analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Netflix_Checker_FAST.rar

Full analysis: https://app.any.run/tasks/103273af-137a-42fc-be9e-6f0e5ae790dd
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 14:43:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

CB4D728DBF186DFEDD2D290C6F047C2A

SHA1:

B4C8178B7B60C6D4E6C6E59AA98D11087A776207

SHA256:

1315A84B9C117F50F7BAC7F1C11F71484F277A2C0FFDC7277B1AFDED6A0C6D2F

SSDEEP:

49152:jBR0EyEmB3kIMmYoZezU2fbFeEqMr1g0AydcSr4aqweaR0Eyl:9ROVKoZezU2jUVzSr/TROl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3680)
      • updater.exe (PID: 3656)

    • Application was dropped or rewritten from another process

      • Netflix Checker FAST.exe (PID: 272)
      • server.exe (PID: 2612)
      • updater.exe (PID: 3656)
      • CommandCam.exe (PID: 2300)
      • ctfmom.exe (PID: 2676)

    • Stealing of credential data

      • MSBuild.exe (PID: 3028)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 3028)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2584)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2584)
      • server.exe (PID: 2612)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2584)
      • server.exe (PID: 2612)
      • MSBuild.exe (PID: 3028)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2584)

    • Starts CMD.EXE for commands execution

      • Netflix Checker FAST.exe (PID: 272)
      • MSBuild.exe (PID: 3028)

    • Creates files in the user directory

      • server.exe (PID: 2612)

    • Reads Environment values

      • MSBuild.exe (PID: 3028)

    • Searches for installed software

      • MSBuild.exe (PID: 3028)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2536)

    • Reads the cookies of Mozilla Firefox

      • MSBuild.exe (PID: 3028)

    • Reads the cookies of Google Chrome

      • MSBuild.exe (PID: 3028)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 2256)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2536)

    • Starts Internet Explorer

      • MSBuild.exe (PID: 3028)

    • Checks for external IP

      • MSBuild.exe (PID: 3028)

  • INFO

    • Manual execution by user

      • Netflix Checker FAST.exe (PID: 272)

    • Dropped object may contain Bitcoin addresses

      • server.exe (PID: 2612)

    • Changes internet zones settings

      • iexplore.exe (PID: 2016)

    • Application launched itself

      • iexplore.exe (PID: 2016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
17
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe searchprotocolhost.exe no specs netflix checker fast.exe no specs cmd.exe no specs server.exe updater.exe no specs msbuild.exe cmd.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs cmd.exe no specs tasklist.exe no specs commandcam.exe no specs iexplore.exe no specs iexplore.exe no specs ctfmom.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2584"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Netflix_Checker_FAST.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3680"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
272"C:\Users\admin\Desktop\Netflix Checker FAST\Netflix Checker FAST.exe" C:\Users\admin\Desktop\Netflix Checker FAST\Netflix Checker FAST.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2352"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\414D.tmp\414E.tmp\414F.bat "C:\Users\admin\Desktop\Netflix Checker FAST\Netflix Checker FAST.exe""C:\Windows\system32\cmd.exe—Netflix Checker FAST.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2612configs\server.exe C:\Users\admin\Desktop\Netflix Checker FAST\configs\server.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FileConverter
Exit code:
0
Version:
1.0.0.0
3656configs\updater.exe C:\Users\admin\Desktop\Netflix Checker FAST\configs\updater.exe—cmd.exe
User:
admin
Company:
YashvirGaming#0388
Integrity Level:
MEDIUM
Description:
Netflix ios Api
Version:
1.1.5.0
3028"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
2536"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr AllC:\Windows\system32\cmd.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4024chcp 65001 C:\Windows\system32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2424netsh wlan show profile C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 874
Read events
2 736
Write events
0
Delete events
0

