File name:

virus.rar

Full analysis: https://app.any.run/tasks/6ea89ccb-6b47-4430-b1d7-18018dbe4f43
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: July 19, 2024, 01:25:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
hijackloader
loader
asyncrat
rat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DA913E56C16EFFDDC6C3B9041146FFA4

SHA1:

A1AD230984C72E23D82CEC7893A3ABB3DF033D33

SHA256:

11CF35CA10BA07F602329C7ACBDCD76D5530DB731782038FE8931A8A78F4692F

SSDEEP:

98304:m6ihjw2ZzjQlZ9xQO2t7J3un3vwdr7WzpTNyQgLHn8rNqOf3ke5aUEcrgdwY5fO8:Fvrq20s4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ASYNCRAT has been detected (MUTEX)

      • MSBuild.exe (PID: 7308)
    • ASYNCRAT has been detected (YARA)

      • MSBuild.exe (PID: 7308)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 8108)
      • CITACION JUDICIAL.exe (PID: 6688)
    • HIJACKLOADER has been detected (YARA)

      • cmd.exe (PID: 6160)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 8108)
    • Drops 7-zip archiver for unpacking

      • WinRAR.exe (PID: 8108)
    • Starts CMD.EXE for commands execution

      • CITACION JUDICIAL.exe (PID: 6688)
    • Connects to unusual port

      • MSBuild.exe (PID: 7308)
    • Executable content was dropped or overwritten

      • CITACION JUDICIAL.exe (PID: 6688)
  • INFO

    • Creates files or folders in the user directory

      • CITACION JUDICIAL.exe (PID: 6688)
    • Reads the computer name

      • MSBuild.exe (PID: 7308)
      • CITACION JUDICIAL.exe (PID: 6688)
    • Checks supported languages

      • MSBuild.exe (PID: 7308)
      • CITACION JUDICIAL.exe (PID: 6688)
    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 7308)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 8108)
    • Create files in a temporary directory

      • CITACION JUDICIAL.exe (PID: 6688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(7308) MSBuild.exe
C2 (1)enviofinal.kozow.com
Ports (1)5051
Version| CRACKED BY https://t.me/xworm_v2
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAOQb7nA/hP/L1XXxqdDJNzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMwNTI1MDUyMTIyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIykAVxs0s6rZ/dwP6ujJtpnj6RSsCsZN6Cfj1InZxSIswX+zNiKJys8xyLlyexoya3ebLp5gOSz...
Server_SignatureH6CC69VFwMAeB1cvASWt6n66/K+g9J9WhTbw+OrBeCfv67skFd/CgT2QnjYsCUql0QIxTmCtG3tsuNetF0yVkv3Cwyfv/JwuEIXyyNW5ci5YatXq+T4ZhhUYhDdslTs9jBvwwvmIT6IsmdCuIQrcaKV62atj42oUEx58oydjFtMdlTcsls7eduiXagYuIyjPzk2hMthfGPT/QI9GuaQdOgo6P9bPSQAod0ieGoaHZ+0rI04u2JFlYxJkxWi8S0ZYf+bj9zggBzI7cwsgxUYvTM9Jr/1xh/lZSNp/oKZtejOr...
Keys
AESb4ef162c5c2b8858870784bad86f90094ed07701ead952ef99d12b829999f7e8
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe citacion judicial.exe #HIJACKLOADER cmd.exe no specs conhost.exe no specs #ASYNCRAT msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
6160C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe
CITACION JUDICIAL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6688"C:\Users\admin\AppData\Local\Temp\Rar$EXa8108.17113\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\CITACION JUDICIAL.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa8108.17113\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\CITACION JUDICIAL.exe
WinRAR.exe
User:
admin
Company:
madshi.net
Integrity Level:
MEDIUM
Description:
mad* home cinema control
Exit code:
1
Version:
1.1.21.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa8108.17113\notificacion_proceso_judicial_demanda_juzgado_03_penal_del_circuito-09\citacion judicial.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7308C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\hdmbay
c:\windows\syswow64\mshtml.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
AsyncRat
(PID) Process(7308) MSBuild.exe
C2 (1)enviofinal.kozow.com
Ports (1)5051
Version| CRACKED BY https://t.me/xworm_v2
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAOQb7nA/hP/L1XXxqdDJNzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMwNTI1MDUyMTIyWhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIykAVxs0s6rZ/dwP6ujJtpnj6RSsCsZN6Cfj1InZxSIswX+zNiKJys8xyLlyexoya3ebLp5gOSz...
Server_SignatureH6CC69VFwMAeB1cvASWt6n66/K+g9J9WhTbw+OrBeCfv67skFd/CgT2QnjYsCUql0QIxTmCtG3tsuNetF0yVkv3Cwyfv/JwuEIXyyNW5ci5YatXq+T4ZhhUYhDdslTs9jBvwwvmIT6IsmdCuIQrcaKV62atj42oUEx58oydjFtMdlTcsls7eduiXagYuIyjPzk2hMthfGPT/QI9GuaQdOgo6P9bPSQAod0ieGoaHZ+0rI04u2JFlYxJkxWi8S0ZYf+bj9zggBzI7cwsgxUYvTM9Jr/1xh/lZSNp/oKZtejOr...
Keys
AESb4ef162c5c2b8858870784bad86f90094ed07701ead952ef99d12b829999f7e8
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
7452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8108"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\virus.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
9 564
Read events
9 548
Write events
16
Delete events
0

