File name:

AntiPublic.rar

Full analysis: https://app.any.run/tasks/108953a8-fab0-413c-b2af-3525de715c3f
Verdict: No threats detected
Analysis date: December 16, 2019, 18:17:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

778A79D4F50025258F70A97A219988F5

SHA1:

0294113BC2AF8101C574FF0B920E5C2E18823AE5

SHA256:

1D7E6BF73230EB2F0F08B688FB8797CE68F18A1DED22D71F84193E18B008BA81

SSDEEP:

49152:Ujy/gIyltixnuKBdAesNYuH4PAXZ9dHWfVpKD3yj:ayGniUud9WYuYoXIf3KDij

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AntiPublic Cracked By CrackCash.exe (PID: 3432)

    • Loads dropped or rewritten executable

      • AntiPublic Cracked By CrackCash.exe (PID: 3432)

  • SUSPICIOUS

    • Reads Environment values

      • AntiPublic Cracked By CrackCash.exe (PID: 3432)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2336)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe antipublic cracked by crackcash.exe

Process information

PID
CMD
Path
Indicators
Parent process
2336"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AntiPublic.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3432"C:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\AntiPublic Cracked By CrackCash.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\AntiPublic Cracked By CrackCash.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2336.26616\antipublic\antipublic cracked by crackcash.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
531
Read events
503
Write events
28
Delete events
0

Modification events

(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2336) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AntiPublic.rar
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2336) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
5
Suspicious files
0
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
3432AntiPublic Cracked By CrackCash.exeC:\Users\admin\AppData\Local\IsolatedStorage\fpcus3oe.5l1\v4zlnnt0.fpl\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\identity.datpi2
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Результат 15.11_20-43-07\private_zabugor.txttext
MD5:—
SHA256:—
3432AntiPublic Cracked By CrackCash.exeC:\Users\admin\AppData\Local\IsolatedStorage\fpcus3oe.5l1\v4zlnnt0.fpl\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\identity.datpi2
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\AntiPublic Cracked By CrackCash.exeexecutable
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Newtonsoft.Json.dllexecutable
MD5:5AFDA7C7D4F7085E744C2E7599279DB3
SHA256:F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
3432AntiPublic Cracked By CrackCash.exeC:\Users\admin\AppData\Local\IsolatedStorage\fpcus3oe.5l1\v4zlnnt0.fpl\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\info.databr
MD5:22589A024E2B52B44365C84BF9053EAB
SHA256:335D953107E146619C0BF52F8D650C2CDBB5DAF1E1278F51437D96215AC74DB9
3432AntiPublic Cracked By CrackCash.exeC:\Users\admin\AppData\Local\IsolatedStorage\fpcus3oe.5l1\v4zlnnt0.fpl\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\Url.feqqjsel2j4wuxkzkoqlgu0e1xmlvmiq\Files\CultureSettings.xmlxml
MD5:388E09773F560969256C631FAAE2D2A2
SHA256:EC795E4E751F3BB0C56880078C3C25B5F730D8325BF6B5A9C5EFB8E5B0526EFF
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\ConsoleRegChecker.exeexecutable
MD5:E45AB7767CD2C15503F510F45150D6C4
SHA256:5CD12B3E976FCE79A0F19B30827F9FC07B209DECC557B65F41F296EBC6F8FABC
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\Общий приват\private_zabugor_15.11_20-43-07.txttext
MD5:—
SHA256:—
2336WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2336.26616\AntiPublic\screenshots\antipublic__.jpgimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3432
AntiPublic Cracked By CrackCash.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check_updates.php?do=version
DE
text
18 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
GET
200
144.76.190.197:80
http://myrz.org/api/count_lines.php
DE
text
10 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
POST
200
144.76.190.197:80
http://myrz.org/api/email_search.php
DE
text
59 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
POST
200
144.76.190.197:80
http://myrz.org/api/email_search.php
DE
text
59 b
whitelisted
3432
AntiPublic Cracked By CrackCash.exe
POST
200
144.76.190.197:80
http://myrz.org/api/email_search.php
DE
text
59 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3432
AntiPublic Cracked By CrackCash.exe
144.76.190.197:80
myrz.org
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
myrz.org
  • 144.76.190.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AntiPublic.rar