File name:

raid_tool - alphascript.zip

Full analysis: https://app.any.run/tasks/4af776f3-1d24-4e7f-8568-41e998684a54
Verdict: Malicious activity
Analysis date: October 19, 2020, 21:46:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

77D6440735983CAB424802592EA512AB

SHA1:

5F3BF811D9CDFCF5E8958D9155D8B3311525CEDC

SHA256:

15E17C51D719ACE10FE841EFE64D4EB6B2CBEA090687A06964D7521D5DD7E4A5

SSDEEP:

196608:egzE5VUziCh92ESzIYsbO1m8v26jrkNDRHcthJZ409aXKNdSF88C0YwAfcjrZIVW:dz/0nzIfi1m8u6QHcthbtE2V0Y9kxjGo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • raid_tool.exe (PID: 2984)
      • raid_tool.exe (PID: 1544)

    • Loads dropped or rewritten executable

      • raid_tool.exe (PID: 1544)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2504)
      • raid_tool.exe (PID: 2984)

    • Application launched itself

      • raid_tool.exe (PID: 2984)

    • Loads Python modules

      • raid_tool.exe (PID: 1544)

  • INFO

    • Manual execution by user

      • raid_tool.exe (PID: 2984)

    • Dropped object may contain Bitcoin addresses

      • raid_tool.exe (PID: 2984)

    • Reads settings of System Certificates

      • raid_tool.exe (PID: 1544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:07:22 17:41:08
ZipCRC: 0x3365e02f
ZipCompressedSize: 11572330
ZipUncompressedSize: 12028416
ZipFileName: raid_tool.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe raid_tool.exe raid_tool.exe

Process information

PID
CMD
Path
Indicators
Parent process
1544"C:\Users\admin\Desktop\raid_tool.exe" C:\Users\admin\Desktop\raid_tool.exe
raid_tool.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\raid_tool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2504"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\raid_tool - alphascript.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2984"C:\Users\admin\Desktop\raid_tool.exe" C:\Users\admin\Desktop\raid_tool.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\raid_tool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
Total events
680
Read events
660
Write events
20
Delete events
0

Modification events

(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2504) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\raid_tool - alphascript.zip
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
35
Suspicious files
3
Text files
929
Unknown types
2

Dropped files

PID
Process
Filename
Type
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.38034\tokens.txttext
MD5:—
SHA256:—
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.38034\raid_tool.exeexecutable
MD5:—
SHA256:—
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.38034\README.txttext
MD5:—
SHA256:—
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_cffi_backend.cp38-win32.pydexecutable
MD5:012DB6C90D38DB71D0647659217CA286
SHA256:4207E3276411F75A6680EAE28D7D5ED7F6CAD946B1DE7B724440F44593267414
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_multiprocessing.pydexecutable
MD5:8901E96BB7A8EEAD994AF2BDF54A2447
SHA256:823A96F080A3424F4C5327CF61FF517723E19A69679EBE93EA97061063D8D593
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_overlapped.pydexecutable
MD5:AA428E44A78A280EC8152C43D8284F6F
SHA256:F8FDA2A6E3FF0069E634FEEC4854EE7A8C24134C747DE3211AC2BA26E0188C79
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_lzma.pydexecutable
MD5:54F12E2385A77D825AE4D41A4AC515FE
SHA256:08DE18FBA635822F3BB89C9429F175E3680B7261546430BA9E2ED09BB31F5218
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_queue.pydexecutable
MD5:BC5FCE7B8DE6CA765CBF79F9D0587164
SHA256:A5DB4D041F40FB01761B5BAA907099DB89CF891B0DF0251D92DA2FBF9DC3897B
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_ssl.pydexecutable
MD5:B9ECF769FC63A542A113CA1552DC7A7B
SHA256:E0BDB16CFFC7B5A19C5AF22D8A33D3C999D55A3117F2DA07ED3171CA9487927E
2984raid_tool.exeC:\Users\admin\AppData\Local\Temp\_MEI29842\_hashlib.pydexecutable
MD5:05362ADD80824B06014645A7951337D8
SHA256:20B3A3D3350B3D4D57911ECFDB15F77512A6E73C3BF72B410724F81C79A5B1AF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1544
raid_tool.exe
162.159.135.233:443
discordapp.com
Cloudflare Inc
—
shared

DNS requests

Domain
IP
Reputation
discordapp.com
  • 162.159.135.233
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.133.233
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
raid_tool - alphascript.zip