File name:

1.zip

Full analysis: https://app.any.run/tasks/e8150f58-e95a-47db-adb0-a1e6f1812b4a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 31, 2020, 08:09:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
miner
stealer
vidar
loader
qulab
masad
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E3F9C417C058B15D963D2400813554FA

SHA1:

A8C7F3B51DAD387A110A07D9D046EF969AD81212

SHA256:

2E95B77D0C6656423AD9B1C3FADFD37E8AB18098D8B6C34C3D5CF9081E65BDE4

SSDEEP:

98304:EwFRR1hLEs974t5hJLNryG6bj3bCEHloKfPXgwXz1HvyzapAshWNIY7VUfc:Eqs7hf+G6bj39znXgwXVyqAX2YSc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3548)
      • MyPhone(32bit).exe (PID: 3732)
      • MyPhone(32bit).exe (PID: 3036)
      • Oski.exe (PID: 2804)
      • mfc100fra.exe (PID: 3760)

    • Looks like application has launched a miner

      • ThePhone(32bit).exe (PID: 3316)

    • Application was dropped or rewritten from another process

      • Oski.exe (PID: 2804)
      • ThePhone(32bit).exe (PID: 3316)
      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 2168)
      • mfc100fra.exe (PID: 3376)
      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 680)
      • mfc100fra.exe (PID: 3760)
      • MyPhone(32bit).exe (PID: 3036)
      • MyPhone(32bit).exe (PID: 3732)

    • Loads the Task Scheduler COM API

      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 680)

    • Connects to CnC server

      • MyPhone(32bit).exe (PID: 3732)
      • MyPhone(32bit).exe (PID: 3036)

    • VIDAR was detected

      • Oski.exe (PID: 2804)

    • Downloads executable files from the Internet

      • Oski.exe (PID: 2804)

    • Downloads executable files from IP

      • Oski.exe (PID: 2804)

    • Stealing of credential data

      • Oski.exe (PID: 2804)
      • mfc100fra.exe (PID: 3760)

    • Actions looks like stealing of personal data

      • Oski.exe (PID: 2804)

    • Detected Qulab/Masad stealer

      • mfc100fra.exe (PID: 3760)

    • Changes settings of System certificates

      • mfc100fra.exe (PID: 3760)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1832)
      • ThePhone(32bit).exe (PID: 3316)
      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 2168)
      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 680)
      • Oski.exe (PID: 2804)
      • mfc100fra.exe (PID: 3760)

    • Application launched itself

      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 2168)

    • Creates files in the user directory

      • ThePhone(32bit).exe (PID: 3316)
      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 680)
      • mfc100fra.exe (PID: 3760)

    • Reads Internet Cache Settings

      • Oski.exe (PID: 2804)
      • mfc100fra.exe (PID: 3760)

    • Starts itself from another location

      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 680)

    • Creates files in the program directory

      • Oski.exe (PID: 2804)

    • Connects to unusual port

      • MyPhone(32bit).exe (PID: 3036)
      • MyPhone(32bit).exe (PID: 3732)

    • Connects to server without host name

      • Oski.exe (PID: 2804)

    • Reads the cookies of Google Chrome

      • mfc100fra.exe (PID: 3760)
      • Oski.exe (PID: 2804)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2740)

    • Reads the cookies of Mozilla Firefox

      • Oski.exe (PID: 2804)

    • Searches for installed software

      • Oski.exe (PID: 2804)

    • Starts CMD.EXE for commands execution

      • Oski.exe (PID: 2804)

    • Adds / modifies Windows certificates

      • mfc100fra.exe (PID: 3760)

  • INFO

    • Manual execution by user

      • [NEW] Netflix Premium Account Generator (2020).exe (PID: 2168)

