File name:

Hex-Rays IDA Pro v7.3.zip

Full analysis: https://app.any.run/tasks/aa9f9ac1-de1a-4ef0-a5f6-7d88fbeaa8f5
Verdict: Malicious activity
Threats:

Ficker Stealer is a malware that steals passwords, files, credit card details, and other types of sensitive information on Windows systems. It is most often distributed via phishing emails and can perform keylogging, process injection, and browser tracking.

Analysis date: January 12, 2021, 17:58:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
ficker
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

0E08C931CE47CD0157EF52557704A405

SHA1:

46F471C242CC0CDEAA9B3BEF8BC498A102FAFAF3

SHA256:

531E000A244C140FBD5907075B835F48D265BE1D6AAE9E970B92E5D9A670E2FB

SSDEEP:

196608:Lcz/YPbPJJbTMCHfBmT4VhIQSRye27lMeytJECR3FfjiGo5:Yz/YPbPQFTShIQG27ty73tE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe (PID: 2344)
      • Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe (PID: 3712)
    • Actions looks like stealing of personal data

      • calc.exe (PID: 3492)
    • Steals credentials from Web Browsers

      • calc.exe (PID: 3492)
    • FICKER was detected

      • calc.exe (PID: 3492)
  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 1252)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1252)
    • Reads the cookies of Mozilla Firefox

      • calc.exe (PID: 3492)
    • Creates files in the program directory

      • calc.exe (PID: 3492)
    • Checks for external IP

      • calc.exe (PID: 3492)
    • Reads the cookies of Google Chrome

      • calc.exe (PID: 3492)
  • INFO

    • Manual execution by user

      • Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe (PID: 3712)
      • Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe (PID: 2344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2021:01:12 17:55:10
ZipCRC: 0x50c868d6
ZipCompressedSize: 3218
ZipUncompressedSize: 3218
ZipFileName: Readme!.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe hex-rays ida pro v7.3.190614 (x64) patched - [haxnode].exe no specs hex-rays ida pro v7.3.190614 (x64) patched - [haxnode].exe #FICKER calc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1252"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Hex-Rays IDA Pro v7.3.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2344"C:\Users\admin\Desktop\Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe" C:\Users\admin\Desktop\Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exeexplorer.exe
User:
admin
Company:
The GIMP Team
Integrity Level:
MEDIUM
Description:
GIMP Setup
Exit code:
3221226540
Version:
2.10.22
Modules
Images
c:\users\admin\desktop\hex-rays ida pro v7.3.190614 (x64) patched - [haxnode].exe
c:\systemroot\system32\ntdll.dll
3492"C:\Users\admin\Desktop\Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe" C:\Windows\system32\calc.exe
Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Calculator
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\calc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
3712"C:\Users\admin\Desktop\Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe" C:\Users\admin\Desktop\Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exe
explorer.exe
User:
admin
Company:
The GIMP Team
Integrity Level:
HIGH
Description:
GIMP Setup
Exit code:
0
Version:
2.10.22
Modules
Images
c:\users\admin\desktop\hex-rays ida pro v7.3.190614 (x64) patched - [haxnode].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
Total events
495
Read events
459
Write events
36
Delete events
0

Modification events

(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1252) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Hex-Rays IDA Pro v7.3.zip
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1252) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@C:\Windows\system32\msinfo32.exe,-10001
Value:
System Information File
(PID) Process:(1252) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:@C:\Windows\System32\ieframe.dll,-10046
Value:
Internet Shortcut
Executable files
1
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1252.18681\data.dat
MD5:
SHA256:
1252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1252.18681\Hex-Rays IDA Pro v7.3.190614 (x64) Patched - [haxNode].exeexecutable
MD5:
SHA256:
3492calc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\93ZIKSE7.txttext
MD5:
SHA256:
1252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1252.18681\Readme!.txttext
MD5:
SHA256:
3492calc.exeC:\ProgramData\krosqm.txttext
MD5:
SHA256:
1252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1252.18681\Info.nfobinary
MD5:
SHA256:
1252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1252.18681\THEPIRATEBAY.ORG.urltext
MD5:F0A05245942DF80720C52D58064731EE
SHA256:650CAE89065A9B00E4A7A1F3DFE4FB03A33F5BF96453A71DB1C05B30F5469F66
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3492
calc.exe
GET
200
54.235.189.250:80
http://api.ipify.org/?format=xml
US
text
13 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3492
calc.exe
54.235.189.250:80
api.ipify.org
Amazon.com, Inc.
US
suspicious
3492
calc.exe
85.17.190.28:80
LeaseWeb Netherlands B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 54.235.189.250
  • 54.235.83.248
  • 54.243.119.179
  • 23.21.140.41
  • 54.221.253.252
  • 23.21.252.4
  • 23.21.126.66
  • 50.19.252.36
shared

Threats

PID
Process
Class
Message
3492
calc.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup (ipify .org)
3492
calc.exe
A Network Trojan was detected
ET TROJAN Win32/Ficker Stealer Activity M3
3492
calc.exe
A Network Trojan was detected
STEALER [PTsecurity] Ficker
3492
calc.exe
A Network Trojan was detected
ET TROJAN Win32/Ficker Stealer Activity M3
3492
calc.exe
A Network Trojan was detected
STEALER [PTsecurity] Ficker
No debug info