File name:

Myrz AntiPublic Cracked by TeamOtimus.rar

Full analysis: https://app.any.run/tasks/44a74339-fd72-4f09-8fc6-c1c45a03cb78
Verdict: Malicious activity
Analysis date: April 11, 2021, 15:25:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

6BBCD287B1D7F6CAF332A55EAD5138EF

SHA1:

CB5074AE046FE07F46CC9D208129E70BAADEA884

SHA256:

63629D0EF9C8A99A706E1A553D5817A424DFB4401BD787780A5D5CB9D2619613

SSDEEP:

49152:iN8U/57LVboqSC33cRevDDM5QEqJTRye5RyLVboqSC33cRevMvM5QEeJiD:68UpLVbTZM6/M5t6ye5RyLVbTZM6eM5n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • AntiPublic.exe (PID: 2252)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2292)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 4056)
      • schtasks.exe (PID: 660)

    • Loads dropped or rewritten executable

      • AntiPublic.exe (PID: 2252)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2292)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • AntiPublic.exe (PID: 2540)

    • Adds / modifies Windows certificates

      • AntiPublic.exe (PID: 2252)

    • Executable content was dropped or overwritten

      • AntiPublic.exe (PID: 2252)

    • Creates files in the user directory

      • powershell.exe (PID: 2128)
      • loader.exe (PID: 1852)
      • powershell.exe (PID: 2188)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2292)

  • INFO

    • Manual execution by user

      • AntiPublic.exe (PID: 2540)
      • AntiPublic.exe (PID: 1524)
      • AntiPublic Updater.exe (PID: 2052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs antipublic.exe no specs antipublic.exe cmd.exe no specs antipublic.exe antipublic updater.exe powershell.exe no specs powershell.exe no specs schtasks.exe no specs schtasks.exe no specs attrib.exe no specs loader.exe no specs loader1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660schtasks /create /sc minute /mo 1 /tn "Microsoft\Assemblies\SystemManager" /tr "C:\Users\admin\AppData\Roaming\MicrosoftAssemblies\SystemManager.exe" /RL HIGHEST /fC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1524"C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\AntiPublic.exe" C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\AntiPublic.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\myrz antipublic\myrz antipublic\antipublic.exe
c:\systemroot\system32\ntdll.dll
1664"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Myrz AntiPublic Cracked by TeamOtimus.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1852loader.exe -pW1Nd0vv$C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\Config\loader.exe—cmd.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
HIGH
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.6.0.2712
Modules
Images
c:\users\admin\desktop\myrz antipublic\myrz antipublic\config\loader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2052"C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\AntiPublic Updater.exe" C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\AntiPublic Updater.exe
explorer.exe
User:
admin
Company:
Newtonsoft
Integrity Level:
MEDIUM
Description:
Json.NET
Exit code:
0
Version:
9.0.1.19813
Modules
Images
c:\users\admin\desktop\myrz antipublic\myrz antipublic\antipublic updater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2128powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2188powershell Add-MpPreference -ExclusionPath "C:\Users" -forceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2252Config\Config\AntiPublic.exeC:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\Config\Config\AntiPublic.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
4294967295
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\myrz antipublic\myrz antipublic\config\config\antipublic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2292"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\CB20.tmp\CB21.tmp\CB22.bat "C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\AntiPublic.exe""C:\Windows\system32\cmd.exe—AntiPublic.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2372loader1.exe -pW1Nd0vv$C:\Users\admin\Desktop\Myrz AntiPublic\Myrz AntiPublic\Config\loader1.exe—cmd.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
HIGH
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.6.0.2712
Modules
Images
c:\users\admin\desktop\myrz antipublic\myrz antipublic\config\loader1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
Total events
1 208
Read events
1 025
Write events
183
Delete events
0

Modification events

(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1664) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1664) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Myrz AntiPublic Cracked by TeamOtimus.rar
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1664) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
1
Suspicious files
4
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\AltoControls.dll —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\AntiPublic Updater.exe —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\AntiPublic.exe —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\AltoControls.dll —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\AntiPublic Updater.exe —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\AntiPublic.exe —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\ConsoleRegChecker.exe —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\en\AntiPublic.resources.dll —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\GemBox.Email.dll —
MD5:—
SHA256:—
1664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1664.9604\Myrz AntiPublic\Myrz AntiPublic\Config\Config\GemBox.Email.xml —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2052
AntiPublic Updater.exe
GET
301
5.196.97.250:80
http://myrz.org/check_updates.php
FR
html
178 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2252
AntiPublic.exe
5.196.97.250:80
myrz.org
OVH SAS
FR
suspicious
2252
AntiPublic.exe
5.196.97.250:443
myrz.org
OVH SAS
FR
suspicious
2052
AntiPublic Updater.exe
5.196.97.250:443
myrz.org
OVH SAS
FR
suspicious
2052
AntiPublic Updater.exe
5.196.97.250:80
myrz.org
OVH SAS
FR
suspicious

DNS requests

Domain
IP
Reputation
myrz.org
  • 5.196.97.250
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Myrz AntiPublic Cracked by TeamOtimus.rar