File name:

psn- [Cracked By Badboy] - [C-Cracking.org].rar

Full analysis: https://app.any.run/tasks/b499746a-acc6-4f58-b1cc-6b337627de12
Verdict: Malicious activity
Analysis date: February 18, 2020, 10:48:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3C72A6F8F901DF3117ECCB6205B98FA5

SHA1:

E858CA9ACCAB2F058060E78E127B11F32B08A681

SHA256:

28B9620A26ECE61F942FFF1F42623A33B699008ACB547B99CB6596240DFAD960

SSDEEP:

393216:W2mKNSHTC6vX3u5EZ6eSbl2jXC3JKJEYthXQXfVPi4La:rmWP6/+WUe42jEJyEEhXwf2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • PlayStation Checker - [Cracked By Badboy].exe (PID: 2864)

    • Application was dropped or rewritten from another process

      • PlayStation Checker - [Cracked By Badboy].exe (PID: 2864)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1928)
      • PlayStation Checker - [Cracked By Badboy].exe (PID: 2864)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe playstation checker - [cracked by badboy].exe

Process information

PID
CMD
Path
Indicators
Parent process
1928"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\psn- [Cracked By Badboy] - [C-Cracking.org].rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
2864"C:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\PlayStation Checker - [Cracked By Badboy].exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\PlayStation Checker - [Cracked By Badboy].exe
WinRAR.exe
User:
admin
Company:
jokerTM
Integrity Level:
MEDIUM
Description:
PlayStation Checker by BLJ
Exit code:
0
Version:
4.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1928.41325\playstation checker - [cracked by badboy].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
481
Read events
455
Write events
26
Delete events
0

Modification events

(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1928) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\psn- [Cracked By Badboy] - [C-Cracking.org].rar
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1928) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
23
Suspicious files
8
Text files
43
Unknown types
1

Dropped files

PID
Process
Filename
Type
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\LastSession.xmlxml
MD5:—
SHA256:—
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\LOG.txttext
MD5:—
SHA256:—
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\PlayStation Checker - [Cracked By Badboy].exeexecutable
MD5:—
SHA256:—
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\Source\PlayStation Checker V4.2.0\PlayStation_Checker_by_Halo\ElementCollection.cstext
MD5:—
SHA256:—
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\Leaf.xNet.dllexecutable
MD5:ECCED64FE31AF5C957B14D964477D7CC
SHA256:25A6BCBFDAC13D3D423B7091E0DECD59E8C0833F1C73641E2B8BEC9196BBAED0
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\Source\PlayStation Checker V4.2.0\PlayStation_Checker_by_Halo\CommonHtmlElement.cstext
MD5:—
SHA256:—
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\Newtonsoft.Json.dllexecutable
MD5:4DF6C8781E70C3A4912B5BE796E6D337
SHA256:3598CCCAD5B535FEA6F93662107A4183BFD6167BF1D0F80260436093EDC2E3AF
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\System.Data.SQLite.dllexecutable
MD5:99DD5DE4174BF7FD09ED3AE2C21FE8E2
SHA256:A1FD117D427918D22DDE8FFDE74587F70ADB80C2FC072BC5EBF9E4C9B69F2933
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\System.Data.SQLite.EF6.dllexecutable
MD5:2E268316CD22B6C4CBB0C100BF33FAE5
SHA256:674264FB49BBDC6A4BF8AE0800A763FA69C88BD69331B3A914D6C8A2CADEA3A7
1928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\SkinSoft.VisualStyler.dllexecutable
MD5:D93366374B57B5A0FE3A1A8A1CA95F78
SHA256:14F231441DAD16EF046AB97415C33195056A61B0240D7D890971E5F626068925
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2864
PlayStation Checker - [Cracked By Badboy].exe
GET
404
195.201.88.195:80
http://masterproxy.salehsoftware.com/api/getproxy?apikey=70c3e54b69762cb06c42f3937494cf48&service=3&type=http
RU
text
19 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
195.201.88.195:80
masterproxy.salehsoftware.com
Awanti Ltd.
RU
unknown

DNS requests

Domain
IP
Reputation
masterproxy.salehsoftware.com
  • 195.201.88.195
unknown

Threats

No threats detected
Process
Message
PlayStation Checker - [Cracked By Badboy].exe
Native library pre-loader is trying to load native SQLite library "C:\Users\admin\AppData\Local\Temp\Rar$EXa1928.41325\x86\SQLite.Interop.dll"...
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
psn- [Cracked By Badboy] - [C-Cracking.org].rar