| File name: | Robux Generator.rar |
| Full analysis: | https://app.any.run/tasks/e001e46b-e4b5-4a71-8979-f01bfee4c893 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | February 21, 2020, 20:44:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | FF7DFBCE55950618E307EAEA0D48B12A |
| SHA1: | 2639DC154040C6C68187574EBB0CD225E6C83966 |
| SHA256: | 44F05724DBED0FB9BBD7661A8B98CBEEAF65528525D7602CB0EAF46F8E3A5EE1 |
| SSDEEP: | 6144:oMEoMPGSFp8cQT35gTEjdaZhbA5pELVNMb+QEppHTCy8xvlvuJxYMhTgBqhz:hEDPGSFpSTuTEjdAXLPMb+Q6tp8dlmJb |
MALICIOUS
Actions looks like stealing of personal data
- Shell.exe (PID: 392)
- Shell.exe (PID: 2572)
- Shell.exe (PID: 272)
Application was dropped or rewritten from another process
- Shell.exe (PID: 392)
- Robux Generator.exe (PID: 620)
- Robux Generator.exe (PID: 3596)
- Shell.exe (PID: 2572)
- Robux Generator.exe (PID: 2236)
- Shell.exe (PID: 272)
Loads dropped or rewritten executable
- Robux Generator.exe (PID: 620)
- Robux Generator.exe (PID: 3596)
- Robux Generator.exe (PID: 2236)
Runs app for hidden code execution
- Robux Generator.exe (PID: 620)
- Robux Generator.exe (PID: 3596)
- Robux Generator.exe (PID: 2236)
Uses NirSoft utilities to collect credentials
- Shell.exe (PID: 392)
- Shell.exe (PID: 2572)
- Shell.exe (PID: 272)
Stealing of credential data
- Shell.exe (PID: 392)
- WinRAR.exe (PID: 3052)
- Shell.exe (PID: 2572)
- Shell.exe (PID: 272)
SUSPICIOUS
Executable content was dropped or overwritten
- Robux Generator.exe (PID: 620)
- WinRAR.exe (PID: 3052)
- Robux Generator.exe (PID: 3596)
- Robux Generator.exe (PID: 2236)
Starts CMD.EXE for commands execution
- Robux Generator.exe (PID: 620)
- Robux Generator.exe (PID: 3596)
- Robux Generator.exe (PID: 2236)
Loads DLL from Mozilla Firefox
- Shell.exe (PID: 392)
- Shell.exe (PID: 2572)
- Shell.exe (PID: 272)
Connects to SMTP port
- Robux Generator.exe (PID: 3596)
- Robux Generator.exe (PID: 2236)
INFO
Reads settings of System Certificates
- Robux Generator.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
54
Monitored processes
12
Malicious processes
10
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 272 | Shell.exe /stext Engine.mxl | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.41070\Robux Generator\Shell.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 392 | Shell.exe /stext Engine.mxl | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\Shell.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 540 | "cmd.exe" | C:\Windows\system32\cmd.exe | — | Robux Generator.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 620 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\Robux Generator.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\Robux Generator.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Robux Generator Exit code: 3762504530 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2104 | "cmd.exe" | C:\Windows\system32\cmd.exe | — | Robux Generator.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2236 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.41070\Robux Generator\Robux Generator.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.41070\Robux Generator\Robux Generator.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Robux Generator Exit code: 3762504530 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2572 | Shell.exe /stext Engine.mxl | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.40398\Robux Generator\Shell.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3004 | "cmd.exe" | C:\Windows\system32\cmd.exe | — | Robux Generator.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3052 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Robux Generator.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3180 | "cmd.exe" | C:\Windows\system32\cmd.exe | — | Robux Generator.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
742
Read events
674
Write events
68
Delete events
0
Modification events
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Robux Generator.rar | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3052) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
14
Suspicious files
4
Text files
8
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\__rar_3052.39514 | — | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\__rar_3052.39735 | — | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\Robux Generator.exe | executable | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\README.txt | text | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\Shell.exe | executable | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Robux Generator.rar | compressed | |
MD5:— | SHA256:— | |||
| 620 | Robux Generator.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.38189\Robux Generator\Shell.Data | executable | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Robux Generator.bak3052.39515 | compressed | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3052.40398\Robux Generator\README.txt | text | |
MD5:— | SHA256:— | |||
| 3052 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Robux Generator.bak3052.39740 | compressed | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
3
Threats
2
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3596 | Robux Generator.exe | 104.23.98.190:443 | pastebin.com | Cloudflare Inc | US | malicious |
3596 | Robux Generator.exe | 64.233.167.109:587 | smtp.gmail.com | Google Inc. | US | whitelisted |
2236 | Robux Generator.exe | 104.23.99.190:443 | pastebin.com | Cloudflare Inc | US | malicious |
2236 | Robux Generator.exe | 64.233.167.109:587 | smtp.gmail.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
pastebin.com |
| malicious |
smtp.gmail.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3596 | Robux Generator.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2236 | Robux Generator.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |