File name:

HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.7z

Full analysis: https://app.any.run/tasks/fea05c69-9b09-49bf-bfaf-990a489eae98
Verdict: Malicious activity
Threats:

Raccoon is an info stealer type malware available as a Malware as a Service. It can be obtained for a subscription and costs $200 per month. Raccoon malware has already infected over 100,000 devices and became one of the most mentioned viruses on the underground forums in 2019.

Malware Trends Tracker     >>>
Analysis date: April 28, 2025, 12:51:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
raccoon
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

FC958BDB1819F5931E7BFF45F1803133

SHA1:

41690BFB7744B7EB99AE034E204D2FF36137EAA5

SHA256:

1A940913D2C6FC138DB3380C347A1965A8AF841AC0AE7871D53111B939A00025

SSDEEP:

12288:uQPNqiyb9GzaOI5UjsDNToPoZ9V/cC0SWmHUmyD5tGTjoJIIjjoFcWk:uQPNqiyp4I5eWToPS/cC0Sz0N5tGTjod

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RACCOON has been detected (YARA)

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

    • There is functionality for taking screenshot (YARA)

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

  • INFO

    • Reads the computer name

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2364)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

    • Reads the software policy settings

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)

    • Checks supported languages

      • HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe (PID: 1028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Raccoon

(PID) Process(1028) HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
C2 urlhttps://telete.in/opa4kiprivatem
RC4_key235aa39e14baeee2e915154e8ea069ba3
Bot Id93d3ccba4a3cbd5e268873fc1760b2335272e198
RC4_key1$Z2s`ten\@bE9vzR
Strings (146)\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
ejbalbakoplchlghecdalmeeeajnimhm
odbfpeeihdkbihmopkbjmoonfanlbfcl
fnjhmkhhmkbjkkabndcnnogagogbneec
ibnejdfjmmkpcnlpebklmnkoeoihofec
fhbohimaelbohpjbbldcngcnapndodjp
Extension Settings
sqlite3_open_v2
SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards
sqlite3_open_v2
SELECT name, value FROM autofill
sqlite3_open_v2
b2#6*nb+11'!70'bnb':2+0'176!nb,#/'nb4#.7'nb',!0;26'&4#.7'bj--)+'1jmoonfanlbfcl
SELECT host_key, path, secure , expires_utc, name, value, encrypted_value FROM cookies
sqlite3_open_v2
SELECT origin_url, username_value, password_value FROM logins
SELECT origin_url, username_value, password_value FROM wow_logins
sqlite3_open_v2
Q &  & YVYHIIIIIIYRYQ  Q^\ ^UY^HOIHTIHTIH^PPUY^  ^PY?+64CCCCC
Wallets\wallet.dat
Wallets\Ethereum
Wallets\Ethereum\
Wallets\Ethereum
Wallets\Ethereum\
\Exodus\exodus.wallet
Wallets\Exodus
Wallets\Exodus\exodus.wallet
Wallets\Exodus\exodus.wallet\
Wallets\Exodus
Wallets\Exodus\
\Blockstream-Green\
\Jaxx\Local Storage
\signons.sqlite
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
encryptedUsername
encryptedPassword
encryptedUsername
encryptedPassword
thunderbird.txt
encryptedUsername
encryptedPassword
encryptedUsername
encryptedPassword
\places.sqlite
\places.sqlite
firefox_urls.txt
\cookies.sqlite
SELECT host, path, isSecure, expiry, name, value FROM moz_cookies
ie_autofill.txt
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
!PeriodicCheckTime
OutgoingServer
Outgoing Server:
IncomingServer
Incoming server:
\Accounts\Account.rec0
\Accounts\Account.rec0
D:\Program Files (x86)\Foxmail 7.2\Storage
D:\Foxmail 7.2\Storage
C:\Program Files\Foxmail 7.2\Storage
C:\Program Files (x86)\Foxmail 7.2\Storage
$Z2s`ten\@bE9vzR
Wrong config id
@l_~Cb^oCcVy Yl70YUTN_TN^SIJUISNSUT\UHW^[N[T[W_VaultCloseVault
.zip" Content-Type: application/octet-stream
PStoreCreateInstance
dqsdqsdqsdqs<7.2\StoragewC:\Program Files`P
SUBTYPE GUID="
Installed Apps:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Racc0_0n | 1.8.0
Build compile date:
- Passwords:
System Information:
- System Language:
- System TimeZone:
- Location:
- ComputerName:
- Username:
- Windows version: NT
- Product name:
- System arch:
- Display devices:
SOFTWARE\Microsoft\Cryptography
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "%s"
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:08:20 12:08:32+00:00
ArchivedFileName: HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #RACCOON heur-trojan-ransom.win32.blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe

