File name:

_Cracked_Streambot_2.rar

Full analysis: https://app.any.run/tasks/547416d6-3361-4a73-818d-e3c339f8a221
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: December 18, 2018, 15:15:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
miner
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C98AAE43EC84FADC9EAC5EBC0CD7A1B2

SHA1:

FCD63318B9146484A521D9AFC0AFC0AE17F13D18

SHA256:

141FB3AB10523E8624E5736218F9A6B7A8CD1FFB3862444F491D5792FA6D3142

SSDEEP:

196608:R9itwJNPwD7qM2KFJUycFd+o+zOwAd+jDoWRJO4Zvj57UIG+uMNZkyzf29F0Hl:uiJNYy4C/Fd+ond47nOc9UIG+DZ/29Fg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1040)

    • Known privilege escalation attack

      • Streambot 2.exe (PID: 3836)

    • Uses Task Scheduler to run other applications

      • Protectedwo.exe (PID: 2520)
      • 22.exe (PID: 3644)
      • 2222.exe (PID: 3724)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2584)
      • schtasks.exe (PID: 3916)
      • schtasks.exe (PID: 3900)
      • schtasks.exe (PID: 3956)
      • schtasks.exe (PID: 3944)

    • Application was dropped or rewritten from another process

      • streambot2.exe (PID: 2912)
      • 2222.exe (PID: 3724)
      • 22.exe (PID: 3644)
      • Protectednj.exe (PID: 3436)
      • Protectedwo.exe (PID: 2520)
      • Protectedin.exe (PID: 2192)
      • Protectedwo.exe (PID: 908)
      • Protectedcy.exe (PID: 3652)
      • 2222.sfx.exe (PID: 3052)
      • SDVGJHKHC.exe (PID: 2864)
      • ZVKQHTPNL.exe (PID: 3008)

    • Changes the autorun value in the registry

      • 22.exe (PID: 3644)
      • cscript.exe (PID: 3396)
      • 2222.exe (PID: 3724)
      • wscript.exe (PID: 2848)

    • Writes to a start menu file

      • cscript.exe (PID: 3396)
      • wscript.exe (PID: 2848)

    • MINER was detected

      • SDVGJHKHC.exe (PID: 2864)
      • ZVKQHTPNL.exe (PID: 3008)

    • Connects to CnC server

      • SDVGJHKHC.exe (PID: 2864)
      • ZVKQHTPNL.exe (PID: 3008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3308)
      • Streambot 2.exe (PID: 3272)
      • Protectedwo.exe (PID: 2520)
      • 2222.sfx.exe (PID: 3052)
      • 22.exe (PID: 3644)
      • 2222.exe (PID: 3724)

    • Modifies the open verb of a shell class

      • Streambot 2.exe (PID: 3836)

    • Executes scripts

      • Protectedwo.exe (PID: 908)
      • cscript.exe (PID: 3396)

    • Creates files in the user directory

      • cscript.exe (PID: 3396)

    • Connects to unusual port

      • SDVGJHKHC.exe (PID: 2864)
      • ZVKQHTPNL.exe (PID: 3008)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
25
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe explorer.exe no specs searchprotocolhost.exe no specs streambot 2.exe no specs eventvwr.exe no specs eventvwr.exe streambot 2.exe streambot2.exe no specs protectedcy.exe no specs protectedin.exe no specs protectednj.exe no specs protectedwo.exe 22.exe 2222.sfx.exe protectedwo.exe no specs schtasks.exe no specs cscript.exe 2222.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs wscript.exe #MINER sdvgjhkhc.exe #MINER zvkqhtpnl.exe

