download: | master.zip |
Full analysis: | https://app.any.run/tasks/7377fe1d-6a1b-4c66-81a9-086072d2ec5e |
Verdict: | Malicious activity |
Analysis date: | August 18, 2019, 03:05:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 212F8FADBDC6D83043469D74A2C7EDB7 |
SHA1: | 1D78CEF6EE2D806B7BF647D052591CA9038C2204 |
SHA256: | 4391A8B7DABB7E26B6C7547C84A8EEDCBBDBEC52F48BEDCC48188EECC6BBAA54 |
SSDEEP: | 98304:9lxZvEiEBpXqjJKWJruGgXPusgrZm6YIkIKEoM/EDMZuIKaCji0BFz60W3rQyUV/:JZBErXqj/Jr1MGs2mDRIpSIKaKBRq3r2 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 10 |
---|---|
ZipBitFlag: | - |
ZipCompression: | None |
ZipModifyDate: | 2019:08:13 23:24:11 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | - |
ZipUncompressedSize: | - |
ZipFileName: | Flysoft-Virus-master/ |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3012 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\master.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
684 | "C:\Users\admin\Desktop\Flysoft-Virus-master\Code.exe" | C:\Users\admin\Desktop\Flysoft-Virus-master\Code.exe | — | explorer.exe |
User: admin Company: Flysoft Integrity Level: MEDIUM Description: Flysoft 代码加载器 Exit code: 0 | ||||
3164 | "C:\Users\admin\Desktop\Flysoft-Virus-master\Code.exe" -el -s2 "-dC:\Program Files\Code\Flysoft-Virus" "-sp" | C:\Users\admin\Desktop\Flysoft-Virus-master\Code.exe | Code.exe | |
User: admin Company: Flysoft Integrity Level: HIGH Description: Flysoft 代码加载器 Exit code: 0 | ||||
3156 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Program Files\Code\Flysoft-Virus\病毒.sln | C:\Windows\system32\rundll32.exe | — | Code.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1524 | "C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe" | C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe | — | explorer.exe |
User: admin Company: Flysoft Integrity Level: MEDIUM Description: Flysoft Virus Exit code: 0 | ||||
2436 | "C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe" -el -s2 "-dC:\Program Files\Flysoft_Virus" "-sp" | C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe | Flysoft Virus.exe | |
User: admin Company: Flysoft Integrity Level: HIGH Description: Flysoft Virus Exit code: 0 | ||||
2132 | "C:\Program Files\Flysoft_Virus\Flysoft_Virus.exe" | C:\Program Files\Flysoft_Virus\Flysoft_Virus.exe | — | Flysoft Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: Flysoft Virus 主程序 | ||||
3640 | "C:\Program Files\Flysoft_Virus\MBR.exe" | C:\Program Files\Flysoft_Virus\MBR.exe | Flysoft_Virus.exe | |
User: admin Company: Flysoft Integrity Level: HIGH Description: MBR损坏程序(慎用) Exit code: 0 | ||||
3872 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 | ||||
3824 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\Flysoft_Virus.exe | executable | |
MD5:33C240016514D447D084E2D736E67B9F | SHA256:F464F4D8098422A0EC62A907A8F8B19F6B0DA803553775ABCC41A158AA18C66D | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒.sln | text | |
MD5:2DECD0DB8B597E9FCFB68F0330EF14A9 | SHA256:4970172259479C173874DBB4B5940AB7109A2A8B55D1FB7AF32D8786413DF158 | |||
3012 | WinRAR.exe | C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe | executable | |
MD5:AD84ADBF28BDDB217A61C3F76B239A6F | SHA256:F89943AB12C4B052CFE3E6B11C320EE451103E10DD565DA548F0AC3AC668C4B2 | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\System.Web.Services.dll | executable | |
MD5:FDD0D8C334EB4ECDECB7D574AE1677E9 | SHA256:B6F47E78B1624005C066A5F75A079B89C3D50EAC05C850B63BB73F8013F750A7 | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\Suidao.exe | executable | |
MD5:54BFD643DBEA9C973ECFADF900C321F7 | SHA256:AE55E46E5BFD78A6C067E91F0561CF4468D914CFFACACB4379236C24E97BEADF | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\Color.exe | executable | |
MD5:10C1700F37EA2B7F9EA90231CE506E27 | SHA256:5A0D6B03FE8190BFF9998C0ED1514C41BBFA960F92502F62F717368FB3D4C25C | |||
3012 | WinRAR.exe | C:\Users\admin\Desktop\Flysoft-Virus-master\Code.exe | executable | |
MD5:B96E05DFA74D15F9816957A1915BB55A | SHA256:12AF482208F67A44953C1119697D0C37A93FDB8909699DA000EBB20CC2A65006 | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\Access Denied.exe | executable | |
MD5:F716F75952AA54A379CB84E55E4EFC02 | SHA256:477437F1F7999A2FDBDC1741090A38F6CF8CAECDD596A0E7CDF36924245E3760 | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\MBR.exe | executable | |
MD5:EB1979EE21A690BEE857F60F9ACE026C | SHA256:DF6AB2AC2A8A8AFD421B6EE304D9359CCD4D7209099233DCA270258095959EFB | |||
3164 | Code.exe | C:\Program Files\Code\Flysoft-Virus\病毒\bin\Debug\Error.exe | executable | |
MD5:7B4841EA33E30DB273705EF9A4AE13C3 | SHA256:54FA048A9ABCE6E56DE98054A16DAE01D3EBAC87C9B8B699EE1F6D2DE2B2E4BB |