File name:

SecureByte v1.0.0 - DeepRET.zip

Full analysis: https://app.any.run/tasks/192328d6-b016-44ea-91ec-1d21b3e199a7
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 05, 2024, 21:41:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sheetrat
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

80B2762742CBB64A95CBB2F83785D36F

SHA1:

92FEA92FF567066AFEC75A9366F98B3CBDC8ECBA

SHA256:

14B345FEB1B9ECDC3E304139D5DB87C924908473827F81A9CA799241050283FB

SSDEEP:

98304:3vANahPqEhbk8sBueZeUT+1Jd7NQYLIU8jc+gJIFdB+AKDXaFsGyCnQ+Oqf4+sVp:Ek7qgt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3500)

    • SHEETRAT has been detected (YARA)

      • SECURE BYTE GUI.exe (PID: 2208)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SECURE BYTE GUI.exe (PID: 2208)

    • Reads settings of System Certificates

      • SECURE BYTE GUI.exe (PID: 2208)

  • INFO

    • Manual execution by a user

      • SECURE BYTE GUI.exe (PID: 2208)

    • Reads the machine GUID from the registry

      • SECURE BYTE GUI.exe (PID: 2208)

    • Reads Environment values

      • SECURE BYTE GUI.exe (PID: 2208)

    • Reads the software policy settings

      • SECURE BYTE GUI.exe (PID: 2208)

    • Checks supported languages

      • SECURE BYTE GUI.exe (PID: 2208)

    • Reads the computer name

      • SECURE BYTE GUI.exe (PID: 2208)

    • Create files in a temporary directory

      • SECURE BYTE GUI.exe (PID: 2208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:03:08 17:35:50
ZipCRC: 0x42e33b97
ZipCompressedSize: 3008
ZipUncompressedSize: 6656
ZipFileName: CodeEncryption.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #SHEETRAT secure byte gui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2208"C:\Users\admin\Desktop\SECURE BYTE GUI.exe" C:\Users\admin\Desktop\SECURE BYTE GUI.exe
explorer.exe
User:
admin
Company:
DeepRET
Integrity Level:
MEDIUM
Description:
Secure Byte Obfuscator
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\secure byte gui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3500"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\SecureByte v1.0.0 - DeepRET.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
9 316
Read events
9 268
Write events
48
Delete events
0

Modification events

(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3500) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SecureByte v1.0.0 - DeepRET.zip
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3500) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
8
Suspicious files
7
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\CodeEncryption.dllexecutable
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Core.dllexecutable
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\dnlib.dllexecutable
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Hardening.dllexecutable
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Important !\GOTHIC.TTFbinary
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Important !\GOTHICB.TTFbinary
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Important !\GOTHICBI.TTFbinary
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Important !\GOTHICI.TTFbinary
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Important !\Read me.txttext
MD5:—
SHA256:—
3500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3500.28507\Runtime.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
3
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2208
SECURE BYTE GUI.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?54a95c1eab34bab9
US
compressed
68.3 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2208
SECURE BYTE GUI.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
unknown
2208
SECURE BYTE GUI.exe
172.67.72.57:443
keyauth.win
CLOUDFLARENET
US
unknown
2208
SECURE BYTE GUI.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
shared
keyauth.win
  • 172.67.72.57
  • 104.26.1.5
  • 104.26.0.5
malicious
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)
2208
SECURE BYTE GUI.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecureByte v1.0.0 - DeepRET.zip