analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Boleto 11-01-2019 cod. COXQybNuyP1.zip

Full analysis: https://app.any.run/tasks/1d576db7-6af5-417a-8b2b-312b33e0e089
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 10, 2019, 22:01:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
banload
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

76B086C9A15D81B6245F78C050E668C3

SHA1:

65A418017ED686A43BC7D084C056E6B0BA638B5D

SHA256:

23BC46BF4D7FDD5B4944920979ADB2C0F2E23653AD8B9BF91568A2202F9025DE

SSDEEP:

98304:w7kPqw7vmMA0PPn4u3OUPdcqz5SnxGLLLA:ZPq+vmF6PDPme5GxGLLLA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Banload was detected

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Changes settings of System certificates

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2988)
    • Adds / modifies Windows certificates

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Creates files in the program directory

      • Boleto 11-01-2019 cod. COXQybNuyP.exe (PID: 2876)
    • Application launched itself

      • WinRAR.exe (PID: 3016)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Boleto 11-01-2019 cod. COXQybNuyP.zip
ZipUncompressedSize: 3325269
ZipCompressedSize: 3325269
ZipCRC: 0x88cd6b18
ZipModifyDate: 2019:01:07 12:21:21
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe #BANLOAD boleto 11-01-2019 cod. coxqybnuyp.exe

Process information

PID
CMD
Path
Indicators
Parent process
3016"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Boleto 11-01-2019 cod. COXQybNuyP1.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21027\Boleto 11-01-2019 cod. COXQybNuyP.zip"C:\Program Files\WinRAR\WinRAR.exeWinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3252"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21345\Boleto 11-01-2019 cod. COXQybNuyP.zip"C:\Program Files\WinRAR\WinRAR.exeWinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2988"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21777\Boleto 11-01-2019 cod. COXQybNuyP.zip"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2876"C:\Users\admin\AppData\Local\Temp\Rar$EXa2988.22184\Boleto 11-01-2019 cod. COXQybNuyP.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2988.22184\Boleto 11-01-2019 cod. COXQybNuyP.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Total events
1 813
Read events
1 719
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21027\Boleto 11-01-2019 cod. COXQybNuyP.zipcompressed
MD5:E85ADEC255E6C0F429EC4D4AA64A9396
SHA256:06748E08486917D3F79FC54DC1913309EA7173EC0A786E32BED01F734F70CFB7
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21777\Boleto 11-01-2019 cod. COXQybNuyP.zipcompressed
MD5:E85ADEC255E6C0F429EC4D4AA64A9396
SHA256:06748E08486917D3F79FC54DC1913309EA7173EC0A786E32BED01F734F70CFB7
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.21345\Boleto 11-01-2019 cod. COXQybNuyP.zipcompressed
MD5:E85ADEC255E6C0F429EC4D4AA64A9396
SHA256:06748E08486917D3F79FC54DC1913309EA7173EC0A786E32BED01F734F70CFB7
2988WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2988.22184\Boleto 11-01-2019 cod. COXQybNuyP.exeexecutable
MD5:E1D7479D02F68645C526BF3D510BC235
SHA256:CD1968CEF573CA4EDAA28312ADDDC58407B192C5FEAF4C5647C1215B92F60324
2876Boleto 11-01-2019 cod. COXQybNuyP.exeC:\ProgramData\TEMP\RAIDTesttext
MD5:C7B414D47E276953ED848B6EE9B03845
SHA256:38021E44326E235BC37782DD8B02634F2024D2952ECD1DFCC4524E45BB5B307F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2876
Boleto 11-01-2019 cod. COXQybNuyP.exe
74.125.140.199:443
sites.google.com
Google Inc.
US
unknown
2876
Boleto 11-01-2019 cod. COXQybNuyP.exe
64.233.166.137:443
0f46fc6b-a-62cb3a1a-s-sites.googlegroups.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
sites.google.com
  • 74.125.140.199
whitelisted
0f46fc6b-a-62cb3a1a-s-sites.googlegroups.com
  • 64.233.166.137
shared

Threats

No threats detected
Process
Message
Boleto 11-01-2019 cod. COXQybNuyP.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Boleto 11-01-2019 cod. COXQybNuyP.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s