analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SQLi Dumper 9.2.rar

Full analysis: https://app.any.run/tasks/15de9f4d-5fc9-4cca-94b0-eecc89e9fe04
Verdict: Malicious activity
Threats:

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

Malware Trends Tracker     >>>
Analysis date: November 14, 2018, 19:25:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
quasar
orcus
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A0157E775BFEB483C8D556BF8291F1D7

SHA1:

728CF33A07861E6B4FD0B5F089EF44FF7D4EC636

SHA256:

240894BB28D0D5C25A9219F3D427E76EAA41AA1CAC1F8F9214EE1117B2CFEA6B

SSDEEP:

393216:tzl6hc0syAeBueaXJiQFeV0FPvI9A+cKrwG6:tz0zAeBue5H0dIuvh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SQLi Dumper 9.2.1...exe (PID: 1872)
      • SQLi Dumper 9.2.1..exe (PID: 800)
      • SQLi Dumper 9.2.1.exe (PID: 2124)
      • SQLi Dumper 9.2.1..exe (PID: 3724)
      • WindowsInput.exe (PID: 2920)
      • PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE (PID: 2668)
      • WindowsInput.exe (PID: 2900)
      • PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE (PID: 3824)
      • v.exe (PID: 3936)
      • v.exe (PID: 920)
      • c.exe (PID: 3584)
      • c.exe (PID: 3248)

    • QUASAR was detected

      • SQLi Dumper 9.2.1...exe (PID: 1872)

    • Loads the Task Scheduler COM API

      • v.exe (PID: 3936)

    • Changes the autorun value in the registry

      • v.exe (PID: 3936)

    • Orcus RAT was detected

      • c.exe (PID: 3584)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SQLi Dumper 9.2.1.exe (PID: 2124)
      • SQLi Dumper 9.2.1..exe (PID: 800)
      • WinRAR.exe (PID: 1184)
      • PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE (PID: 3824)
      • v.exe (PID: 3936)

    • Creates files in the program directory

      • SQLi Dumper 9.2.1..exe (PID: 800)

    • Creates files in the Windows directory

      • WindowsInput.exe (PID: 2900)
      • SQLi Dumper 9.2.1..exe (PID: 800)

    • Application launched itself

      • SQLi Dumper 9.2.1..exe (PID: 3724)
      • c.exe (PID: 3584)

    • Creates files in the user directory

      • PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE (PID: 3824)
      • v.exe (PID: 3936)

    • Creates or modifies windows services

      • WindowsInput.exe (PID: 2900)

    • Checks for external IP

      • SQLi Dumper 9.2.1...exe (PID: 1872)

    • Starts itself from another location

      • SQLi Dumper 9.2.1..exe (PID: 800)

