analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RoYo.zip

Full analysis: https://app.any.run/tasks/a70351b0-7546-4a02-a728-15f091224b4e
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: April 01, 2023, 17:13:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
asyncrat
quasar
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EA8986395F4E341DBE4F4240615992CA

SHA1:

E6163093D3C0C14DC2682A27CA4BCAC451EDBFF4

SHA256:

65D78BD6EBA9E03C543AEBB7FD64BE32C7D99C30F4BBE9DE2569693E41E50E0E

SSDEEP:

24576:SKt8Bzi7pb2kQFNL2kIeGQnw0xlh84kLoEMgxaMHYAnRH:Rqi7pFalh8ZoFgxvYWRH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

    • ASYNCRAT detected by memory dumps

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

    • QUASAR detected by memory dumps

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • The process checks LSA protection

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

    • Checks supported languages

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

    • Reads the computer name

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

    • Reads Environment values

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)

    • Manual execution by a user

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)
      • taskmgr.exe (PID: 3224)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2512)

    • Reads the machine GUID from the registry

      • RoYo.exe (PID: 3864)
      • RoYo.exe (PID: 2952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(3864) RoYo.exe
CertificateMIIE9DCCAtygAwIBAgIQAJ0hC0VNIJLvW03Nv0KWgTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDMzMDE2NDkyNFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxRD+tQJsGG0NRD8tYPShMwFpG/KS0ofFA8nmFLLSbZfmGk6eQsNgt41GJqW0yGxNwFONytXa...
SignatureSN5sWBwo/25lV0Ek+IZyl6lkcCVPkB0H07HAVGQQbY33e0TLR/p3Ah1SD8n1x7YjhQCxfiIGdBY0AFtKgMcGapjGSeOd4aBVOhMSvAyRn7eGeBGfyPHQtIlistC54CFUgivo2DGDCtpaO64GIgYZJWw5G5AsMBNrjm/p1zkWPoXIDY9LdJyUY+1Z61pBVrLvI0lg4PDMrxis2Q0m7ZuB1W3KxzGvs4MPKYriPdCY/b7fztfo5OHm3TJ2gMYY9bVfc6v3RBUxU9tjtwcDeKxaTXELzIqd4iGS5d6jWR4W1Zl4...
LogDirLogs
TagOffice04
StartupOneDrive Support
Mutex115c3855-a135-47d8-b491-a87b371fbb91
Install_NameDefenderSetup.exe
Sub_DirSubDir
C2 (2)147.185.221.181:4782
Version1.4.1
(PID) Process(2952) RoYo.exe
CertificateMIIE9DCCAtygAwIBAgIQAJ0hC0VNIJLvW03Nv0KWgTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDMzMDE2NDkyNFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxRD+tQJsGG0NRD8tYPShMwFpG/KS0ofFA8nmFLLSbZfmGk6eQsNgt41GJqW0yGxNwFONytXa...
SignatureSN5sWBwo/25lV0Ek+IZyl6lkcCVPkB0H07HAVGQQbY33e0TLR/p3Ah1SD8n1x7YjhQCxfiIGdBY0AFtKgMcGapjGSeOd4aBVOhMSvAyRn7eGeBGfyPHQtIlistC54CFUgivo2DGDCtpaO64GIgYZJWw5G5AsMBNrjm/p1zkWPoXIDY9LdJyUY+1Z61pBVrLvI0lg4PDMrxis2Q0m7ZuB1W3KxzGvs4MPKYriPdCY/b7fztfo5OHm3TJ2gMYY9bVfc6v3RBUxU9tjtwcDeKxaTXELzIqd4iGS5d6jWR4W1Zl4...
LogDirLogs
TagOffice04
StartupOneDrive Support
Mutex115c3855-a135-47d8-b491-a87b371fbb91
Install_NameDefenderSetup.exe