Modification events

(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\virus.rar
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(8108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
8
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6160cmd.exeC:\Users\admin\AppData\Local\Temp\hdmbay
MD5:
SHA256:
8108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa8108.17113\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\CITACION JUDICIAL.exeexecutable
MD5:B841D408448F2A07F308CED1589E7673
SHA256:69A90665113BD73B30360D87F7F6ED2C789A90A67F3B6E86474E21273A64F699
8108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa8108.17113\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\unrar.dllexecutable
MD5:851C9E8CE9F94457CC36B66678F52494
SHA256:0891EDB0CC1C0208AF2E4BC65D6B5A7160642F89FD4B4DC321F79D2B5DFC2DCC
6688CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\mvrSettings32.dllexecutable
MD5:D168F18B79F9F33690F011D1DEB1E7CF
SHA256:B7D3BC460A17E1B43C9FF09786E44EA4033710538BDB539400B55E5B80D0B338
6688CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\unrar.dllexecutable
MD5:851C9E8CE9F94457CC36B66678F52494
SHA256:0891EDB0CC1C0208AF2E4BC65D6B5A7160642F89FD4B4DC321F79D2B5DFC2DCC
8108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa8108.17113\NOTIFICACION_PROCESO_JUDICIAL_DEMANDA_JUZGADO_03_PENAL_DEL_CIRCUITO-09\Winrar\7z2301.exeexecutable
MD5:1CFB215A6FB373AC33A38B1DB320C178
SHA256:9B6682255BED2E415BFA2EF75E7E0888158D1AAF79370DEFAA2E2A5F2B003A59
6688CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\madHcNet32.dllexecutable
MD5:2BA4099EB6FBAC4EAAE2D6DFE71B4E18
SHA256:8BD3EDBF027972636BDB4CBB46037F0BE98CA233E19B003E860AF0BD7526A0AC
6688CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\tape.epsbinary
MD5:10D8E1CB3CC0836EE187C96073C19DEA
SHA256:DF5BD65B747646A7CFD95DBD4F67C27F668E1023AFCB311CAF24C9A0FF2057C1
6688CITACION JUDICIAL.exeC:\Users\admin\AppData\Roaming\ScanExplore\sallow.mdbbinary
MD5:2556ACA0B94D623367029C5D5F89E98E
SHA256:B45A92A00018F7F4FE2C2C9FCC863292E232FC99CAA991D936ECF858692F69BF
6688CITACION JUDICIAL.exeC:\Users\admin\AppData\Local\Temp\a4e12a5bbinary
MD5:7F1ED80E56F309149295930BA76CA11C
SHA256:FFB85AFC63ED3EF10DF946D7125E79C2A0F094F077BD683C4C291249108053E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
7
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
4032
svchost.exe
239.255.255.250:1900
whitelisted
5212
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
4716
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4.209.32.67:443
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:137
whitelisted
5212
backgroundTaskHost.exe
20.74.47.205:443
fd.api.iris.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
2760
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4716
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
7292
backgroundTaskHost.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
unknown

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.199.58.43
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.140
whitelisted
google.com
  • 142.250.186.142
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.182
  • 2.23.209.133
whitelisted
enviofinal.kozow.com
  • 45.32.175.194
malicious

Threats

PID
Process
Class
Message
2168
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.kozow .com Domain
No debug info