File name:

ALL FILES 00001.zip

Full analysis: https://app.any.run/tasks/e494413a-5b45-4b89-a05d-8c84bfca2a31
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: February 10, 2019, 16:20:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EDA5D1F5A507A85FBA6D34BD835E9D5C

SHA1:

D64093833CE6596FC75EA88FECFC4E622EBE332B

SHA256:

0ACFD55E26F4419F32E0BA35B33F42E235D7961D875E3B202030E98CB2D2E8F5

SSDEEP:

49152:FGyjJVa49pjcH+YW38tEPk/MMYEZnDnUmePttirIXQBh99:FGyntc2cik/vYEZnDnUmuXQd9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • eScfbGVynncWo.exe (PID: 3644)
      • filename.exe (PID: 3588)
      • filename.exe (PID: 3500)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 3308)

    • AZORULT was detected

      • filename.exe (PID: 3588)

    • Connects to CnC server

      • filename.exe (PID: 3588)

    • Loads dropped or rewritten executable

      • filename.exe (PID: 3588)

    • Actions looks like stealing of personal data

      • filename.exe (PID: 3588)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2164)
      • eScfbGVynncWo.exe (PID: 3644)
      • filename.exe (PID: 3588)

    • Executes scripts

      • WinRAR.exe (PID: 3516)
      • eScfbGVynncWo.exe (PID: 3644)

    • Starts itself from another location

      • eScfbGVynncWo.exe (PID: 3644)

    • Application launched itself

      • filename.exe (PID: 3500)

    • Reads the cookies of Mozilla Firefox

      • filename.exe (PID: 3588)

    • Reads the cookies of Google Chrome

      • filename.exe (PID: 3588)

    • Starts CMD.EXE for commands execution

      • filename.exe (PID: 3588)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:02:09 22:04:21
ZipCRC: 0x41f39fef
ZipCompressedSize: 2083386
ZipUncompressedSize: 3316146
ZipFileName: ALL.FILES00001.js
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
8
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs wscript.exe escfbgvynncwo.exe wscript.exe filename.exe no specs #AZORULT filename.exe cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2164"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3516.15836\ALL.FILES00001.js" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3180"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "filename.exe"C:\Windows\system32\cmd.exe—filename.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3308"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\subfolder\filename.vbs" C:\Windows\System32\WScript.exe
eScfbGVynncWo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3500"C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe" C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe—eScfbGVynncWo.exe
User:
admin
Company:
ammi2
Integrity Level:
MEDIUM
Description:
wheelerdealer7
Exit code:
0
Version:
1.06.0006
Modules
Images
c:\users\admin\appdata\local\temp\subfolder\filename.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3516"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ALL FILES 00001.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3588C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe" C:\Users\admin\AppData\Local\Temp\subfolder\filename.exe
filename.exe
User:
admin
Company:
ammi2
Integrity Level:
MEDIUM
Description:
wheelerdealer7
Exit code:
0
Version:
1.06.0006
Modules
Images
c:\users\admin\appdata\local\temp\subfolder\filename.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3644"C:\Users\admin\AppData\Local\Temp\eScfbGVynncWo.exe" C:\Users\admin\AppData\Local\Temp\eScfbGVynncWo.exe
WScript.exe
User:
admin
Company:
ammi2
Integrity Level:
MEDIUM
Description:
wheelerdealer7
Exit code:
0
Version:
1.06.0006
Modules
Images
c:\users\admin\appdata\local\temp\escfbgvynncwo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4008C:\Windows\system32\timeout.exe 3 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
Total events
1 240
Read events
1 199
Write events
41
Delete events
0

Modification events

(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3516) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ALL FILES 00001.zip
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3516) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4804
Value:
JScript Script File
(PID) Process:(3516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
50
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3644eScfbGVynncWo.exeC:\Users\admin\AppData\Local\Temp\~DF79D10BC1AC5D8F57.TMPbinary
MD5:—
SHA256:—
3644eScfbGVynncWo.exeC:\Users\admin\AppData\Local\Temp\subfolder\filename.vbstext
MD5:—
SHA256:—
3516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3516.15836\ALL.FILES00001.jstext
MD5:—
SHA256:—
3644eScfbGVynncWo.exeC:\Users\admin\AppData\Local\Temp\subfolder\filename.exeexecutable
MD5:—
SHA256:—
2164WScript.exeC:\Users\admin\AppData\Local\Temp\eScfbGVynncWo.exeexecutable
MD5:—
SHA256:—
3588filename.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:E479444BDD4AE4577FD32314A68F5D28
SHA256:C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
3588filename.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:502263C56F931DF8440D7FD2FA7B7C00
SHA256:94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
3588filename.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:88FF191FD8648099592ED28EE6C442A5
SHA256:C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
3588filename.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:6D778E83F74A4C7FE4C077DC279F6867
SHA256:A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
3588filename.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:CB978304B79EF53962408C611DFB20F5
SHA256:90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
1
DNS requests
1
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3588
filename.exe
POST
200
162.244.92.133:80
http://k-antivirus.com/index.php
US
txt
4.27 Mb
malicious
3588
filename.exe
POST
200
162.244.92.133:80
http://k-antivirus.com/index.php
US
text
5 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3588
filename.exe
162.244.92.133:80
k-antivirus.com
FranTech Solutions
US
malicious

DNS requests

Domain
IP
Reputation
k-antivirus.com
  • 162.244.92.133
malicious

Threats

PID
Process
Class
Message
3588
filename.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
3588
filename.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
3588
filename.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3588
filename.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3588
filename.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
3588
filename.exe
A Network Trojan was detected
ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ALL FILES 00001.zip