Sub_DirSubDir
C2 (2)147.185.221.181:4782
Version1.4.1
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: RoYo/RoYo.exe
ZipUncompressedSize: 3266048
ZipCompressedSize: 1222972
ZipCRC: 0x01e157c3
ZipModifyDate: 2023:04:01 13:56:06
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #ASYNCRAT royo.exe no specs #ASYNCRAT royo.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RoYo.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ntdll.dll
3864"C:\Users\admin\Desktop\RoYo\RoYo.exe" C:\Users\admin\Desktop\RoYo\RoYo.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
1
Version:
1.4.1
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\royo\royo.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
Quasar
(PID) Process(3864) RoYo.exe
CertificateMIIE9DCCAtygAwIBAgIQAJ0hC0VNIJLvW03Nv0KWgTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDMzMDE2NDkyNFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxRD+tQJsGG0NRD8tYPShMwFpG/KS0ofFA8nmFLLSbZfmGk6eQsNgt41GJqW0yGxNwFONytXa...
SignatureSN5sWBwo/25lV0Ek+IZyl6lkcCVPkB0H07HAVGQQbY33e0TLR/p3Ah1SD8n1x7YjhQCxfiIGdBY0AFtKgMcGapjGSeOd4aBVOhMSvAyRn7eGeBGfyPHQtIlistC54CFUgivo2DGDCtpaO64GIgYZJWw5G5AsMBNrjm/p1zkWPoXIDY9LdJyUY+1Z61pBVrLvI0lg4PDMrxis2Q0m7ZuB1W3KxzGvs4MPKYriPdCY/b7fztfo5OHm3TJ2gMYY9bVfc6v3RBUxU9tjtwcDeKxaTXELzIqd4iGS5d6jWR4W1Zl4...
LogDirLogs
TagOffice04
StartupOneDrive Support
Mutex115c3855-a135-47d8-b491-a87b371fbb91
Install_NameDefenderSetup.exe
Sub_DirSubDir
C2 (2)147.185.221.181:4782
Version1.4.1
2952"C:\Users\admin\Desktop\RoYo\RoYo.exe" C:\Users\admin\Desktop\RoYo\RoYo.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
1
Version:
1.4.1
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\royo\royo.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(2952) RoYo.exe
CertificateMIIE9DCCAtygAwIBAgIQAJ0hC0VNIJLvW03Nv0KWgTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDMzMDE2NDkyNFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxRD+tQJsGG0NRD8tYPShMwFpG/KS0ofFA8nmFLLSbZfmGk6eQsNgt41GJqW0yGxNwFONytXa...
SignatureSN5sWBwo/25lV0Ek+IZyl6lkcCVPkB0H07HAVGQQbY33e0TLR/p3Ah1SD8n1x7YjhQCxfiIGdBY0AFtKgMcGapjGSeOd4aBVOhMSvAyRn7eGeBGfyPHQtIlistC54CFUgivo2DGDCtpaO64GIgYZJWw5G5AsMBNrjm/p1zkWPoXIDY9LdJyUY+1Z61pBVrLvI0lg4PDMrxis2Q0m7ZuB1W3KxzGvs4MPKYriPdCY/b7fztfo5OHm3TJ2gMYY9bVfc6v3RBUxU9tjtwcDeKxaTXELzIqd4iGS5d6jWR4W1Zl4...
LogDirLogs
TagOffice04
StartupOneDrive Support
Mutex115c3855-a135-47d8-b491-a87b371fbb91
Install_NameDefenderSetup.exe
Sub_DirSubDir
C2 (2)147.185.221.181:4782
Version1.4.1
3224"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
2 840
Read events
2 746
Write events
94
Delete events
0

Modification events

(PID) Process:(2512) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2512WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2512.21890\RoYo\RoYo.exeexecutable
MD5:EBE14CBABCED6FA90136D35F9D035E21
SHA256:AACE4310718783C6B92C3BDEAFA5E7531A479DC4AD0EC521A3CB0C1A03CA3E60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RoYo.zip