File name:

AntiPublic.rar

Full analysis: https://app.any.run/tasks/108953a8-fab0-413c-b2af-3525de715c3f
Verdict: No threats detected
Analysis date: December 16, 2019, 18:17:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

778A79D4F50025258F70A97A219988F5

SHA1:

0294113BC2AF8101C574FF0B920E5C2E18823AE5

SHA256:

1D7E6BF73230EB2F0F08B688FB8797CE68F18A1DED22D71F84193E18B008BA81

SSDEEP:

49152:Ujy/gIyltixnuKBdAesNYuH4PAXZ9dHWfVpKD3yj:ayGniUud9WYuYoXIf3KDij

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • AntiPublic Cracked By CrackCash.exe (PID: 3432)

    • Application was dropped or rewritten from another process

      • AntiPublic Cracked By CrackCash.exe (PID: 3432)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2336)

    • Reads Environment values

      • AntiPublic Cracked By CrackCash.exe (PID: 3432)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe antipublic cracked by crackcash.exe

Process information

PID
CMD
Path
Indicators
Parent process
2336"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AntiPublic.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3432"C:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\AntiPublic Cracked By CrackCash.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\AntiPublic Cracked By CrackCash.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2336.26616\antipublic\antipublic cracked by crackcash.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
531
Read events
503
Write events
28
Delete events
0

Modification events

(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2336) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AntiPublic.rar
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
5
Suspicious files
0
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\AntiPublic Cracked By CrackCash.exeexecutable
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\screenshots\antipublic__.jpgimage
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\GemBox.Email.dllexecutable
MD5:3657F2F4783FC9D9505B8C137AABA060
SHA256:A5899F6D6C6F3944DEC97CA32B4A915606EE7154ABCEC29020AF3C21AE9B3274
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Newtonsoft.Json.dllexecutable
MD5:5AFDA7C7D4F7085E744C2E7599279DB3
SHA256:F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Результат 15.11_20-43-07\antipublic_20-43-07_15.11.jpgimage
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Результат 15.11_20-43-07\public.txttext
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Результат 15.11_20-43-07\private_zabugor.txttext
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Общий приват\private_zabugor_15.11_20-43-07.txttext
MD5:—
SHA256:—
3432AntiPublic Cracked By CrackCash.exeC:\Users\admin\AppData\Local\IsolatedStorage\fpcus3oe.5l1\v4zlnnt0.fpl\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\identity.datpi2
MD5:—
SHA256:—
3432AntiPublic Cracked By CrackCash.exeC:\Users\admin\AppData\Local\IsolatedStorage\fpcus3oe.5l1\v4zlnnt0.fpl\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\identity.datpi2
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3432
AntiPublic Cracked By CrackCash.exe
POST
200
144.76.190.197:80
http://myrz.org/api/email_search.php
DE
text
59 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
POST
200
144.76.190.197:80
http://myrz.org/api/email_search.php
DE
text
59 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check_updates.php?do=version
DE
text
18 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
GET
200
144.76.190.197:80
http://myrz.org/api/count_lines.php
DE
text
10 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
POST
200
144.76.190.197:80
http://myrz.org/api/email_search.php
DE
text
59 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3432
AntiPublic Cracked By CrackCash.exe
144.76.190.197:80
myrz.org
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
myrz.org
  • 144.76.190.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AntiPublic.rar