download:

File_pass1234.7z

Full analysis: https://app.any.run/tasks/bfbfd744-5e63-4aab-b337-f1834d648281
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 19, 2023, 08:31:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
privateloader
opendir
loader
g0njxa
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

228119EE4C65CB1007F6A059D9B9EA04

SHA1:

FFF65D55391A3AABD4262886CBABF87F6F2600FD

SHA256:

540B52866F994DC6C92ED34BB9E3D7F9ED6183CE5AD09DAA9C0704DA733AE060

SSDEEP:

98304:O3vnS3jwpt1B1ODe16f/dqDlvgYCrBBkTRuRs4hI5z:OKMnODe16f/dqZvawRuRjqz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file the system directory

      • File.exe (PID: 2496)

    • PRIVATELOADER was detected

      • File.exe (PID: 2496)

    • Connects to the CnC server

      • File.exe (PID: 2496)

    • Actions looks like stealing of personal data

      • File.exe (PID: 2496)

  • SUSPICIOUS

    • Connects to the server without a host name

      • File.exe (PID: 2496)

    • Adds/modifies Windows certificates

      • WinRAR.exe (PID: 2448)

    • Executes as Windows Service

      • raserver.exe (PID: 2508)
      • raserver.exe (PID: 1440)

    • Reads settings of System Certificates

      • File.exe (PID: 2496)

    • Reads the Internet Settings

      • File.exe (PID: 2496)

    • Reads security settings of Internet Explorer

      • File.exe (PID: 2496)

    • Checks Windows Trust Settings

      • File.exe (PID: 2496)

    • Executable content was dropped or overwritten

      • File.exe (PID: 2496)

    • Process requests binary or script from the Internet

      • File.exe (PID: 2496)

    • Connects to unusual port

      • File.exe (PID: 2496)

  • INFO

    • The process checks LSA protection

      • File.exe (PID: 2496)
      • File.exe (PID: 2740)

    • Checks supported languages

      • File.exe (PID: 2740)
      • File.exe (PID: 2496)

    • Reads the computer name

      • File.exe (PID: 2496)
      • File.exe (PID: 2740)

    • Checks proxy server information

      • File.exe (PID: 2496)

    • Reads the machine GUID from the registry

      • File.exe (PID: 2496)

    • Manual execution by a user

      • File.exe (PID: 2740)

    • Process checks computer location settings

      • File.exe (PID: 2496)

    • Creates files or folders in the user directory

      • File.exe (PID: 2496)

    • Create files in a temporary directory

      • File.exe (PID: 2496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs file.exe no specs #PRIVATELOADER file.exe file.exe raserver.exe no specs raserver.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1440C:\Windows\system32\RAServer.exe /offerraupdateC:\Windows\System32\raserver.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Remote Assistance COM Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\raserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2448"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\File_pass1234.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2496"C:\Users\admin\AppData\Local\Temp\Rar$EXb2448.551\File.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2448.551\File.exe
WinRAR.exe
User:
admin
Company:
MPC-HC Team
Integrity Level:
HIGH
Description:
MPC-HC (x64)
Exit code:
0
Version:
1.9.23 (a8e9113b5)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2448.551\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2508C:\Windows\system32\RAServer.exe /offerraupdateC:\Windows\System32\raserver.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Remote Assistance COM Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\raserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
2740"C:\Users\admin\Desktop\File.exe" C:\Users\admin\Desktop\File.exe
explorer.exe
User:
admin
Company:
MPC-HC Team
Integrity Level:
HIGH
Description:
MPC-HC (x64)
Exit code:
0
Version:
1.9.23 (a8e9113b5)
Modules
Images
c:\users\admin\desktop\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2972"C:\Users\admin\AppData\Local\Temp\Rar$EXb2448.551\File.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2448.551\File.exe—WinRAR.exe
User:
admin
Company:
MPC-HC Team
Integrity Level:
MEDIUM
Description:
MPC-HC (x64)
Exit code:
3221226540
Version:
1.9.23 (a8e9113b5)
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rar$exb2448.551\file.exe
Total events
2 388
Read events
2 299
Write events
55
Delete events
34

