analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Vidar Cracked by Skales007 [XakFor.Net].rar

Full analysis: https://app.any.run/tasks/95e920b3-7f54-46cf-b1d5-689c2ecbad4e
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 08:15:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
evasion
trojan
arkei
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

44BFA00E965CD475467AA2FE20CCD15E

SHA1:

F6D2B251202F23C967E513DF928C5AB084B34CBC

SHA256:

3A3765DC248D9B07B8090EDD5B6A67159B1D277B42BEBC58E1699FEAACE39A22

SSDEEP:

49152:zloY/Lx1TVScf/f5hMYqADqqIIkyRY8xQtOoqGgOqC:Px1Jbf/f5hvqOzadqGgOR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Vidar Cracked by Skales007 [XakFor.Net].exe (PID: 3388)
      • FTAQwgsut.exe (PID: 3484)

    • Stealing of credential data

      • FTAQwgsut.exe (PID: 3484)

    • ARKEI was detected

      • FTAQwgsut.exe (PID: 3484)

    • Actions looks like stealing of personal data

      • FTAQwgsut.exe (PID: 3484)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Vidar Cracked by Skales007 [XakFor.Net].exe (PID: 3388)

    • Creates files in the user directory

      • FTAQwgsut.exe (PID: 3484)

    • Creates files in the program directory

      • FTAQwgsut.exe (PID: 3484)

    • Loads DLL from Mozilla Firefox

      • FTAQwgsut.exe (PID: 3484)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3712)

    • Checks for external IP

      • FTAQwgsut.exe (PID: 3484)

    • Starts CMD.EXE for commands execution

      • FTAQwgsut.exe (PID: 3484)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs vidar cracked by skales007 [xakfor.net].exe #ARKEI ftaqwgsut.exe cmd.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2960"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Vidar Cracked by Skales007 [XakFor.Net].rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3388"C:\Users\admin\Desktop\Vidar Cracked by Skales007 [XakFor.Net].exe" C:\Users\admin\Desktop\Vidar Cracked by Skales007 [XakFor.Net].exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Vidar Cracked by Skales007
Version:
1.0.0.0
3484"C:\Users\admin\Desktop\FTAQwgsut.exe" C:\Users\admin\Desktop\FTAQwgsut.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3712"C:\Windows\System32\cmd.exe" /c taskkill /im FTAQwgsut.exe /f & erase C:\Users\admin\Desktop\FTAQwgsut.exe & exitC:\Windows\System32\cmd.exe—FTAQwgsut.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2780taskkill /im FTAQwgsut.exe /f C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
935
Read events
867
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
2960WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2960.18137\Vidar Cracked by Skales007 [XakFor.Net].exe —
MD5:—
SHA256:—
3388Vidar Cracked by Skales007 [XakFor.Net].exeC:\Users\admin\Desktop\stub.bin —
MD5:—
SHA256:—
3388Vidar Cracked by Skales007 [XakFor.Net].exeC:\Users\admin\Desktop\RCX2767.tmp —
MD5:—
SHA256:—
3484FTAQwgsut.exeC:\ProgramData\U64W5IL6NPV57HPY07YB\files\information.txt —
MD5:—
SHA256:—
3484FTAQwgsut.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\line[1].txttext
MD5:44594E9274D4A367C71B4DB62293F4BD
SHA256:5444DE6DBFD6B40662839BCEAB74E0009B3575B8BBC06E93E209EABB8A3AD956
3484FTAQwgsut.exeC:\ProgramData\U64W5IL6NPV57HPY07YB\SE_90059c37-1320-41a4-b58d-2b75a9850d2f5118933904.zipcompressed
MD5:FCEADA60A3E0B13B65D706C360FEABA3
SHA256:7F1C7D606DE7B517B45760550294A01F79C56D0A97A3C531C4569804308E20D3
3484FTAQwgsut.exeC:\ProgramData\U64W5IL6NPV57HPY07YB\ldsqlite
MD5:01A1EE033F117197D52DC1CA978AD16B
SHA256:6D4BABAEBEA2F5450BD4BBE07E43C7E84A67E78F8B508CF2731A45A1EC5F9E2E
3388Vidar Cracked by Skales007 [XakFor.Net].exeC:\Users\admin\Desktop\FTAQwgsut.exeexecutable
MD5:DD424B5873BEB3FCD7298E2ED4EA2652
SHA256:C38D20D60494859DA3C5351C0FAE6E6E9E7B875DBF647F369E6FD127714413C9
3484FTAQwgsut.exeC:\ProgramData\U64W5IL6NPV57HPY07YB\files\passwords.txttext
MD5:0ED84EDA88A19802AF9C9D6670349475
SHA256:1F367E81EF2666C51E1BA310CEC9015187150DF1BAAD543E252DA9717DD7FB0A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3484
FTAQwgsut.exe
POST
200
185.194.141.58:80
http://ip-api.com/line/
DE
text
132 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3484
FTAQwgsut.exe
185.194.141.58:80
ip-api.com
netcup GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 185.194.141.58
shared

Threats

PID
Process
Class
Message
3484
FTAQwgsut.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3484
FTAQwgsut.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.PWS.Stealer.23869 (Arkei)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Vidar Cracked by Skales007 [XakFor.Net].rar