Modification events

No data
Executable files
13
Suspicious files
6
Text files
28
Unknown types
3

Dropped files

PID
Process
Filename
Type
272Netflix Checker FAST.exeC:\Users\admin\AppData\Local\Temp\414D.tmp\414E.tmp\414F.bat —
MD5:—
SHA256:—
3028MSBuild.exeC:\Users\admin\AppData\Local\Temp\d81213685d38144385839ea32e9be75d\ef73856a39bec359068d0fe61f18eeaa\Dirs\Pictures.txttext
MD5:E4C73A2356BEEED7C56803CE6A267E17
SHA256:6F7EDC5AC3C80DAE7AECF322C1E71B2471F0074ED2B434AE552863CF6B1EB890
3028MSBuild.exeC:\Users\admin\AppData\Local\Temp\d81213685d38144385839ea32e9be75d\ef73856a39bec359068d0fe61f18eeaa\Dirs\Desktop.txttext
MD5:274031841E594ACA9F9E6E41FA5F9DF7
SHA256:B2E891A442F721351FE5ABE1FE0E9C1629A9D94A8945E3D2D6FE3948E5526B87
2584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2584.39333\Netflix Checker FAST\configs\updater.exeexecutable
MD5:998FCC43DA0056E90260C7629DD3209D
SHA256:336A9A12A66D19A3E34D920214A9FFA4D58F1E631EB0A808F747D1977072F3CD
3028MSBuild.exeC:\Users\admin\AppData\Local\Temp\d81213685d38144385839ea32e9be75d\ef73856a39bec359068d0fe61f18eeaa\Dirs\Downloads.txttext
MD5:4E3128E80C38A29622EE90618A698638
SHA256:7679301F4D9D024E39955A7D40E8B3E5A29A03894881CDCC7EACB5A607A3D1CC
2584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2584.39333\Netflix Checker FAST\Netflix Checker FAST.exeexecutable
MD5:2433585D98E16EE1FC2E73F4DE779120
SHA256:2A67C7B97F8725A059397714EBC245FC49FBAB81BA783F2F0BDD182D8F6E4111
3028MSBuild.exeC:\Users\admin\AppData\Local\Temp\d81213685d38144385839ea32e9be75d\ef73856a39bec359068d0fe61f18eeaa\Dirs\Documents.txttext
MD5:951BE89045F6382AB5ABAA603C64E111
SHA256:8205507A9E5418381ED24DD0DD5395B0BEDF5C22CB9FE720CF87E90ED8FBD2C8
2612server.exeC:\Users\admin\AppData\Local\Temp\gpustats.bxtext
MD5:5D1AB2DF669F6A496C318E6CFD5F1059
SHA256:F9D2FBCAFA1438133392A4D2F560B18FC87694BDE17B023878C7819F3AC26E92
2584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2584.39333\Netflix Checker FAST\configs\Leaf.xNet.dllexecutable
MD5:C56DE89F88B5E8203A637FC0CC1FA0DB
SHA256:5F4938C1140BE5E19F0BFD0FE9838DCCF8554DB781C56482660AA7DC751FB4BB
3028MSBuild.exeC:\Users\admin\AppData\Local\Temp\d81213685d38144385839ea32e9be75d\ef73856a39bec359068d0fe61f18eeaa\Dirs\Startup.txttext
MD5:68C93DA4981D591704CEA7B71CEBFB97
SHA256:889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3028
MSBuild.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml/
unknown
xml
459 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3028
MSBuild.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
3028
MSBuild.exe
151.101.0.133:443
raw.githubusercontent.com
Fastly
US
malicious
3028
MSBuild.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger LLP
GB
malicious

DNS requests

Domain
IP
Reputation
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared
ip-api.com
  • 208.95.112.1
shared
api.telegram.org
  • 149.154.167.220
shared

Threats

PID
Process
Class
Message
3028
MSBuild.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3028
MSBuild.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3028
MSBuild.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3028
MSBuild.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3028
MSBuild.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3028
MSBuild.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Netflix_Checker_FAST.rar