Modification events

(PID) Process:(2448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\14C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7AndW2K8R2-KB3191566-x64.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
16
Suspicious files
7
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2448.551\File.exe —
MD5:—
SHA256:—
2448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2448.1491\File.exe —
MD5:—
SHA256:—
2496File.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:39DFFC602ED934569F26BE44EC645814
SHA256:B57A88E5B1ACF3A784BE88B87FA3EE1F0991CB7C1C66DA423F3595FFC6E0C5C2
2496File.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:CDFD60E717A44C2349B553E011958B85
SHA256:0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
2496File.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\0FJG430T.txttext
MD5:1F53143555FF466F69C98B6ED18CE414
SHA256:0F2C1F86DD11D68BA6C96534732AE8F57323124EAC967ECFD0CC1F626C908B87
2496File.exeC:\Users\admin\Pictures\Minor Policy\7GYslHBw3ezh2EIVbi5ZRi2E.exeexecutable
MD5:A80A71FA1BB88E7708609F4D287FD266
SHA256:365CBD4B53AD81CD83207C6E760DF0BA183DECCB997C88EA9E46DA2F827C2056
2496File.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\photo221[1].exeexecutable
MD5:8BC0F9A464D40D9DF7D79790A414A0E0
SHA256:BA78E7BD378AC34115266A5AB0543D6944723FCAD4C596DBA9A8BAB5968E9BB5
2496File.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:8AE33739D4BFFE20CBD2D8EB10A92406
SHA256:1935F47FAC25B080267A029CFB3B7C99863D56E23D1E2463F7273DEDAB5F22AC
2496File.exeC:\Users\admin\Pictures\Minor Policy\DMztWI8DpbTKYm92dxw0rv89.exeexecutable
MD5:EE0516A44D6E7CC5E2BEF2CA0E5CF461
SHA256:8DC7D4261B9EA7463AE129A04C13BEB905D7A5722B03C90EA57E0A81C04F0880
2496File.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\BXR0X7MX.txttext
MD5:E6249403B037D3941C71BB4140497313
SHA256:9B9D05D7468FBD9B64A08E6F6D6909F63218664F47A3B126AD88CDC9892BA3EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
71
DNS requests
13
Threats
740

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2496
File.exe
HEAD
—
194.169.175.124:80
http://194.169.175.124:3002/
US
—
—
malicious
2496
File.exe
GET
—
45.12.253.74:80
http://45.12.253.74/pineapple.php?pub=mixinte
BG
—
—
malicious
2496
File.exe
HEAD
200
83.97.73.131:80
http://83.97.73.131/gallery/photo221.exe
unknown
—
—
malicious
2496
File.exe
GET
—
83.97.73.131:80
http://83.97.73.131/gallery/photo221.exe
unknown
—
—
malicious
2496
File.exe
HEAD
200
188.114.97.3:80
http://ji.jahhaega2qq.com/m/p0aw25.exe
US
—
—
malicious
2496
File.exe
GET
200
188.114.97.3:80
http://ji.jahhaega2qq.com/m/p0aw25.exe
US
executable
417 Kb
malicious
2496
File.exe
POST
200
208.67.104.60:80
http://208.67.104.60/api/firegate.php
US
text
108 b
malicious
2496
File.exe
POST
200
208.67.104.60:80
http://208.67.104.60/api/firegate.php
US
text
108 b
malicious
2496
File.exe
GET
200
163.123.143.4:80
http://163.123.143.4/download/Service32.exe
unknown
executable
5.11 Mb
malicious
2496
File.exe
GET
200
45.9.74.80:80
http://45.9.74.80/undoo.exe
SC
executable
772 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2496
File.exe
208.67.104.60:80
—
Delis LLC
US
malicious
2496
File.exe
104.26.8.59:443
api.myip.com
CLOUDFLARENET
US
suspicious
2740
File.exe
94.142.138.113:80
—
Network Management Ltd
RU
malicious
2496
File.exe
172.67.75.163:443
api.myip.com
CLOUDFLARENET
US
suspicious
2496
File.exe
87.240.132.78:80
vk.com
VKontakte Ltd
RU
suspicious
2496
File.exe
87.240.129.133:80
vk.com
VKontakte Ltd
RU
malicious
2496
File.exe
87.240.132.67:80
vk.com
VKontakte Ltd
RU
suspicious
2496
File.exe
93.186.225.194:80
vk.com
VKontakte Ltd
RU
suspicious

DNS requests

Domain
IP
Reputation
api.myip.com
  • 104.26.8.59
  • 172.67.75.163
  • 104.26.9.59
suspicious
teredo.ipv6.microsoft.com
  • —
whitelisted
ipinfo.io
  • 34.117.59.81
shared
vk.com
  • 87.240.132.78
  • 87.240.129.133
  • 87.240.132.67
  • 87.240.132.72
  • 93.186.225.194
  • 87.240.137.164
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
hugersi.com
  • 91.215.85.147
suspicious
ji.jahhaega2qq.com
  • 188.114.96.3
  • 188.114.97.3
malicious
bitbucket.org
  • 104.192.141.1
shared
bbuseruploads.s3.amazonaws.com
  • 3.5.28.106
  • 52.216.209.105
  • 52.217.164.105
  • 3.5.29.240
  • 52.216.108.123
  • 54.231.161.169
  • 52.217.167.225
  • 52.217.43.100
shared
x.ss2.us
  • 143.204.214.29
  • 143.204.214.104
  • 143.204.214.191
  • 143.204.214.125
whitelisted

Threats

PID
Process
Class
Message
2496
File.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 39
2496
File.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
2496
File.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
2496
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2496
File.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
2496
File.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2496
File.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2496
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2496
File.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2496
File.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
File_pass1234.7z