Process information

PID
CMD
Path
Indicators
Parent process
908"C:\Users\admin\AppData\Local\Temp\Protectedwo.exe"C:\Users\admin\AppData\Local\Temp\Protectedwo.exe—Protectedwo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\protectedwo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1040"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1328"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2192"C:\Users\admin\AppData\Local\Temp\Protectedin.exe" C:\Users\admin\AppData\Local\Temp\Protectedin.exe—Streambot 2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\protectedin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2520"C:\Users\admin\AppData\Local\Temp\Protectedwo.exe" C:\Users\admin\AppData\Local\Temp\Protectedwo.exe
Streambot 2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\protectedwo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2584"C:\Windows\System32\schtasks.exe" /create /tn 66717363737462656F6C797A /tr "C:\Users\admin\AppData\Local\Temp\awafvqrobbjo\skecatbucrom.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—Protectedwo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2848"C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Local\Temp\6C9.vbs"C:\Windows\System32\wscript.exe
cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2864C:\Users\admin\AppData\Local\Temp\BVPWSLUSIHIG\SDVGJHKHC.exe -o pooleu.xmrminingpool.net:2222 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQtz7XNvpsygAzF9g1Y -p 2222 -a cryptonight --max-cpu-usage 58C:\Users\admin\AppData\Local\Temp\BVPWSLUSIHIG\SDVGJHKHC.exe
22.exe
User:
admin
Integrity Level:
HIGH
Description:
UpdaterWindows
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bvpwslusihig\sdvgjhkhc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
2912"C:\Users\admin\AppData\Local\Temp\streambot2.exe" C:\Users\admin\AppData\Local\Temp\streambot2.exe—Streambot 2.exe
User:
admin
Company:
Shadiku Izayoi, Emma Skye <neosyndicate.net>
Integrity Level:
HIGH
Description:
streambot²
Exit code:
3221225781
Version:
2.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\streambot2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
3008C:\Users\admin\AppData\Local\Temp\VNBZOAYJFDRA\ZVKQHTPNL.exe -o pooleu.xmrminingpool.net:2222 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQtz7XNvpsygAzF9g1Y -p 2222 -a cryptonight --max-cpu-usage 58C:\Users\admin\AppData\Local\Temp\VNBZOAYJFDRA\ZVKQHTPNL.exe
2222.exe
User:
admin
Integrity Level:
HIGH
Description:
UpdaterWindows
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vnbzoayjfdra\zvkqhtpnl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
Total events
1 960
Read events
1 916
Write events
44
Delete events
0

Modification events

(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3308) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\_Cracked_Streambot_2.rar
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3308) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1040) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1040) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
30
Suspicious files
8
Text files
45
Unknown types
0

Dropped files

PID
Process
Filename
Type
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap10.datimage
MD5:15FEC6C33A20A6ECB295FA55514781E7
SHA256:E238521A1915A0C488D87FA0068D03135BA2D806268F58E973B858195975B20D
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap11.datcompressed
MD5:EEB4B272A3C00AB96E0D854BDF67BB9A
SHA256:BC42AC736F96D0CD124FDA4933B83B64C7DA3E8DC4C764D87215D2F332B8B280
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap1.dattext
MD5:38DE427224A5082A04FE82E2BD4EA9EC
SHA256:12F99F53144294750FE8713D580EDA286F4BD95CD9C840DB8AB957DEF8040028
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap13.datimage
MD5:636121997F8139FA039DA7EAA207C23F
SHA256:7F7E0C0BAA8EDB2035D7108ED7760C7F26D80205CB6CA2609904E5B8F69BE6F1
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap14.datimage
MD5:58724CE63DFB037C86EE19358FC20157
SHA256:D4D9BE6BFBAAF7B4215D149907182B8D92137628E0369986D07E8E27006817E8
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap15.datimage
MD5:9739753453EC79E41C49500DDA06D0C9
SHA256:56407243DFEA14F0A42D5CD7E0D7CE3D3D828C83AB3C1A70FC3E09056E99D110
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap18.datimage
MD5:9073D4D6CB37AB39CAA44CFF241182EE
SHA256:19105802E9202F5070919D1326732BE8E8B0D0EF0B9E7DD11AA6BF7DD43042D3
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap17.datimage
MD5:60B09CEE404FCC00B7CB15EC1FDA26DB
SHA256:6A17EAA4FE1B8574588367254EA27B9686C5B8DFB13928028D13415DCF44FDBB
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap21.datimage
MD5:83E5EEF02E173AC3EFD8CA49609EC5E3
SHA256:87249BFB103A8FDE22FE5C6C77CB990E36AE31FBFF8A5FF8361F99199B0F79F4
3308WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3308.16372\[Cracked]Streambot 2\V\includes\dat01\ap22.datcompressed
MD5:45DDEF3B2DFA5D79DDE211620FCF538C
SHA256:1159A44808FAA6C897BDA6D66AE0620B898593A13EAF56318CDDBE66A8298583
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3008
ZVKQHTPNL.exe
192.154.110.50:2222
pooleu.xmrminingpool.net
GorillaServers, Inc.
US
suspicious
2864
SDVGJHKHC.exe
192.154.110.50:2222
pooleu.xmrminingpool.net
GorillaServers, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
pooleu.xmrminingpool.net
  • 192.154.110.50
malicious

Threats

PID
Process
Class
Message
3008
ZVKQHTPNL.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
3008
ZVKQHTPNL.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
2864
SDVGJHKHC.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
2864
SDVGJHKHC.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
3008
ZVKQHTPNL.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3008
ZVKQHTPNL.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
2864
SDVGJHKHC.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
2864
SDVGJHKHC.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_Cracked_Streambot_2.rar