Process information

PID
CMD
Path
Indicators
Parent process
1028"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.win32.blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Raccoon
(PID) Process(1028) HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
C2 urlhttps://telete.in/opa4kiprivatem
RC4_key235aa39e14baeee2e915154e8ea069ba3
Bot Id93d3ccba4a3cbd5e268873fc1760b2335272e198
RC4_key1$Z2s`ten\@bE9vzR
Strings (146)\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
\eJ7xG7cQ_5q.zip
encrypted_key":"
description" dir="auto">
is_history_enabled
is_screen_enabled
ejbalbakoplchlghecdalmeeeajnimhm
odbfpeeihdkbihmopkbjmoonfanlbfcl
fnjhmkhhmkbjkkabndcnnogagogbneec
ibnejdfjmmkpcnlpebklmnkoeoihofec
fhbohimaelbohpjbbldcngcnapndodjp
Extension Settings
sqlite3_open_v2
SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards
sqlite3_open_v2
SELECT name, value FROM autofill
sqlite3_open_v2
b2#6*nb+11'!70'bnb':2+0'176!nb,#/'nb4#.7'nb',!0;26'&4#.7'bj--)+'1jmoonfanlbfcl
SELECT host_key, path, secure , expires_utc, name, value, encrypted_value FROM cookies
sqlite3_open_v2
SELECT origin_url, username_value, password_value FROM logins
SELECT origin_url, username_value, password_value FROM wow_logins
sqlite3_open_v2
Q &  & YVYHIIIIIIYRYQ  Q^\ ^UY^HOIHTIHTIH^PPUY^  ^PY?+64CCCCC
Wallets\wallet.dat
Wallets\Ethereum
Wallets\Ethereum\
Wallets\Ethereum
Wallets\Ethereum\
\Exodus\exodus.wallet
Wallets\Exodus
Wallets\Exodus\exodus.wallet
Wallets\Exodus\exodus.wallet\
Wallets\Exodus
Wallets\Exodus\
\Blockstream-Green\
\Jaxx\Local Storage
\signons.sqlite
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
encryptedUsername
encryptedPassword
encryptedUsername
encryptedPassword
thunderbird.txt
encryptedUsername
encryptedPassword
encryptedUsername
encryptedPassword
\places.sqlite
\places.sqlite
firefox_urls.txt
\cookies.sqlite
SELECT host, path, isSecure, expiry, name, value FROM moz_cookies
ie_autofill.txt
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
!PeriodicCheckTime
OutgoingServer
Outgoing Server:
IncomingServer
Incoming server:
\Accounts\Account.rec0
\Accounts\Account.rec0
D:\Program Files (x86)\Foxmail 7.2\Storage
D:\Foxmail 7.2\Storage
C:\Program Files\Foxmail 7.2\Storage
C:\Program Files (x86)\Foxmail 7.2\Storage
$Z2s`ten\@bE9vzR
Wrong config id
@l_~Cb^oCcVy Yl70YUTN_TN^SIJUISNSUT\UHW^[N[T[W_VaultCloseVault
.zip" Content-Type: application/octet-stream
PStoreCreateInstance
dqsdqsdqsdqs<7.2\StoragewC:\Program Files`P
SUBTYPE GUID="
Installed Apps:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Racc0_0n | 1.8.0
Build compile date:
- Passwords:
System Information:
- System Language:
- System TimeZone:
- Location:
- ComputerName:
- Username:
- Windows version: NT
- Product name:
- System arch:
- Display devices:
SOFTWARE\Microsoft\Cryptography
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "%s"
2364"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\fea05c69-9b09-49bf-bfaf-990a489eae98.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
3 938
Read events
3 901
Write events
37
Delete events
0

Modification events

(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2364) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\fea05c69-9b09-49bf-bfaf-990a489eae98.7z
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2364.1911\HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exeexecutable
MD5:F0B68DDC0BEF98205B22B8BCCEC05436
SHA256:ADF56D5514F9FF609943983010D3FC67AC0B29D5F92AC9ADC25BAFBA79BAD88A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1028
HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
199.59.243.228:443
telete.in
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
telete.in
  • 199.59.243.228
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.7z