File name:

dsghdshsh.rar

Full analysis: https://app.any.run/tasks/b869d397-0237-4fdd-85a4-37455c222e8a
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 20:53:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qrcode
evasion
stealer
securityxploded
floxif
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

AB1654759F959E61A0B11E4D056C6033

SHA1:

303699887B5E80F3A451EA615CAA585213C2403B

SHA256:

152FFFEA72DF218908ABE387B0D4478058EC5D3F19E6B568272CD53210411EEF

SSDEEP:

98304:1GGEzRczvpa15GN1RTQPXVHTZDHVPb5I8Z5G5kftAdSjN95TTHGvgaIfcwI+uWb6:UKUFBRrWL5EVz07hn1p9z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)
      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 3160)
      • winmgr119.exe (PID: 2820)

    • Changes the autorun value in the registry

      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)

    • Registers / Runs the DLL via REGSVR32.EXE

      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)

    • Uses Task Scheduler to run other applications

      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)

    • Changes the AppInit_DLLs value (autorun option)

      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Actions looks like stealing of personal data

      • cvtres.exe (PID: 2676)
      • cvtres.exe (PID: 3744)
      • cvtres.exe (PID: 1212)
      • RegAsm.exe (PID: 2404)

    • Steals credentials

      • cvtres.exe (PID: 2676)
      • cvtres.exe (PID: 3744)

    • SecurityXploded is detected

      • cvtres.exe (PID: 2676)
      • cvtres.exe (PID: 3744)
      • cvtres.exe (PID: 1212)

    • Steals credentials from Web Browsers

      • cvtres.exe (PID: 2676)
      • cvtres.exe (PID: 3744)
      • cvtres.exe (PID: 1212)

    • Renames files like ransomware

      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • FLOXIF has been detected (SURICATA)

      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Connects to the CnC server

      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • RegAsm.exe (PID: 2404)
      • cvtres.exe (PID: 2676)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Reads Microsoft Outlook installation path

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)

    • Reads Internet Explorer settings

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)

    • Reads security settings of Internet Explorer

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • RegAsm.exe (PID: 2404)

    • Checks Windows Trust Settings

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • RegAsm.exe (PID: 2404)

    • Reads settings of System Certificates

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • RegAsm.exe (PID: 2404)

    • Adds/modifies Windows certificates

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • RegAsm.exe (PID: 2404)

    • Starts itself from another location

      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)

    • Detected use of alternative data streams (AltDS)

      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)

    • Process drops legitimate windows executable

      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Searches for installed software

      • RegAsm.exe (PID: 2404)

    • Reads Mozilla Firefox installation path

      • RegAsm.exe (PID: 2404)

    • Loads DLL from Mozilla Firefox

      • RegAsm.exe (PID: 2404)

    • Checks for external IP

      • RegAsm.exe (PID: 2404)

    • The process drops Mozilla's DLL files

      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Connects to SMTP port

      • RegAsm.exe (PID: 2404)

    • Accesses Microsoft Outlook profiles

      • cvtres.exe (PID: 3744)

    • The process executes via Task Scheduler

      • winmgr119.exe (PID: 2820)

    • Starts CMD.EXE for commands execution

      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3540)

  • INFO

    • Checks supported languages

      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)
      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 2600)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3176)
      • wmpnscfg.exe (PID: 3600)
      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)
      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 1604)
      • RegAsm.exe (PID: 2404)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 1928)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3292)
      • cvtres.exe (PID: 2676)
      • cvtres.exe (PID: 3744)
      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • cvtres.exe (PID: 1212)

    • Create files in a temporary directory

      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 2600)
      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)
      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 1604)
      • cvtres.exe (PID: 2676)
      • RegAsm.exe (PID: 2404)
      • cvtres.exe (PID: 3744)
      • cvtres.exe (PID: 1212)

    • Manual execution by a user

      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 2600)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3176)
      • wmpnscfg.exe (PID: 3600)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)
      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 1604)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3292)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 1928)
      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 3160)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 2248)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3540)

    • Reads the computer name

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)
      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3176)
      • wmpnscfg.exe (PID: 3600)
      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)
      • 887a4917f4af1126d489a4f4d56b2eb3.exe (PID: 3292)
      • RegAsm.exe (PID: 2404)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 1928)
      • cvtres.exe (PID: 2676)
      • cvtres.exe (PID: 3744)
      • cvtres.exe (PID: 1212)

    • Reads mouse settings

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)
      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 1928)

    • Checks proxy server information

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2144)

