8.8.8:53 | — | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
dns.msftncsi.com |
| shared |
ngfbgfb.ddns.net |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Generic dynamic DNS detection |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Generic dynamic DNS detection |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Generic dynamic DNS detection |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Generic dynamic DNS detection |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain |
2852 | Netflix Checker (latest).exe | A Network Trojan was detected | SC BAD_UNKNOWN Generic dynamic DNS detection |