download: | master.zip |
Full analysis: | https://app.any.run/tasks/b8533e7f-cffe-4722-b8c6-a82e8604c726 |
Verdict: | Malicious activity |
Analysis date: | August 18, 2019, 03:00:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 212F8FADBDC6D83043469D74A2C7EDB7 |
SHA1: | 1D78CEF6EE2D806B7BF647D052591CA9038C2204 |
SHA256: | 4391A8B7DABB7E26B6C7547C84A8EEDCBBDBEC52F48BEDCC48188EECC6BBAA54 |
SSDEEP: | 98304:9lxZvEiEBpXqjJKWJruGgXPusgrZm6YIkIKEoM/EDMZuIKaCji0BFz60W3rQyUV/:JZBErXqj/Jr1MGs2mDRIpSIKaKBRq3r2 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 10 |
---|---|
ZipBitFlag: | - |
ZipCompression: | None |
ZipModifyDate: | 2019:08:13 23:24:11 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | - |
ZipUncompressedSize: | - |
ZipFileName: | Flysoft-Virus-master/ |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3700 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\master.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2904 | "C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe" | C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe | — | explorer.exe |
User: admin Company: Flysoft Integrity Level: MEDIUM Description: Flysoft Virus Exit code: 0 | ||||
3056 | "C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe" -el -s2 "-dC:\Program Files\Flysoft_Virus" "-sp" | C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe | Flysoft Virus.exe | |
User: admin Company: Flysoft Integrity Level: HIGH Description: Flysoft Virus Exit code: 0 | ||||
2620 | "C:\Program Files\Flysoft_Virus\Flysoft_Virus.exe" | C:\Program Files\Flysoft_Virus\Flysoft_Virus.exe | — | Flysoft Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: Flysoft Virus 主程序 Exit code: 1073807364 | ||||
2876 | "C:\Program Files\Flysoft_Virus\MBR.exe" | C:\Program Files\Flysoft_Virus\MBR.exe | Flysoft_Virus.exe | |
User: admin Company: Flysoft Integrity Level: HIGH Description: MBR损坏程序(慎用) Exit code: 0 | ||||
3192 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 Exit code: 1073807364 | ||||
3068 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 Exit code: 1073807364 | ||||
316 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 Exit code: 1073807364 | ||||
3340 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 Exit code: 1073807364 | ||||
912 | "C:\Program Files\Flysoft_Virus\Access Denied.exe" | C:\Program Files\Flysoft_Virus\Access Denied.exe | — | Flysoft_Virus.exe |
User: admin Company: Flysoft Integrity Level: HIGH Description: 拒绝访问对话框 Exit code: 1073807364 |
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\master.zip | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
(PID) Process: | (3700) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3700 | WinRAR.exe | C:\Users\admin\Desktop\Flysoft-Virus-master\Flysoft Virus.exe | executable | |
MD5:AD84ADBF28BDDB217A61C3F76B239A6F | SHA256:F89943AB12C4B052CFE3E6B11C320EE451103E10DD565DA548F0AC3AC668C4B2 | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\Access Denied.exe | executable | |
MD5:F716F75952AA54A379CB84E55E4EFC02 | SHA256:477437F1F7999A2FDBDC1741090A38F6CF8CAECDD596A0E7CDF36924245E3760 | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\System.Web.Services.dll | executable | |
MD5:FDD0D8C334EB4ECDECB7D574AE1677E9 | SHA256:B6F47E78B1624005C066A5F75A079B89C3D50EAC05C850B63BB73F8013F750A7 | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\Ctrl.exe | executable | |
MD5:E68A768041602386A6CEC90CCD27C75A | SHA256:CB5AFEF5308776CD1167F20128739FCDC2265A40278F4BF1FB53FFC8EBBF5F0F | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\Flysoft_Virus.exe | executable | |
MD5:33C240016514D447D084E2D736E67B9F | SHA256:F464F4D8098422A0EC62A907A8F8B19F6B0DA803553775ABCC41A158AA18C66D | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\Suidao.exe | executable | |
MD5:54BFD643DBEA9C973ECFADF900C321F7 | SHA256:AE55E46E5BFD78A6C067E91F0561CF4468D914CFFACACB4379236C24E97BEADF | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\System.Xml.Linq.dll | executable | |
MD5:3BBF55FD4E3A920D95C4FC44423E728A | SHA256:D10F1B8EAAAAFF0C6B23605603597D7FF43D7043FA9058E789F8442F2982AD1A | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\MBR.exe | executable | |
MD5:EB1979EE21A690BEE857F60F9ACE026C | SHA256:DF6AB2AC2A8A8AFD421B6EE304D9359CCD4D7209099233DCA270258095959EFB | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\Color.exe | executable | |
MD5:10C1700F37EA2B7F9EA90231CE506E27 | SHA256:5A0D6B03FE8190BFF9998C0ED1514C41BBFA960F92502F62F717368FB3D4C25C | |||
3056 | Flysoft Virus.exe | C:\Program Files\Flysoft_Virus\Error.exe | executable | |
MD5:7B4841EA33E30DB273705EF9A4AE13C3 | SHA256:54FA048A9ABCE6E56DE98054A16DAE01D3EBAC87C9B8B699EE1F6D2DE2B2E4BB |