    • Reads settings of System Certificates

      • mfc100fra.exe (PID: 3760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2015:06:13 02:48:09
ZipCRC: 0xb1c54cbb
ZipCompressedSize: 653953
ZipUncompressedSize: 1362432
ZipFileName: libeay32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
12
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe searchprotocolhost.exe no specs [new] netflix premium account generator (2020).exe #VIDAR oski.exe thephone(32bit).exe [new] netflix premium account generator (2020).exe myphone(32bit).exe myphone(32bit).exe mfc100fra.exe no specs #QULAB mfc100fra.exe cmd.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\Desktop\[NEW] Netflix Premium Account Generator (2020).exe" C:\Users\admin\Desktop\[NEW] Netflix Premium Account Generator (2020).exe
[NEW] Netflix Premium Account Generator (2020).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\[new] netflix premium account generator (2020).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1832"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2168"C:\Users\admin\Desktop\[NEW] Netflix Premium Account Generator (2020).exe" C:\Users\admin\Desktop\[NEW] Netflix Premium Account Generator (2020).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\[new] netflix premium account generator (2020).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2516taskkill /pid 2804 C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2740"C:\Windows\System32\cmd.exe" /c taskkill /pid 2804 & erase C:\Users\admin\AppData\Local\Temp\Oski.exe & RD /S /Q C:\\ProgramData\\963073789932511\\* & exitC:\Windows\System32\cmd.exe—Oski.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2804"C:\Users\admin\AppData\Local\Temp\Oski.exe" C:\Users\admin\AppData\Local\Temp\Oski.exe
[NEW] Netflix Premium Account Generator (2020).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\oski.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\netapi32.dll
3036 --scrypt -o stratum+tcp://us.litecoinpool.org:3333 -u hackore55.4 -p 4C:\Users\admin\AppData\Roaming\MyPhone\MyPhone(32bit).exe
ThePhone(32bit).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\myphone\myphone(32bit).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\myphone\opencl.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\appdata\roaming\myphone\libcurl-4.dll
3316"C:\Users\admin\AppData\Local\Temp\ThePhone(32bit).exe" C:\Users\admin\AppData\Local\Temp\ThePhone(32bit).exe
[NEW] Netflix Premium Account Generator (2020).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\thephone(32bit).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\roaming\myphone\myphone(32bit).exe
3376C:\Users\admin\AppData\Roaming\amd64_microsoft-windows-time-tool.resources\mfc100fra.exeC:\Users\admin\AppData\Roaming\amd64_microsoft-windows-time-tool.resources\mfc100fra.exe—[NEW] Netflix Premium Account Generator (2020).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\amd64_microsoft-windows-time-tool.resources\mfc100fra.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3548"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
3 954
Read events
979
Write events
1 993
Delete events
982

