analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2.rar

Full analysis: https://app.any.run/tasks/6f59f085-53fc-40be-be83-4bcaa6525b7d
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 31, 2020, 08:10:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
revenge
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

EA74B1C94CF8A9BEC462B97C0F6248B4

SHA1:

C68F23034D0383C70115499F8F4E18E42806369C

SHA256:

18F3F4BAC5EE311339FFCCFDF47602A319CFCB28DDA15C249D3601EF3454601E

SSDEEP:

384:2dP1pv4SjrcIqyEB4lI4ntIbA+Fl/fVVeNjwcTBAfgF8RQ5Jc/nIFkjtdSjyclKT:2dtGSjrcIqLmqlfNcefq8RQvZVK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • cheatfox.exe.exe (PID: 1296)
    • Connects to CnC server

      • cheatfox.exe.exe (PID: 1296)
    • REVENGE was detected

      • cheatfox.exe.exe (PID: 1296)
  • SUSPICIOUS

    • Connects to unusual port

      • cheatfox.exe.exe (PID: 1296)
  • INFO

    • Manual execution by user

      • cheatfox.exe.exe (PID: 1296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #REVENGE cheatfox.exe.exe

Process information

PID
CMD
Path
Indicators
Parent process
3852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1296"C:\Users\admin\Desktop\cheatfox.exe.exe" C:\Users\admin\Desktop\cheatfox.exe.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Total events
460
Read events
441
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3852.10693\cheatfox.exe.exe
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1296
cheatfox.exe.exe
83.163.73.56:8808
Xs4all Internet BV
NL
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
1296
cheatfox.exe.exe
A Network Trojan was detected
MALWARE [PTsecurity] MSIL/Revenge-RAT CnC Checkin
13 ETPRO signatures available at the full report
No debug info