    • Reads the machine GUID from the registry

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)
      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)
      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)
      • RegAsm.exe (PID: 2404)
      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 1604)
      • cvtres.exe (PID: 2676)
      • a9ea383aca2b60aece3a27c899e3f784.exe (PID: 2600)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)

    • Creates files or folders in the user directory

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)

    • Reads CPU info

      • 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe (PID: 684)

    • Creates files in the program directory

      • jhdfkldfhndfkjdfnbfklfnf.exe (PID: 1064)
      • 41637d74a16e50cafe6cb72974a1cf5c.exe (PID: 2336)
      • 9a6f31f789128531e4c714e44915f822.exe (PID: 3460)
      • RegAsm.exe (PID: 2404)
      • 1fa9dbcc19fb2ae5cd344f559e95b759.exe (PID: 1328)

    • Reads Environment values

      • RegAsm.exe (PID: 2404)

    • Reads product name

      • RegAsm.exe (PID: 2404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
109
Monitored processes
32
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs a9ea383aca2b60aece3a27c899e3f784.exe 1fa9dbcc19fb2ae5cd344f559e95b759.exe 64âë¸ßçåíøâçµçêóv2.4.2.exe 41637d74a16e50cafe6cb72974a1cf5c.exe 887a4917f4af1126d489a4f4d56b2eb3.exe wmpnscfg.exe no specs jhdfkldfhndfkjdfnbfklfnf.exe regsvr32.exe no specs regasm.exe schtasks.exe no specs #FLOXIF 9a6f31f789128531e4c714e44915f822.exe a9ea383aca2b60aece3a27c899e3f784.exe 41637d74a16e50cafe6cb72974a1cf5c.exe 887a4917f4af1126d489a4f4d56b2eb3.exe #SECURITYXPLODED cvtres.exe #SECURITYXPLODED cvtres.exe schtasks.exe no specs #SECURITYXPLODED cvtres.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs winmgr119.exe no specs schtasks.exe no specs 41637d74a16e50cafe6cb72974a1cf5c.exe schtasks.exe no specs 887a4917f4af1126d489a4f4d56b2eb3.exe cmd.exe no specs cmd.exe no specs schtasks.exe no specs 9a6f31f789128531e4c714e44915f822.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\Windows\system32\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /fC:\Windows\System32\schtasks.exe—jhdfkldfhndfkjdfnbfklfnf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
684"C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
1fa9dbcc19fb2ae5cd344f559e95b759.exe
User:
admin
Company:
64码
Integrity Level:
HIGH
Description:
64码高清网络电视
Exit code:
0
Version:
2.4.2.0
Modules
Images
c:\program files\64âë¸ßçåíøâçµçêóv2.4.2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1064C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeC:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
41637d74a16e50cafe6cb72974a1cf5c.exe
User:
admin
Company:
Neil Hodgson neilh@scintilla.org
Integrity Level:
HIGH
Description:
SciTE - a Scintilla based Text Editor
Exit code:
0
Version:
1.75
Modules
Images
c:\programdata\jhdfkldfhndfkjdfnbfklfnf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1088C:\Windows\system32\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /fC:\Windows\System32\schtasks.exe—jhdfkldfhndfkjdfnbfklfnf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1212C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\admin\AppData\Local\Temp\tmp16E5.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1328"C:\Users\admin\Desktop\1fa9dbcc19fb2ae5cd344f559e95b759.exe" C:\Users\admin\Desktop\1fa9dbcc19fb2ae5cd344f559e95b759.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\1fa9dbcc19fb2ae5cd344f559e95b759.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1380C:\Windows\system32\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /fC:\Windows\System32\schtasks.exe—jhdfkldfhndfkjdfnbfklfnf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1604"C:\Users\admin\Desktop\a9ea383aca2b60aece3a27c899e3f784.exe" C:\Users\admin\Desktop\a9ea383aca2b60aece3a27c899e3f784.exe
explorer.exe
User:
admin
Company:
home
Integrity Level:
HIGH
Exit code:
0
Version:
3.06.0001
Modules
Images
c:\users\admin\desktop\a9ea383aca2b60aece3a27c899e3f784.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1928"C:\Users\admin\Desktop\41637d74a16e50cafe6cb72974a1cf5c.exe" C:\Users\admin\Desktop\41637d74a16e50cafe6cb72974a1cf5c.exe
explorer.exe
User:
admin
Company:
Neil Hodgson neilh@scintilla.org
Integrity Level:
HIGH
Description:
SciTE - a Scintilla based Text Editor
Exit code:
4294967295
Version:
1.75
Modules
Images
c:\users\admin\desktop\41637d74a16e50cafe6cb72974a1cf5c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2144"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\dsghdshsh.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
15 110
Read events
15 026
Write events
84
Delete events
0