Modification events

(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1832) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\1.zip
(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2168) [NEW] Netflix Premium Account Generator (2020).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2168) [NEW] Netflix Premium Account Generator (2020).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
24
Suspicious files
1
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
1832WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1832.2115\ssleay32.dllexecutable
MD5:CF2C57DDA3766C204C398430DA23693D
SHA256:492F045643354C8B9FA11673B6C32CDBB33779826A729CE55DE5901279C1F6D5
1832WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1832.2115\[NEW] Netflix Premium Account Generator (2020).exeexecutable
MD5:D4D6D5704BC81449CAFA1619351C8DA9
SHA256:E6B3FB186D8C44BDBFE6F767900A7FDCAAD8AF1F6D2552AAAA1B0409A03F3203
3316ThePhone(32bit).exeC:\Users\admin\AppData\Roaming\MyPhone\zlib1.dllexecutable
MD5:15D6AF5C659FE2D9524DD9A90A674D02
SHA256:AAD5344650F7AB0A0A396F518F7EF827B8773748220D9E48D28FE4BC7888EB0C
680[NEW] Netflix Premium Account Generator (2020).exeC:\Users\admin\AppData\Roaming\amd64_microsoft-windows-time-tool.resources\ENU_6887FE9730D2535E9D41 —
MD5:—
SHA256:—
3316ThePhone(32bit).exeC:\Users\admin\AppData\Roaming\MyPhone\librtmp.dllexecutable
MD5:AB5E6208B97A40EC3FB76499ADF305D3
SHA256:B3F7A37CBE08687FA119A00A0F8366DB68F92BF5B04336F89618E9CC32D8D285
3316ThePhone(32bit).exeC:\Users\admin\AppData\Roaming\MyPhone\diakgcn121016.cltext
MD5:E316C3C6069AEC5DAF069CAB14D44F1C
SHA256:D1BC7A702C3D0A5D7A1FC34C2432F6E16C67A006F9BF9899BA063098CD533B55
3316ThePhone(32bit).exeC:\Users\admin\AppData\Roaming\MyPhone\libidn-11.dllexecutable
MD5:7C6F8DEE62B2E68938C5B65505248333
SHA256:49E4B17129D1586EB80F48523F274914AEE9D5DCFA39D9F832C1DDE0B380A836
3316ThePhone(32bit).exeC:\Users\admin\AppData\Roaming\MyPhone\libssh2.dllexecutable
MD5:8F0FC353DC7716A75272C002F17E367B
SHA256:7714F81F04FDBACC8CD226C70A0F7E0A903B12E163A05B1AB1D3C6BC6B9AE466
2168[NEW] Netflix Premium Account Generator (2020).exeC:\Users\admin\AppData\Local\Temp\Oski.exeexecutable
MD5:5EA936F671D360BBE5F29472DDC99681
SHA256:B0DA7822EC16F65B4EC1A8E3422270C8403B115B462D910C1FAE1395A55F6EAD
3316ThePhone(32bit).exeC:\Users\admin\AppData\Roaming\MyPhone\libcurl-4.dllexecutable
MD5:48131A7C1CD5BCE34DA3EDA489A81158
SHA256:A899458036E4CBF1B13F755FB1C65B6A63E537EE72AEFA569A9DEA590E8D3FF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
8
DNS requests
4
Threats
36

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/sqlite3.dll
RU
executable
630 Kb
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/freebl3.dll
RU
executable
326 Kb
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/
RU
—
—
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/mozglue.dll
RU
executable
133 Kb
malicious
2804
Oski.exe
POST
—
194.87.238.60:80
http://194.87.238.60/main.php
RU
—
—
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/main.php
RU
—
—
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/softokn3.dll
RU
executable
141 Kb
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/vcruntime140.dll
RU
executable
81.8 Kb
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/msvcp140.dll
RU
executable
429 Kb
malicious
2804
Oski.exe
POST
200
194.87.238.60:80
http://194.87.238.60/nss3.dll
RU
executable
1.19 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2804
Oski.exe
194.87.238.60:80
—
JSC Mediasoft ekspert
RU
malicious
3732
MyPhone(32bit).exe
158.69.196.61:3333
us.litecoinpool.org
OVH SAS
CA
malicious
3036
MyPhone(32bit).exe
104.236.57.24:3333
us.litecoinpool.org
Digital Ocean, Inc.
US
malicious
3760
mfc100fra.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger LLP
GB
malicious
3760
mfc100fra.exe
104.26.9.44:443
ipapi.co
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
us.litecoinpool.org
  • 158.69.196.61
  • 104.236.57.24
malicious
api.telegram.org
  • 149.154.167.220
shared
ipapi.co
  • 104.26.9.44
  • 104.26.8.44
shared

Threats

PID
Process
Class
Message
2804
Oski.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2804
Oski.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
2804
Oski.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2804
Oski.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2804
Oski.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
2804
Oski.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2804
Oski.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
2804
Oski.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2804
Oski.exe
A Network Trojan was detected
SUSPICIOUS [PTsecurity] Possible Generic.Trojan Boundary
2804
Oski.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
14 ETPRO signatures available at the full report
No debug info