File name:

TradingView Ultimate.zip

Full analysis: https://app.any.run/tasks/9c7b635b-8211-430c-be53-45a2fe0a6b68
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 30, 2024, 04:35:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
vidar
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

59E59A5F895F3BC49F026BAFA3136D83

SHA1:

6BC0201C502C8253EC0C249F262FA26CEE9C5AD9

SHA256:

5832220AA8AA0005668154A8CA11BCF798E6B2A2ED5D978446FD8E8BBC00C48E

SSDEEP:

98304:1K8wSFyKlEXT3a1kyQv33AaZLTponX95g1Q7yXSNkRfqGPLZNkjcoCWCGlA3tfHn:vYGIAeoamPxE+7OwrM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 268)

    • VIDAR has been detected (SURICATA)

      • TradingView Ultimate_beta.exe (PID: 4092)

    • VIDAR has been detected (YARA)

      • TradingView Ultimate_beta.exe (PID: 4092)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 268)

    • Reads the BIOS version

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads the Internet Settings

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads settings of System Certificates

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads security settings of Internet Explorer

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Checks Windows Trust Settings

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Connects to unusual port

      • TradingView Ultimate_beta.exe (PID: 4092)

  • INFO

    • Checks supported languages

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Manual execution by a user

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads the computer name

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Checks proxy server information

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Create files in a temporary directory

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads the machine GUID from the registry

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads product name

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Creates files or folders in the user directory

      • TradingView Ultimate_beta.exe (PID: 4092)

    • Reads Environment values

      • TradingView Ultimate_beta.exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:07:30 14:19:12
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: lang/
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #VIDAR tradingview ultimate_beta.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TradingView Ultimate.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4092"C:\Users\admin\Desktop\TradingView Ultimate_beta.exe" C:\Users\admin\Desktop\TradingView Ultimate_beta.exe
explorer.exe
User:
admin
Company:
Novosoft LLC
Integrity Level:
MEDIUM
Description:
Handy Backup 5.8.2.0 Agent
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\tradingview ultimate_beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
Total events
5 745
Read events
5 699
Write events
46
Delete events
0

Modification events

(PID) Process:(268) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(268) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
0
Suspicious files
11
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
268WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa268.31435\TradingView Ultimate_beta.exe —
MD5:—
SHA256:—
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:AF8FE67F803BECEEADDDE6CCEA592C52
SHA256:6EA2BE6CE59199D8530E5AB5D1E77DD6BFF1D7E3BE39DD27EBDF68AB3F71489C
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:B79F15E24A4482E3015F9E42BAE0941C
SHA256:19EF17F321926B307C13F0430DE578E79FC7462A442A81C169B38D43F878783E
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EEbinary
MD5:CB9AB0A511C37CCD2113D02C14D6796D
SHA256:19A6643361B4E76A5B54FAD5555D088D48459EC5B85BB089A3C42A3AA9A2577E
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\F0DA2R6S.txttext
MD5:C6124380A676C86E1B73827DD8E2E5F3
SHA256:A7A2C54ABAAAC59B7B9FC841D071EFFC80AC0D7F6B05EFAD87EB2CD3AA46F1DC
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:98C09ADE14F56D594E512B2B187348AA
SHA256:DA004BC5DB5414BDA9FD06AC863CAFE67026F25141A3A4D35B926EA260197D7C
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:0C76091549DD3F21E45B83BCF72068A6
SHA256:51BC9161064AD9E7C9DA8E184D4BCE61C1655E860820C82EEDEA7AC6963E5C1B
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\Local\Temp\TarA415.tmpcat
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
4092TradingView Ultimate_beta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:5ED2CB6FB3FFAA9EFAD0B9C7FF33D512
SHA256:18007711E7459CF15A68CA87A337D0C64C4EAC4A5CAA9336F733CB176FC6A0B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
9
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4092
TradingView Ultimate_beta.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK
unknown
binary
2.06 Kb
unknown
4092
TradingView Ultimate_beta.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
binary
2.01 Kb
unknown
4092
TradingView Ultimate_beta.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7013747a3395c37f
unknown
compressed
65.2 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a414549a770d7263
unknown
—
—
unknown
4092
TradingView Ultimate_beta.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c7431b466fa8017c
unknown
—
—
unknown
4092
TradingView Ultimate_beta.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
unknown
binary
1.98 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4092
TradingView Ultimate_beta.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
unknown
4092
TradingView Ultimate_beta.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
4092
TradingView Ultimate_beta.exe
192.124.249.36:80
ocsp.godaddy.com
SUCURI-SEC
US
unknown
4092
TradingView Ultimate_beta.exe
88.198.191.199:2920
—
Hetzner Online GmbH
DE
unknown
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
t.me
  • 149.154.167.99
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.godaddy.com
  • 192.124.249.36
  • 192.124.249.23
  • 192.124.249.24
  • 192.124.249.22
  • 192.124.249.41
whitelisted

Threats

PID
Process
Class
Message
4092
TradingView Ultimate_beta.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
4092
TradingView Ultimate_beta.exe
A Network Trojan was detected
STEALER [ANY.RUN] Vidar TLS Connection Attempt
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TradingView Ultimate.zip