File name:

COSMOTUBE viewer bot.rar

Full analysis: https://app.any.run/tasks/8fb36268-5baf-4d34-ab52-b2acc71e368c
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: February 03, 2021, 18:54:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5EEA5BD06B6BEDAD801C584AA02F485C

SHA1:

7707590F47202ED2FEF62DD81F38BE21675EB8F8

SHA256:

510837BC476EC8190DA416591A3D4649A0126971058B8EA043B1949B9CEF1560

SSDEEP:

196608:bZ8H0C+4VHQ31UFu1nHC9x0dqj63mu0HI87bZ+U4X:O0CAxc9x3u4bZy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • COSMOTUBE viewer bot.exe (PID: 3908)
      • COSMOTUBE viewer bot.exe (PID: 3716)
      • COSMOTUBE viewer bot.exe (PID: 820)
      • COSMOTUBE viewer bot.exe (PID: 560)
      • COSMOTUBE viewer bot.exe (PID: 3808)
      • COSMOTUBE viewer bot.exe (PID: 568)

    • REDLINE was detected

      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 2932)

    • Steals credentials from Web Browsers

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)
      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3784)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2616)

    • Reads Environment values

      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2616)

    • Reads the cookies of Mozilla Firefox

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Reads the cookies of Google Chrome

      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)
      • AddInProcess32.exe (PID: 4004)

    • Searches for installed software

      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)
      • AddInProcess32.exe (PID: 3896)

  • INFO

    • Manual execution by user

      • COSMOTUBE viewer bot.exe (PID: 560)
      • COSMOTUBE viewer bot.exe (PID: 3716)
      • COSMOTUBE viewer bot.exe (PID: 568)
      • COSMOTUBE viewer bot.exe (PID: 3808)
      • COSMOTUBE viewer bot.exe (PID: 3908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
13
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe

Process information

PID
CMD
Path
Indicators
Parent process
560"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
568"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
820"C:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\COSMOTUBE viewer bot.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\COSMOTUBE viewer bot.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2616.36959\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1848C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2616"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\COSMOTUBE viewer bot.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2932C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3716"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3784C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3808"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3896C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 658
Read events
4 486
Write events
172
Delete events
0

Modification events

(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2616) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\COSMOTUBE viewer bot.rar
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
Executable files
38
Suspicious files
0
Text files
68
Unknown types
2

Dropped files

PID
Process
Filename
Type
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\german.txttext
MD5:41A3C73C28E06FF699772607B254FB52
SHA256:9CF41160B06E8DF9DE1B8362DCC451F5EDADE8A7EC31E94C2A5FE9A095EF2ACB
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\spanish.txttext
MD5:8518EA90262AD26D1E3C1F3C1364EAAC
SHA256:E1CC1ECAFA7637736E5AE285E6B0F4DD0A7566F489A85A9FD4A220B3D87E0990
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\korean.txttext
MD5:24AF5306FDF70414CA3AE25C1AC5F419
SHA256:2F308B6A009C182FC0D4F2E15E797AD383FC63F8E54C966B3005A69F421A8335
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\mexican.txttext
MD5:116A7328184DEF805A90AD011BC781EF
SHA256:973B68AD2DBCFE4A58CD6289D26583151D81E9D91C57D510052E54DAEF552933
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\russian.txttext
MD5:58536D6D87CDBA649B46B698793613A5
SHA256:981DA91F4EE48808300BA8400D19BF22638CF7272CF70AD343C9698B57BD6A3D
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\japanese.txttext
MD5:BB8F0A9423C0F08215E09AD29675FF46
SHA256:86AD867BB66D094A9BB075ABEF04BFEE99A34802C1B2E97FB8A1EE572AE2F118
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\dll\System.ServiceModel.Primitives.dllexecutable
MD5:2266594F7517AC059626A34881CFB5C2
SHA256:B8DB57B8F90C88144F93320E16B8DBB37813A9175A000A02E7E0F1C3316307A5
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\polish.txttext
MD5:BB784A8396C2FB67A795E553AD4117F0
SHA256:C4159F926DF33736AA0B8C1EC76DA5B2ACF7D7BC3E8C7308725CC952FC6CDBBB
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\portuguese.txttext
MD5:12CF7FBB9295D2BEBBA8AFA909BA2B1A
SHA256:BCB21769C7112BC6CF878610CD082E3B2EFBF621D4AAFEFA5622DADC30C7E6DE
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\chinese.txttext
MD5:AFE1F8E38AC914C4E3DF1121F1DA96EA
SHA256:92322329FCA3A73033D284168471E394BC483412F5D4BB35ABCE6ED535779D92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
30
DNS requests
7
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3784
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
147 b
malicious
3896
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
3784
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
3784
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
2932
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
4000
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
147 b
malicious
4004
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
4000
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
2932
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
1848
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
820
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
560
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3908
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3808
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3716
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3896
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
1848
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
4000
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
3784
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
4000
AddInProcess32.exe
172.67.75.172:443
api.ip.sb
—
US
suspicious

DNS requests

Domain
IP
Reputation
kaunieni.ru
  • 81.177.165.241
malicious
api.ip.sb
  • 172.67.75.172
  • 104.26.13.31
  • 104.26.12.31
whitelisted
whois.iana.org
  • 192.0.32.59
  • 192.0.47.59
whitelisted
WHOIS.ARIN.NET
  • 199.71.0.46
  • 199.5.26.46
  • 199.212.0.46
suspicious

Threats

PID
Process
Class
Message
3896
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
4000
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
4004
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
3784
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
1848
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
2932
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
32 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
COSMOTUBE viewer bot.rar