analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

dekont.pdf.lzh

Full analysis: https://app.any.run/tasks/a9f13e12-c4c9-4f54-83f7-eb291f465981
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 22, 2019, 13:44:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

21850552B5BCAD83588AFE309D25CBD5

SHA1:

A746089505024B043A7C73B818132AB302BD8F17

SHA256:

67B60AAFC80AB4E271FADA7A8B009ECA1C5F835A9815492D5382972DA90B6D64

SSDEEP:

3072:rvs19tCzUOEGlVozatSDSkZYc5qxAMGDqXtrfurT9FUq8EBXQYcDB0tGkvzxCIih:rstC4WlVrtgZkdPsFx8EBgv0BvZhq28

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • dekont.pdf.exe (PID: 3284)
      • dekont.pdf.exe (PID: 3856)
      • dekont.pdf.exe (PID: 3684)
      • remcos.exe (PID: 2260)
    • REMCOS RAT was detected

      • dekont.pdf.exe (PID: 3284)
    • Changes the autorun value in the registry

      • dekont.pdf.exe (PID: 3284)
    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2564)
  • SUSPICIOUS

    • Application launched itself

      • dekont.pdf.exe (PID: 3856)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2696)
      • dekont.pdf.exe (PID: 3284)
    • Creates files in the user directory

      • dekont.pdf.exe (PID: 3284)
    • Starts CMD.EXE for commands execution

      • dekont.pdf.exe (PID: 3284)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe dekont.pdf.exe no specs #REMCOS dekont.pdf.exe cmd.exe no specs ping.exe no specs dekont.pdf.exe remcos.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2696"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\dekont.pdf.lzh"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3856"C:\Users\admin\Desktop\dekont.pdf.exe" C:\Users\admin\Desktop\dekont.pdf.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3284"C:\Users\admin\Desktop\dekont.pdf.exe" C:\Users\admin\Desktop\dekont.pdf.exe
dekont.pdf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2564cmd /c ""C:\Users\admin\AppData\Local\Temp\install.bat" "C:\Windows\system32\cmd.exedekont.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3248PING 127.0.0.1 -n 2 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3684"C:\Users\admin\Desktop\dekont.pdf.exe" C:\Users\admin\Desktop\dekont.pdf.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
2260"C:\Users\admin\AppData\Roaming\remcos\remcos.exe" C:\Users\admin\AppData\Roaming\remcos\remcos.execmd.exe
User:
admin
Integrity Level:
MEDIUM
Total events
962
Read events
904
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2696WinRAR.exeC:\Users\admin\Desktop\dekont.pdf.exeexecutable
MD5:45236F69925F0427C66C803AF14F7E1C
SHA256:3B905C44155191C86F734C22F1DD29A379642560707840E64EACFF8BCF882575
3284dekont.pdf.exeC:\Users\admin\AppData\Roaming\remcos\remcos.exeexecutable
MD5:45236F69925F0427C66C803AF14F7E1C
SHA256:3B905C44155191C86F734C22F1DD29A379642560707840E64EACFF8BCF882575
3284dekont.pdf.exeC:\Users\admin\AppData\Local\Temp\install.battext
MD5:4BE8E47D35A08B8B6AD69312F7B4E077
SHA256:428B8E9AF103691C24E02AA1F514D45763C29FD1F83EA77DAB7DEF653545FB60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info