File name:

Antidetect 8.01.36 CRACKED [Z3ROZ] (1).rar

Full analysis: https://app.any.run/tasks/a6e23e45-d396-4f31-a299-526100752693
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: August 12, 2020, 18:13:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
stealer
avemaria
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

695B5D6EE1F194D0B5130D41C7BCA22E

SHA1:

3C1B88BFCD951D8AA7C04C9540C5975DB87004D6

SHA256:

4EEBD67E3DE4411E67706B9C6CFA06F6A3479A505342B14199E04AF94D1A5303

SSDEEP:

196608:geUKgsDtnYohRy3QATAx+Oxm+rtHlqL1zPps1gyC5mrENBikDyEZ:cKgSh43QAsVs+rtFqpPW1gLmHMyQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • tmp.exe (PID: 1736)
      • explorer.exe (PID: 1840)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 2632)

    • AVEMARIA was detected

      • tmp.exe (PID: 1736)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 2632)
      • explorer.exe (PID: 1840)

    • Changes the autorun value in the registry

      • tmp.exe (PID: 1736)

    • Application was dropped or rewritten from another process

      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)
      • SkyFender.exe (PID: 3424)
      • explorer.exe (PID: 1840)
      • SkyFender.exe (PID: 4068)
      • SkyFender.exe (PID: 3880)
      • SkyFender.exe (PID: 3768)
      • SkyFender.exe (PID: 2248)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 2388)
      • SkyFender.exe (PID: 2872)
      • SkyFender.exe (PID: 2632)
      • SkyFender.exe (PID: 2244)
      • tmp.exe (PID: 1736)

    • Loads dropped or rewritten executable

      • dism.exe (PID: 3580)
      • dism.exe (PID: 2704)
      • dism.exe (PID: 3732)
      • dism.exe (PID: 3828)
      • dism.exe (PID: 2744)
      • dism.exe (PID: 3380)

    • Application was injected by another process

      • explorer.exe (PID: 352)

    • Runs injected code in another process

      • explorer.exe (PID: 1840)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3352)
      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)
      • tmp.exe (PID: 1736)
      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 2212)
      • cmd.exe (PID: 2612)
      • DllHost.exe (PID: 1824)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 2960)

    • Creates files in the user directory

      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)
      • tmp.exe (PID: 1736)
      • powershell.exe (PID: 3704)
      • powershell.exe (PID: 668)
      • powershell.exe (PID: 1820)
      • powershell.exe (PID: 3572)

    • Starts itself from another location

      • tmp.exe (PID: 1736)

    • Starts CMD.EXE for commands execution

      • tmp.exe (PID: 1736)
      • explorer.exe (PID: 1840)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 2632)

    • Creates executable files which already exist in Windows

      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)

    • Executed via COM

      • DllHost.exe (PID: 1824)

    • Executes PowerShell scripts

      • SkyFender.exe (PID: 3880)
      • SkyFender.exe (PID: 2248)
      • SkyFender.exe (PID: 2872)
      • SkyFender.exe (PID: 2388)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
47
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start inject winrar.exe antidetect 8.01.36 cracked by (z3roz).exe #AVEMARIA tmp.exe #AVEMARIA explorer.exe no specs cmd.exe #AVEMARIA skyfender.exe no specs cmd.exe explorer.exe cmd.exe Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe no specs pkgmgr.exe dism.exe no specs pkgmgr.exe skyfender.exe no specs dism.exe no specs skyfender.exe no specs powershell.exe no specs #AVEMARIA skyfender.exe no specs cmd.exe pkgmgr.exe no specs skyfender.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs powershell.exe no specs #AVEMARIA skyfender.exe no specs cmd.exe pkgmgr.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs #AVEMARIA skyfender.exe no specs powershell.exe no specs cmd.exe pkgmgr.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs powershell.exe no specs #AVEMARIA skyfender.exe no specs cmd.exe pkgmgr.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
464"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Package Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
668powershell Add-MpPreference -ExclusionPath C:\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—SkyFender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
780"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
SkyFender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
988"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
996"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Package Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1504"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
SkyFender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1736"C:\Users\admin\AppData\Roaming\tmp.exe" C:\Users\admin\AppData\Roaming\tmp.exe
Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\tmp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1772"C:\Users\admin\AppData\Roaming\SkyFender.exe"C:\Users\admin\AppData\Roaming\SkyFender.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\skyfender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1780"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
Total events
4 442
Read events
4 134
Write events
308
Delete events
0

Modification events

(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3352) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3352) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Antidetect 8.01.36 CRACKED [Z3ROZ] (1).rar
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
Executable files
16
Suspicious files
10
Text files
30
Unknown types
2

Dropped files

PID
Process
Filename
Type
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\browsers.txttext
MD5:99550869C563C7A99BB9D826F63FEA50
SHA256:D13321ADFD3B9558B825FEE29F13C0FB7AC326B2DF3CF36071612249C8F0071E
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\mms.cfgtext
MD5:5246A94C265991426A0B8F9425CBEA42
SHA256:2B5640814352DAD0B28FE962F1D4D4EFBDEB51EDA918AEEC8F1F3173F1145766
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\chrome_parameters.txttext
MD5:5FB9B885ED185A658B44300ECB22A30B
SHA256:9EE6DF8C3300C2E99DE1EA46300A4FE196CD4F2CFDB70364B8A095FCE0045B3E
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\ktlh_ff.dllexecutable
MD5:86722382CCAF8BA83238F59DCBC4FA73
SHA256:8A90B1D65A480D302D29BE52B74CC02871DCC60CD1BA6E9924DFF2A7491357A7
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\DeviceList-DiskDrive2.txttext
MD5:F2019FE9B931DEB8B420ABFB6F760B88
SHA256:9AC129595254F39A3C7552E04ABEA8C3C3B0C973AC102CFCBCCF021FB702059A
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\plugin.vchcat
MD5:DC2DC0FE686F18833D2EA8C053746A13
SHA256:B94EE6C591053EB42A2F6228ACA85B11901165BB0302B0367886FE00E20F205D
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\FlashPlayerPlugin_24_0_0_189.exeexecutable
MD5:B85FA92B2D9F27A629041BD511952ABF
SHA256:AFFE55B47C38325DD975B55C23687F1B0FAA1343D62393EE20F3C049F856FDD4
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\flashplayer.xptxpt
MD5:A81FD3B03B8C6D6E5A14298110718D3F
SHA256:946C2D7808B0F256E5F6B62655246DC9C247833FB2F578519E4354F91DEB6E1B
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\FlashUtil32_24_0_0_189_Plugin.exeexecutable
MD5:19AC5C0AC0021899A696EEC9CE1E60AC
SHA256:514491086F315111960819E7DE4E9EA853133700D2459F18C22567242A50F29C
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\macs.txttext
MD5:A94E2E8B8643EDB5601B26A98493FE6D
SHA256:48770AEA980C9CB5FCA7DD39BEC3B135B3FF1F8DB5690AE3F415C74F7A5A8AD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
u868328.nvpn.so
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Antidetect 8.01.36 CRACKED [Z3ROZ] (1).rar