File name:

MalvareBytes Premium.rar

Full analysis: https://app.any.run/tasks/e1d15f68-cac4-4a12-b9d9-5c0a38df622f
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: February 14, 2022, 23:52:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

820494182D58C045A68B5832DF2C3518

SHA1:

8B1DA7F1E3B5608BBC7D5A0D38D1177CCFEBF4B2

SHA256:

16F4F71423B560A91B88819E60DA1DFA0412C3804ACCB369154183A90E2CC97A

SSDEEP:

196608:c/aEUsmxUt2COSw5WPLLaMLq2Y/TN4m7M1oVMACMlRY8QeIleLEE3D3XlDqo1EHN:txEJxw5yq7Tem7M/wlRY8QVlewstkN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MBSetup.exe (PID: 3024)
      • MBSetup.exe (PID: 1500)

    • Connects to CnC server

      • AppLaunch.exe (PID: 508)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 508)

    • REDLINE was detected

      • AppLaunch.exe (PID: 508)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 508)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3028)
      • MBSetup.exe (PID: 1500)
      • AppLaunch.exe (PID: 508)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3028)

    • Reads the computer name

      • WinRAR.exe (PID: 3028)
      • AppLaunch.exe (PID: 508)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3028)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3028)

    • Reads the cookies of Mozilla Firefox

      • AppLaunch.exe (PID: 508)

    • Reads the cookies of Google Chrome

      • AppLaunch.exe (PID: 508)

    • Reads Environment values

      • AppLaunch.exe (PID: 508)

    • Searches for installed software

      • AppLaunch.exe (PID: 508)

  • INFO

    • Manual execution by user

      • MBSetup.exe (PID: 3024)
      • MBSetup.exe (PID: 1500)
      • taskmgr.exe (PID: 2388)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3028)

    • Checks supported languages

      • taskmgr.exe (PID: 2388)

    • Reads the computer name

      • taskmgr.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe mbsetup.exe no specs mbsetup.exe #REDLINE applaunch.exe taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
508"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
MBSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shlwapi.dll
1500"C:\Users\admin\Desktop\MalvareBytes Premium\MBSetup.exe" C:\Users\admin\Desktop\MalvareBytes Premium\MBSetup.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\malvarebytes premium\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2388"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3024"C:\Users\admin\Desktop\MalvareBytes Premium\MBSetup.exe" C:\Users\admin\Desktop\MalvareBytes Premium\MBSetup.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\malvarebytes premium\mbsetup.exe
3028"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\MalvareBytes Premium.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
Total events
2 271
Read events
2 260
Write events
11
Delete events
0

Modification events

(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3028) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\MalvareBytes Premium.rar
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3028) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
3
Suspicious files
0
Text files
0
Unknown types
55

Dropped files

PID
Process
Filename
Type
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\da.pakpgc
MD5:8D17DF6D95DCF5E46AA9126B56A33CAB
SHA256:0CEACF2B7DD9F345EC6D6C18A187318956D5E10DA3D97271E955A8BE0EF526DA
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\de.pakpgc
MD5:A564A4DAAAA86766C4C2BCF89B8B043B
SHA256:A19A704ADD3872C148F69E3BBBB22F33621D0078ACF358D7ED02D45E99160AAF
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\ar-XB.pakmmw
MD5:7D684602C35EA5112697B26428E13B10
SHA256:31341A80DBA38088322C6A476ADDEB7A2E318A26FE3581B19DD81DF43350AC48
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\bn.pakpgc
MD5:0C0C1B8635BF7C6A56878F4E617FDBCF
SHA256:33A823AC7F67A9B3F5414F0378EB897A8973D62280AFBD652BEACE0B33A888F5
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\ar.pakpgc
MD5:2DA836CB45E495093AA5E4683AA4823E
SHA256:090026163931A00CF6B4E1C8488301780FFCFC01D1D127137E8ADFF72FBED567
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\bg.pakpgc
MD5:7BEBDF7E542C6CF92DE5107A85D5E732
SHA256:6ABD83D85E36DAB12EDB60B7EC5366B9BA392C3F9FA411721BB3305201F7D290
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\en-GB.pakmmw
MD5:090609FADCB8DD44F6EAD13583B11C21
SHA256:3D171DFDC0B5B5BA21FE0197A60C3552AB82C9ED68EE117DB231BDC63B6A83B6
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\en-US.pakmmw
MD5:73D1F10CF422360993B1C356DF9A48B1
SHA256:FA65F78B734B795B63437CFFB5F6D4C9E6F540E097066A933D2708BB49483ECB
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\am.pakpgc
MD5:510DA7B454244A68C41B26C282204357
SHA256:C95771BC2EC7A8723920B72910AB3C62A9D4B80F9608BF075B0E57D40C3DA9C0
3028WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3028.42978\MalvareBytes Premium\locales\cs.pakpgc
MD5:CBEA983775F29D2A94AAC6F9858AAEBF
SHA256:4F2EB464DFD58777668A8345DE0A165AC93F5E63F188B6072FC6DD166DEA9F2D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
508
AppLaunch.exe
94.23.1.92:12857
—
OVH SAS
FR
malicious

DNS requests

No data

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MalvareBytes Premium.rar