File name:

COSMOTUBE viewer bot.rar

Full analysis: https://app.any.run/tasks/8fb36268-5baf-4d34-ab52-b2acc71e368c
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: February 03, 2021, 18:54:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5EEA5BD06B6BEDAD801C584AA02F485C

SHA1:

7707590F47202ED2FEF62DD81F38BE21675EB8F8

SHA256:

510837BC476EC8190DA416591A3D4649A0126971058B8EA043B1949B9CEF1560

SSDEEP:

196608:bZ8H0C+4VHQ31UFu1nHC9x0dqj63mu0HI87bZ+U4X:O0CAxc9x3u4bZy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • COSMOTUBE viewer bot.exe (PID: 3808)
      • COSMOTUBE viewer bot.exe (PID: 820)
      • COSMOTUBE viewer bot.exe (PID: 560)
      • COSMOTUBE viewer bot.exe (PID: 3716)
      • COSMOTUBE viewer bot.exe (PID: 3908)
      • COSMOTUBE viewer bot.exe (PID: 568)

    • REDLINE was detected

      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 2932)

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Steals credentials from Web Browsers

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2616)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2616)

    • Reads Environment values

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Reads the cookies of Google Chrome

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Reads the cookies of Mozilla Firefox

      • AddInProcess32.exe (PID: 4004)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 2932)

    • Searches for installed software

      • AddInProcess32.exe (PID: 4000)
      • AddInProcess32.exe (PID: 1848)
      • AddInProcess32.exe (PID: 3784)
      • AddInProcess32.exe (PID: 3896)
      • AddInProcess32.exe (PID: 2932)
      • AddInProcess32.exe (PID: 4004)

  • INFO

    • Manual execution by user

      • COSMOTUBE viewer bot.exe (PID: 3716)
      • COSMOTUBE viewer bot.exe (PID: 560)
      • COSMOTUBE viewer bot.exe (PID: 568)
      • COSMOTUBE viewer bot.exe (PID: 3808)
      • COSMOTUBE viewer bot.exe (PID: 3908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
13
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe cosmotube viewer bot.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe #REDLINE addinprocess32.exe

Process information

PID
CMD
Path
Indicators
Parent process
560"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
568"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
820"C:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\COSMOTUBE viewer bot.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\COSMOTUBE viewer bot.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2616.36959\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1848C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2616"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\COSMOTUBE viewer bot.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2932C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3716"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3784C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3808"C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe" C:\Users\admin\Desktop\COSMOTUBE viewer bot.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cosmotube viewer bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3896C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
COSMOTUBE viewer bot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 658
Read events
4 486
Write events
172
Delete events
0

Modification events

(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2616) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\COSMOTUBE viewer bot.rar
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
Executable files
38
Suspicious files
0
Text files
68
Unknown types
2

Dropped files

PID
Process
Filename
Type
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\chinese.txttext
MD5:AFE1F8E38AC914C4E3DF1121F1DA96EA
SHA256:92322329FCA3A73033D284168471E394BC483412F5D4BB35ABCE6ED535779D92
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\german.txttext
MD5:41A3C73C28E06FF699772607B254FB52
SHA256:9CF41160B06E8DF9DE1B8362DCC451F5EDADE8A7EC31E94C2A5FE9A095EF2ACB
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\chinesesimp.txttext
MD5:4A67A4CA6057E89A4FC4A4436C04F31E
SHA256:3AE9395FE90A323A79F3DC21AEDED13C747A204D7DEB0E7B396D9A738D22FBD5
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\spanish.txttext
MD5:8518EA90262AD26D1E3C1F3C1364EAAC
SHA256:E1CC1ECAFA7637736E5AE285E6B0F4DD0A7566F489A85A9FD4A220B3D87E0990
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\dll\System.Security.Principal.dllexecutable
MD5:13D414FD8F0A2C9CD7DEEE51AA56E052
SHA256:16A59E600C2A6EBF78D35077D79CEE86DF9AB76DE7B6780E631C531F24269A7D
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\french.txttext
MD5:5EA7B6DCDDE619C1A14D8CC9F63B2D73
SHA256:13AA929B69451AE261E2134F0ED7930FA10AD9D198C8AB8461B62B9B8F1CFE6B
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\dll\System.ServiceModel.Duplex.dllexecutable
MD5:E7708964BD7D1C3BF680B05B73482B88
SHA256:ED36FF40C7341C6146B297CFD91AAB3FEB40EDDD8A73E4DEA1D3932B68379DD8
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\polish.txttext
MD5:BB784A8396C2FB67A795E553AD4117F0
SHA256:C4159F926DF33736AA0B8C1EC76DA5B2ACF7D7BC3E8C7308725CC952FC6CDBBB
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\portuguese.txttext
MD5:12CF7FBB9295D2BEBBA8AFA909BA2B1A
SHA256:BCB21769C7112BC6CF878610CD082E3B2EFBF621D4AAFEFA5622DADC30C7E6DE
2616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2616.36959\data\errorcodes\japanese.txttext
MD5:BB8F0A9423C0F08215E09AD29675FF46
SHA256:86AD867BB66D094A9BB075ABEF04BFEE99A34802C1B2E97FB8A1EE572AE2F118
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
30
DNS requests
7
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4004
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
2932
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
3784
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
1848
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
1.01 Kb
malicious
4004
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
147 b
malicious
3896
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
3784
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
4004
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
2932
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
147 b
malicious
1848
AddInProcess32.exe
POST
200
45.140.146.120:81
http://45.140.146.120:81/
unknown
text
248 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
820
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
560
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3808
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3908
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
3716
COSMOTUBE viewer bot.exe
81.177.165.241:443
kaunieni.ru
JSC RTComm.RU
RU
suspicious
4000
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
3896
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
3784
AddInProcess32.exe
45.140.146.120:81
—
—
—
malicious
4000
AddInProcess32.exe
172.67.75.172:443
api.ip.sb
—
US
suspicious
3784
AddInProcess32.exe
172.67.75.172:443
api.ip.sb
—
US
suspicious

DNS requests

Domain
IP
Reputation
kaunieni.ru
  • 81.177.165.241
malicious
api.ip.sb
  • 172.67.75.172
  • 104.26.13.31
  • 104.26.12.31
whitelisted
whois.iana.org
  • 192.0.32.59
  • 192.0.47.59
whitelisted
WHOIS.ARIN.NET
  • 199.71.0.46
  • 199.5.26.46
  • 199.212.0.46
suspicious

Threats

PID
Process
Class
Message
3896
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
4000
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
4004
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
3784
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
1848
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
2932
AddInProcess32.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
32 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
COSMOTUBE viewer bot.rar