File name:

Antidetect 8.01.36 CRACKED [Z3ROZ] (1).rar

Full analysis: https://app.any.run/tasks/a6e23e45-d396-4f31-a299-526100752693
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: August 12, 2020, 18:13:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
stealer
avemaria
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

695B5D6EE1F194D0B5130D41C7BCA22E

SHA1:

3C1B88BFCD951D8AA7C04C9540C5975DB87004D6

SHA256:

4EEBD67E3DE4411E67706B9C6CFA06F6A3479A505342B14199E04AF94D1A5303

SSDEEP:

196608:geUKgsDtnYohRy3QATAx+Oxm+rtHlqL1zPps1gyC5mrENBikDyEZ:cKgSh43QAsVs+rtFqpPW1gLmHMyQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • tmp.exe (PID: 1736)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 2632)
      • explorer.exe (PID: 1840)

    • Application was dropped or rewritten from another process

      • tmp.exe (PID: 1736)
      • explorer.exe (PID: 1840)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4068)
      • SkyFender.exe (PID: 3880)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 2248)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 3768)
      • SkyFender.exe (PID: 2872)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 2388)
      • SkyFender.exe (PID: 2632)
      • SkyFender.exe (PID: 2244)
      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)

    • AVEMARIA was detected

      • tmp.exe (PID: 1736)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 2632)
      • explorer.exe (PID: 1840)

    • Changes the autorun value in the registry

      • tmp.exe (PID: 1736)

    • Loads dropped or rewritten executable

      • dism.exe (PID: 3580)
      • dism.exe (PID: 2704)
      • dism.exe (PID: 3732)
      • dism.exe (PID: 3828)
      • dism.exe (PID: 2744)
      • dism.exe (PID: 3380)

    • Application was injected by another process

      • explorer.exe (PID: 352)

    • Runs injected code in another process

      • explorer.exe (PID: 1840)

  • SUSPICIOUS

    • Creates files in the user directory

      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)
      • tmp.exe (PID: 1736)
      • powershell.exe (PID: 668)
      • powershell.exe (PID: 3704)
      • powershell.exe (PID: 1820)
      • powershell.exe (PID: 3572)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3352)
      • cmd.exe (PID: 2212)
      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)
      • tmp.exe (PID: 1736)
      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 2612)
      • DllHost.exe (PID: 1824)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 2960)

    • Creates executable files which already exist in Windows

      • Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe (PID: 2824)

    • Starts CMD.EXE for commands execution

      • tmp.exe (PID: 1736)
      • SkyFender.exe (PID: 3424)
      • SkyFender.exe (PID: 4016)
      • SkyFender.exe (PID: 1772)
      • SkyFender.exe (PID: 2984)
      • SkyFender.exe (PID: 2632)
      • explorer.exe (PID: 1840)

    • Starts itself from another location

      • tmp.exe (PID: 1736)

    • Executes PowerShell scripts

      • SkyFender.exe (PID: 3880)
      • SkyFender.exe (PID: 2248)
      • SkyFender.exe (PID: 2872)
      • SkyFender.exe (PID: 2388)

    • Executed via COM

      • DllHost.exe (PID: 1824)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
47
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start inject winrar.exe antidetect 8.01.36 cracked by (z3roz).exe #AVEMARIA tmp.exe #AVEMARIA explorer.exe no specs cmd.exe #AVEMARIA skyfender.exe no specs cmd.exe explorer.exe cmd.exe Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe no specs pkgmgr.exe dism.exe no specs pkgmgr.exe skyfender.exe no specs dism.exe no specs skyfender.exe no specs powershell.exe no specs #AVEMARIA skyfender.exe no specs cmd.exe pkgmgr.exe no specs skyfender.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs powershell.exe no specs #AVEMARIA skyfender.exe no specs cmd.exe pkgmgr.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs #AVEMARIA skyfender.exe no specs powershell.exe no specs cmd.exe pkgmgr.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs powershell.exe no specs #AVEMARIA skyfender.exe no specs cmd.exe pkgmgr.exe no specs pkgmgr.exe dism.exe no specs skyfender.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
464"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Package Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
668powershell Add-MpPreference -ExclusionPath C:\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—SkyFender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
780"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
SkyFender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
988"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
996"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Package Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1504"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
SkyFender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1736"C:\Users\admin\AppData\Roaming\tmp.exe" C:\Users\admin\AppData\Roaming\tmp.exe
Antidetect 8.01.36 CRACKED BY (Z3ROZ).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\tmp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1772"C:\Users\admin\AppData\Roaming\SkyFender.exe"C:\Users\admin\AppData\Roaming\SkyFender.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\skyfender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1780"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
Total events
4 442
Read events
4 134
Write events
308
Delete events
0

Modification events

(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3352) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3352) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Antidetect 8.01.36 CRACKED [Z3ROZ] (1).rar
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
Executable files
16
Suspicious files
10
Text files
30
Unknown types
2

Dropped files

PID
Process
Filename
Type
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\browsers.txttext
MD5:99550869C563C7A99BB9D826F63FEA50
SHA256:D13321ADFD3B9558B825FEE29F13C0FB7AC326B2DF3CF36071612249C8F0071E
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\flashplayer.xptxpt
MD5:A81FD3B03B8C6D6E5A14298110718D3F
SHA256:946C2D7808B0F256E5F6B62655246DC9C247833FB2F578519E4354F91DEB6E1B
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\mms.cfgtext
MD5:5246A94C265991426A0B8F9425CBEA42
SHA256:2B5640814352DAD0B28FE962F1D4D4EFBDEB51EDA918AEEC8F1F3173F1145766
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\Fonts.initext
MD5:28CDE1DDC49D4E74C45E1D1B35256F39
SHA256:A4CBC68F5A9DC481A271054B9E7526816F2C5B73B2B7DC46DA0DCA979BCD8CBB
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\DeviceList-Monitors.txttext
MD5:044D85ABFF2615F9E5FAA0F8A9E2964B
SHA256:D4EC06204D6B817C5B63F2EFCAFA0CC5837AE7772946881179A32604BF41DBD5
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\fla\Flash-24.0.0.189\NPSWF32_24_0_0_189.dllexecutable
MD5:01AF2375AE1D0F1E3CC0A3AB7BF935B0
SHA256:99690DB7B65F70EC6EC413D237F99FBD476DE11F5D284764A5AFB09E72D3EFB8
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\usernames.txttext
MD5:BBBB7FE243F8EA240F5EFB196E87A290
SHA256:CD51BFBCB29724579B49210D9AD1F009F6EE2F108A9E37B01E62D002930E1B1E
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\DevicesList-Display.txttext
MD5:2F31D37A477D99A65E4D8C7C74ABE89B
SHA256:EC639F2B8FD13BC183B81BD37D8E063233303643F98EF406B11B0FDA8558C142
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\DevicesList-DiskDrive.txttext
MD5:BCFED5B275B6081C28B98567452C47A3
SHA256:412D6D18924A5D32C7644D5E706B21EFDED71D33CD3A6EEEA0D7BD8FAF7AC75E
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3352.37848\Antidetect 8.01.36 CRACKED [Z3ROZ]\GenFiles\DevicesList-Processor.txttext
MD5:2CDE9E426BB0C198677D6ED40EC461BE
SHA256:45659CE5DBA4F5A4295509621B643ECA7FD996CA7C3D943CF94CA15009C14903
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
u868328.nvpn.so
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Antidetect 8.01.36 CRACKED [Z3ROZ] (1).rar