analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

0789798.rar

Full analysis: https://app.any.run/tasks/5ab4fff4-d62a-49c2-852e-25786a7377c8
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 16:39:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

CE174A90BBD19D3FBB02EC9C7FCF8A62

SHA1:

0B13A9E00D3043FC932096FD405CCFDD4C4B4769

SHA256:

1970AE291613B23EF6FDAA53BF56A2BE510AF56575385F04EFAD0761CA7A5EDB

SSDEEP:

6144:U+4Lxs0oSvTs1CO3UVKXOp+4opKlfUtq4i789XpiDJh943i22rSjAM5+86k3ZXjv:L4FbLsCObt4oWUi7mX21XruZxZUc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 0789798.exe (PID: 3372)
      • 0789798.exe (PID: 2464)
      • 0789798.exe (PID: 2564)
      • 0789798.exe (PID: 1932)
      • 0789798.exe (PID: 3968)
      • 0789798.exe (PID: 3752)
      • 0789798.exe (PID: 3924)
      • 0789798.exe (PID: 3176)
      • 0789798.exe (PID: 3736)
      • 0789798.exe (PID: 1684)
      • 0789798.exe (PID: 4004)
      • 0789798.exe (PID: 1808)
      • 0789798.exe (PID: 2168)
      • 0789798.exe (PID: 3124)
      • 0789798.exe (PID: 3468)
      • 0789798.exe (PID: 2864)

    • NanoCore was detected

      • 0789798.exe (PID: 2464)

  • SUSPICIOUS

    • Application launched itself

      • 0789798.exe (PID: 2564)
      • 0789798.exe (PID: 2464)
      • 0789798.exe (PID: 1932)
      • 0789798.exe (PID: 3372)
      • 0789798.exe (PID: 3176)
      • 0789798.exe (PID: 3968)
      • 0789798.exe (PID: 3924)
      • 0789798.exe (PID: 4004)
      • 0789798.exe (PID: 2168)
      • 0789798.exe (PID: 2864)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3116)

    • Creates files in the user directory

      • 0789798.exe (PID: 2464)

    • Connects to unusual port

      • 0789798.exe (PID: 1684)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
17
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start winrar.exe 0789798.exe no specs #NANOCORE 0789798.exe no specs 0789798.exe no specs 0789798.exe 0789798.exe no specs 0789798.exe 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs 0789798.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\0789798.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1932"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2464"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe
0789798.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2564"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" 2 2464 2228484C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe—0789798.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3372"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe
0789798.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3968"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe—0789798.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1684"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe
0789798.exe
User:
admin
Integrity Level:
HIGH
3736"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" 2 1684 2369250C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe—0789798.exe
User:
admin
Integrity Level:
HIGH
3752"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe—0789798.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3176"C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe" 2 3752 2369296C:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exe—0789798.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
807
Read events
791
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3116.49409\0789798.exeexecutable
MD5:66E0F08D6187FC4D938118D623BE70CA
SHA256:8F7F4163FDC65C730A213DF8D6A67355ABC92AE5EFB2E1D0671BE6163DB707C5
24640789798.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:A2CED828A08486B7801B2B0BBAFCC923
SHA256:EA64759CC1DFAB43A5DE9C4B4DAEC8BBCCB5EC57E39859137743CA7F6D4E4D93
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1684
0789798.exe
173.46.85.5:1985
—
Abc-hosters LLC
US
malicious

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
0789798.rar