Modification events

(PID) Process:(2144) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(684) 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(684) 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
44
Suspicious files
91
Text files
44
Unknown types
14

Dropped files

PID
Process
Filename
Type
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.43000\8edcc9bf66c21c55cf482dcac1c18c44.exeexecutable
MD5:8EDCC9BF66C21C55CF482DCAC1C18C44
SHA256:44031E3D2381522AFB6B04C95E29483A6E7C6EDEA4F4D75421558E192A311940
68464Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.43000\1fa9dbcc19fb2ae5cd344f559e95b759.exeexecutable
MD5:1FA9DBCC19FB2AE5CD344F559E95B759
SHA256:4DDB27297B45D0195877D13B68BBD36471BE74F72E93FCDDD7F92C9FBA9E94C2
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.43000\887a4917f4af1126d489a4f4d56b2eb3.exeexecutable
MD5:887A4917F4AF1126D489A4F4D56B2EB3
SHA256:68CCD579DEF495EBB77665B750E2DD67E91B977B563DE5CFB0A0146327EAE4A4
2144WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2144.43000\9a6f31f789128531e4c714e44915f822.exeexecutable
MD5:9A6F31F789128531E4C714E44915F822
SHA256:65B564B0AFAE6E283219303CC36A79D3D80118B238D17160DE9B06E28B30527C
68464Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exeC:\Users\admin\AppData\Local\Temp\CabADE7.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
68464Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
13281fa9dbcc19fb2ae5cd344f559e95b759.exeC:\Users\admin\AppData\Local\Temp\2138750\....\TemporaryFileexecutable
MD5:1FA9DBCC19FB2AE5CD344F559E95B759
SHA256:4DDB27297B45D0195877D13B68BBD36471BE74F72E93FCDDD7F92C9FBA9E94C2
13281fa9dbcc19fb2ae5cd344f559e95b759.exeC:\Users\admin\Desktop\1fa9dbcc19fb2ae5cd344f559e95b759.exeexecutable
MD5:2B7904003F4EB1966D1436EADB52353C
SHA256:45F4A06027BF169F992ADE773080907FB131E55A8E3BC05691E1E4368B32A8BD
68464Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:C638D0B5E98D6DB33B1D0FCC0F5A65F7
SHA256:9E2A6DF9D5718A4057E34FB0496707891392DD15EDAF1AB75004E67384C11B9C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
30
DNS requests
16
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
POST
302
69.197.185.26:80
http://live.64ma.com/tv/index.html?s
unknown
—
—
unknown
—
—
GET
200
184.24.77.180:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?de1983f6dc346f99
unknown
compressed
4.66 Kb
unknown
—
—
GET
200
184.24.77.180:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ba082dcb94445d5b
unknown
compressed
65.2 Kb
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDDDJumXgdKVCEN08uA%3D%3D
unknown
binary
1.43 Kb
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDDllKvaYzSKtzZRAvg%3D%3D
unknown
binary
1.43 Kb
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
binary
471 b
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
binary
471 b
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
binary
471 b
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkcHsQGaDFetObPhfan5
unknown
binary
1.41 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
69.197.185.26:80
live.64ma.com
WII
US
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
69.197.185.26:443
live.64ma.com
WII
US
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
184.24.77.180:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
23.212.210.158:80
x1.c.lencr.org
AKAMAI-AS
AU
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
163.181.56.248:443
g.alicdn.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
684
64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
122.225.212.183:443
s22.cnzz.com
CT-HangZhou-IDC
CN
unknown

DNS requests

Domain
IP
Reputation
live.64ma.com
  • 69.197.185.26
unknown
ctldl.windowsupdate.com
  • 184.24.77.180
  • 184.24.77.175
  • 184.24.77.187
  • 184.24.77.199
  • 184.24.77.208
  • 184.24.77.188
  • 184.24.77.193
whitelisted
x1.c.lencr.org
  • 23.212.210.158
whitelisted
s22.cnzz.com
  • 122.225.212.183
malicious
g.alicdn.com
  • 163.181.56.248
  • 163.181.56.244
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
geo2.adobe.com
  • 23.35.236.137
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fpdownload.macromedia.com
  • 23.212.219.216
whitelisted

Threats

PID
Process
Class
Message
2404
RegAsm.exe
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2404
RegAsm.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ipinfo.io
2404
RegAsm.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dsghdshsh.rar