    • Connects to unusual port

      • v.exe (PID: 3936)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
13
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe sqli dumper 9.2.1.exe pbpjgfe4wuaqofpwdcv8fbfpef4fswln..exe no specs pbpjgfe4wuaqofpwdcv8fbfpef4fswln..exe sqli dumper 9.2.1..exe no specs #QUASAR sqli dumper 9.2.1...exe sqli dumper 9.2.1..exe windowsinput.exe no specs windowsinput.exe no specs v.exe v.exe no specs #ORCUS c.exe no specs c.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1184"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SQLi Dumper 9.2.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2124"C:\Users\admin\AppData\Local\Temp\Rar$EXa1184.5754\SQLi Dumper 9.2.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1184.5754\SQLi Dumper 9.2.1.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2668"C:\Users\admin\AppData\Local\Temp\PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE" C:\Users\admin\AppData\Local\Temp\PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE—SQLi Dumper 9.2.1.exe
User:
admin
Company:
fLaSh
Integrity Level:
MEDIUM
Description:
SQLi Dumper.exe
Version:
9.2.1.0
3824"C:\Users\admin\AppData\Local\Temp\PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE"C:\Users\admin\AppData\Local\Temp\PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE
PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE
User:
admin
Company:
fLaSh
Integrity Level:
MEDIUM
Description:
SQLi Dumper.exe
Exit code:
0
Version:
9.2.1.0
3724"C:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1..exe" C:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1..exe—PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE
User:
admin
Company:
fLaSh
Integrity Level:
MEDIUM
Description:
SQLi Dumper
Exit code:
0
Version:
9.2.1.0
1872"C:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1...exe" C:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1...exe
PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXE
User:
admin
Company:
fLaSh
Integrity Level:
MEDIUM
Description:
SQLi Dumper
Exit code:
0
Version:
9.2.1.0
800"C:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1..exe" /waitC:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1..exe
SQLi Dumper 9.2.1..exe
User:
admin
Company:
fLaSh
Integrity Level:
HIGH
Description:
SQLi Dumper
Exit code:
0
Version:
9.2.1.0
2900"C:\Windows\system32\WindowsInput.exe" --installC:\Windows\system32\WindowsInput.exe—SQLi Dumper 9.2.1..exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Windows Input
Exit code:
0
Version:
0.1.0
2920"C:\Windows\system32\WindowsInput.exe"C:\Windows\system32\WindowsInput.exe—services.exe
User:
SYSTEM
Company:
Microsoft
Integrity Level:
SYSTEM
Description:
Windows Input
Version:
0.1.0
3936"C:\Program Files\v\v.exe" C:\Program Files\v\v.exe
SQLi Dumper 9.2.1..exe
User:
admin
Company:
fLaSh
Integrity Level:
HIGH
Description:
SQLi Dumper
Version:
9.2.1.0
Total events
2 352
Read events
2 292
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
0
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3824PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXEC:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1...exeexecutable
MD5:C64FCD9BCDA417509BA32488B61E9594
SHA256:197358D6724F8CBC156048BF9FE146971AE0C32FE6DA01EDA173D20481B108DC
1184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1184.5754\SQLi Dumper 9.2.1.exeexecutable
MD5:F4F04303297739F6C2B0D8962D17FD5E
SHA256:9EB3016A46DA3C53CD774598B066F07A670BF714BFE525AC8475568B2687B9D4
2124SQLi Dumper 9.2.1.exeC:\Users\admin\AppData\Local\Temp\3HEUHBOWRGVP57YIVYDOLVPF2C9A1EXC..EXEexecutable
MD5:A2B44B1D7C14C6BF93F23015263B5477
SHA256:C169B8B204882E6E2A6533AAE7F4A27D06A715DA30A3975090BA9913F5454BFB
3824PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXEC:\Users\admin\AppData\Roaming\SQLi Dumper 9.2.1..exeexecutable
MD5:654F260F4208006619B0B5F55D5E51C1
SHA256:E62C2B41AEAC0118A1603537A29333B1DEA23945133F1E72D8F19D334C81F1FB
2124SQLi Dumper 9.2.1.exeC:\Users\admin\AppData\Local\Temp\PBPJGFE4WUAQOFPWDCV8FBFPEF4FSWLN..EXEexecutable
MD5:10097327DE40E8840749150C239D68F0
SHA256:0CF7D3B5876090E591D14C0F26AA8124931D898D5BED72FC2274326F3765EFF7
800SQLi Dumper 9.2.1..exeC:\Program Files\v\v.exeexecutable
MD5:654F260F4208006619B0B5F55D5E51C1
SHA256:E62C2B41AEAC0118A1603537A29333B1DEA23945133F1E72D8F19D334C81F1FB
3936v.exeC:\Users\admin\AppData\Roaming\c.exe.configxml
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98
SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839
800SQLi Dumper 9.2.1..exeC:\Windows\system32\WindowsInput.exeexecutable
MD5:E6FCF516D8ED8D0D4427F86E08D0D435
SHA256:8DBE814359391ED6B0B5B182039008CF1D00964DA9FBC4747F46242A95C24337
2900WindowsInput.exeC:\Windows\system32\WindowsInput.InstallStatexml
MD5:FFB29BD88BD23C639985F1D369DBD1CA
SHA256:1ADB4F9D1D152E018246A0A2762B473D910906340207F57D3F8CE1097E1DE09F
3936v.exeC:\Users\admin\AppData\Roaming\c.exeexecutable
MD5:913967B216326E36A08010FB70F9DBA3
SHA256:8D880758549220154D2FF4EE578F2B49527C5FB76A07D55237B61E30BCC09E3A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1872
SQLi Dumper 9.2.1...exe
GET
200
185.194.141.58:80
http://ip-api.com/json/
DE
text
260 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1872
SQLi Dumper 9.2.1...exe
185.194.141.58:80
ip-api.com
netcup GmbH
DE
unknown
3936
v.exe
182.237.185.73:1090
port1.gleeze.com
Fivenetwork Solution India Pvt Ltd Internet
IN
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 185.194.141.58
shared
port1.gleeze.com
  • 182.237.185.73
malicious

Threats

PID
Process
Class
Message
1872
SQLi Dumper 9.2.1...exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1872
SQLi Dumper 9.2.1...exe
A Network Trojan was detected
MALWARE [PTsecurity] Quasar 1.3 RAT IP Lookup ip-api.com (HTTP headeer)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SQLi Dumper 9.2.rar