analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

TRANSF_EXT.uue

Full analysis: https://app.any.run/tasks/04039b4d-3530-4127-b242-90a9471d1c2b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 07:20:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

3F239F87EA538756B045FBC9471ACAB7

SHA1:

4317336BAB591C1CBC93941F5C03970CA12980FC

SHA256:

27F77E414A9BF2525D5F58F913FEA54F6E236E01B01E302CE67A44D3EC17245D

SSDEEP:

12288:+mY7p/2fM40pgbJrVa7DgTu8ROC3Li10WWfDF+48+FADF:RY1ef8ObJrVaITTROCbwE78rDF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TRANSF_EXT.exe (PID: 2620)
      • TRANSF_EXT.exe (PID: 488)
      • TRANSF_EXT.exe (PID: 1668)

    • NanoCore was detected

      • TRANSF_EXT.exe (PID: 488)

    • Writes to a start menu file

      • TRANSF_EXT.exe (PID: 2620)

    • Connects to CnC server

      • TRANSF_EXT.exe (PID: 488)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3092)

  • SUSPICIOUS

    • Creates files in the user directory

      • TRANSF_EXT.exe (PID: 2620)
      • TRANSF_EXT.exe (PID: 488)

    • Application launched itself

      • TRANSF_EXT.exe (PID: 2620)

    • Executes scripts

      • TRANSF_EXT.exe (PID: 488)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 1000)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 467001
UncompressedSize: 1227776
OperatingSystem: Win32
ModifyDate: 2019:04:24 09:38:25
PackingMethod: Normal
ArchivedFileName: TRANSF_EXT.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs transf_ext.exe taskmgr.exe no specs #NANOCORE transf_ext.exe transf_ext.exe no specs vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TRANSF_EXT.uue.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2620"C:\Users\admin\Desktop\TRANSF_EXT.exe" C:\Users\admin\Desktop\TRANSF_EXT.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2432"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
488"C:\Users\admin\Desktop\TRANSF_EXT.exe" C:\Users\admin\Desktop\TRANSF_EXT.exe
TRANSF_EXT.exe
User:
admin
Integrity Level:
MEDIUM
1668"C:\Users\admin\Desktop\TRANSF_EXT.exe" 2 488 1157468C:\Users\admin\Desktop\TRANSF_EXT.exe—TRANSF_EXT.exe
User:
admin
Integrity Level:
MEDIUM
3092"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\in2a3usx.c1j"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
TRANSF_EXT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
1000"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\ekglncc5.ppl"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe—TRANSF_EXT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Total events
495
Read events
474
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.33307\TRANSF_EXT.exe —
MD5:—
SHA256:—
3092vbc.exeC:\Users\admin\AppData\Local\Temp\in2a3usx.c1j —
MD5:—
SHA256:—
1000vbc.exeC:\Users\admin\AppData\Local\Temp\ekglncc5.ppl —
MD5:—
SHA256:—
488TRANSF_EXT.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:76843D794FC015CFA4273EAA0303F318
SHA256:64D04E66A674B4119D94764900621DA38DACA954E95347522078F33A083B686D
2620TRANSF_EXT.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Host Process for Windows Tasks .vbstext
MD5:B1E9566C4C0A6EBF3C0FE2BF88A9B899
SHA256:764016D3E08247750608489E15CCFD1A41E8BB8B7D8CD73B3A5DFF3BF720694B
488TRANSF_EXT.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
488TRANSF_EXT.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:963D5E2C9C0008DFF05518B47C367A7F
SHA256:5EACF2974C9BB2C2E24CDC651C4840DD6F4B76A98F0E85E90279F1DBB2E6F3C0
488TRANSF_EXT.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
488
TRANSF_EXT.exe
191.101.151.15:1990
—
Xtudio Networks S.L.U
ES
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
488
TRANSF_EXT.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
488
TRANSF_EXT.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
488
TRANSF_EXT.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
488
TRANSF_EXT.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
488
TRANSF_EXT.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
TRANSF_EXT.uue