download:

B3RAP.zip

Full analysis: https://app.any.run/tasks/88ccf3d2-8ccb-4615-ab80-99818779ac2d
Verdict: Malicious activity
Analysis date: May 30, 2020, 18:59:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

7FADAF427F7F72ECFB3093EEFAF40A13

SHA1:

23D20CBFC5EDCA9B5CE7139FA63175E9044969E3

SHA256:

25ADF33587BC37C607B4D2E1E6B25EC7E7B8CAF5E9721FE461BAAADB1B204FFD

SSDEEP:

49152:jCURXAc87XiI/niK6A/nCUziwveDU35l1wIrLnP6Vc8r/xMSRVfynF1gRkza:jhR2jv/iyRziQUUbnP6VjrtVfy/Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • B3RAP Leecher.exe (PID: 2944)
      • B3RAP Leecher.exe (PID: 272)

    • Loads dropped or rewritten executable

      • B3RAP Leecher.exe (PID: 272)

    • Changes settings of System certificates

      • B3RAP Leecher.exe (PID: 272)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • B3RAP Leecher.exe (PID: 272)
      • WinRAR.exe (PID: 2320)

    • Creates files in the user directory

      • B3RAP Leecher.exe (PID: 272)

    • Adds / modifies Windows certificates

      • B3RAP Leecher.exe (PID: 272)

  • INFO

    • Reads settings of System Certificates

      • B3RAP Leecher.exe (PID: 272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:07:03 18:06:15
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: B3RAP Leecher v0.4.1/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe b3rap leecher.exe no specs b3rap leecher.exe

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Temp\Rar$EXa2320.49733\B3RAP Leecher v0.4.1\B3RAP Leecher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2320.49733\B3RAP Leecher v0.4.1\B3RAP Leecher.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
B3RAP Leecher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2320.49733\b3rap leecher v0.4.1\b3rap leecher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2320"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\B3RAP.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2944"C:\Users\admin\AppData\Local\Temp\Rar$EXa2320.49733\B3RAP Leecher v0.4.1\B3RAP Leecher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2320.49733\B3RAP Leecher v0.4.1\B3RAP Leecher.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
B3RAP Leecher
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2320.49733\b3rap leecher v0.4.1\b3rap leecher.exe
c:\systemroot\system32\ntdll.dll
Total events
1 672
Read events
461
Write events
1 211
Delete events
0

Modification events

(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2320) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2320) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\B3RAP.zip
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2320) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
11
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2320WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2320.49733\B3RAP Leecher v0.4.1\B3RAP Leecher.exeexecutable
MD5:—
SHA256:—
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\CONFIG\LeakMania-NL.ovpntext
MD5:—
SHA256:—
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\openvpn.exeexecutable
MD5:5E6A11E18F115E0DAFEF5069118AA676
SHA256:1C95AE4D20549E9AF22922D1679C6E047DDB21C5E9AC90EF1C58536A45FEBCF2
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\libpkcs11-helper-1.dllexecutable
MD5:2FEF81541C63C74808577183CD027A0E
SHA256:8AC11C4FF07323E985D08401945476FEEEAB92848705EF61970ACEFB24FBC5AB
2320WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2320.49733\B3RAP Leecher v0.4.1\Leaf.xNet.dllexecutable
MD5:B5CB88DE9FE40B6645496F9543CE8E26
SHA256:A91293829D0A4A0F2F34787FC1BA13B9D3AA4F640D0FCA652B24A88F464BC343
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\liblzo2-2.dllexecutable
MD5:46BE4D605BDB49DFC5BAF15E67BF12C2
SHA256:3D3E4939A84FBCEA9A29A1A8C9A4AD1FCD9B85BB3A38010E19D1205FFF5D9F58
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\openssl.exeexecutable
MD5:064F4449B6F4BD6D99B72368FF42014C
SHA256:F8E6C68DF295B62522B2F2CB0B633C9CBFE093B3968B03B23C67BB4866139E7A
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\openvpnserv2.exeexecutable
MD5:861D9AFE99DCFBDEF816ECF59D0266C0
SHA256:E9D7E26DC91C06D50D13071CD85AC922FB3438E57796B18B467A629A1BE75320
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\tap-windows.exeexecutable
MD5:47FA5F0670CF191D066E5DFBF4F4EE70
SHA256:645BEE92BA4E9F32DDFDD9F8519DC1B9F9FF0B0A8E87E342F08D39DA77E499A9
272B3RAP Leecher.exeC:\Users\admin\AppData\Roaming\LeakManiaVPN\OpenVPN\openvpnserv.exeexecutable
MD5:275426EEB679572374B8C69D14CFFA11
SHA256:C701F1404722D339952488479B81A2DAE71DF2F72100D242D781630921B83B1F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
71
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
272
B3RAP Leecher.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
272
B3RAP Leecher.exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
272
B3RAP Leecher.exe
172.67.213.196:443
paste2.org
—
US
unknown
272
B3RAP Leecher.exe
172.67.219.133:443
paste.ee
—
US
malicious
—
—
172.67.213.196:443
paste2.org
—
US
unknown
—
—
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
whitelisted
pastebin.com
  • 104.23.99.190
malicious
paste2.org
  • 172.67.213.196
whitelisted
paste.ee
  • 172.67.219.133
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
B3RAP.zip