URL:

https://www.upload.ee/files/15529307/888_Rat_v1.2.6.zip.html

Full analysis: https://app.any.run/tasks/6040c169-12d4-47d5-9391-36f9e565ab11
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 23, 2024, 18:23:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
stormkitty
evasion
asyncrat
rat
Indicators:
MD5:

51707C50B7EB2BEB2E72693DDD346C3B

SHA1:

49B70FCB57760927E8620F27B4C25F4279F763C9

SHA256:

68C33DDDE32A755599A37F2C081C77CA248F0859B120DB7E9253BF5B46CEFE08

SSDEEP:

3:N8DSLr7MJmUFXVJRJEKn:2OLr0RnkKn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 888 Rat v1.2.6.exe (PID: 844)
      • SetupTCPDriver.exe (PID: 3556)
      • CL_Debug_Log.txt (PID: 2424)
      • 888 Builder.exe (PID: 1840)
      • Helper.exe (PID: 3060)
      • Helper.exe (PID: 2032)

    • Steals credentials

      • Bubbles.scr (PID: 448)

    • Steals credentials from Web Browsers

      • Bubbles.scr (PID: 448)

    • STORMKITTY has been detected (YARA)

      • Bubbles.scr (PID: 448)

    • ASYNCRAT has been detected (MUTEX)

      • Bubbles.scr (PID: 448)

    • Actions looks like stealing of personal data

      • Bubbles.scr (PID: 448)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2504)
      • 888 Rat v1.2.6.exe (PID: 844)
      • Helper.exe (PID: 2032)
      • 888 Builder.exe (PID: 1840)

    • Starts POWERSHELL.EXE for commands execution

      • 888 Rat v1.2.6.exe (PID: 844)

    • Reads the Internet Settings

      • 888 Rat v1.2.6.exe (PID: 844)
      • Bubbles.scr (PID: 448)
      • Helper.exe (PID: 2032)
      • 888 Builder.exe (PID: 1840)
      • powershell.exe (PID: 1544)

    • Base64-obfuscated command line is found

      • 888 Rat v1.2.6.exe (PID: 844)

    • BASE64 encoded PowerShell command has been detected

      • 888 Rat v1.2.6.exe (PID: 844)

    • Executable content was dropped or overwritten

      • 888 Rat v1.2.6.exe (PID: 844)
      • 888 Builder.exe (PID: 1840)
      • Helper.exe (PID: 3060)
      • Helper.exe (PID: 2032)
      • SetupTCPDriver.exe (PID: 3556)
      • CL_Debug_Log.txt (PID: 2424)

    • Starts application with an unusual extension

      • 888 Rat v1.2.6.exe (PID: 844)
      • SetupTCPDriver.exe (PID: 3556)
      • cmd.exe (PID: 1652)
      • cmd.exe (PID: 3744)

    • Reads settings of System Certificates

      • SetupTCPDriver.exe (PID: 3556)
      • Bubbles.scr (PID: 448)

    • Drops 7-zip archiver for unpacking

      • SetupTCPDriver.exe (PID: 3556)

    • Detected use of alternative data streams (AltDS)

      • SetupTCPDriver.exe (PID: 3556)
      • Helper.exe (PID: 2032)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 1544)

    • Starts CMD.EXE for commands execution

      • SetupTCPDriver.exe (PID: 3556)
      • Bubbles.scr (PID: 448)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3352)

    • Reads browser cookies

      • Bubbles.scr (PID: 448)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 1652)
      • cmd.exe (PID: 3744)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1652)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Bubbles.scr (PID: 448)

    • The process executes via Task Scheduler

      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3600)

    • Application launched itself

      • Helper.exe (PID: 2032)

    • Adds/modifies Windows certificates

      • SetupTCPDriver.exe (PID: 3556)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Bubbles.scr (PID: 448)

    • Connects to unusual port

      • tor.exe (PID: 3888)

    • Checks for external IP

      • Bubbles.scr (PID: 448)

  • INFO

    • Checks supported languages

      • 888 Rat v1.2.6.exe (PID: 844)
      • SetupTCPDriver.exe (PID: 3556)
      • Bubbles.scr (PID: 448)
      • 888 Builder.exe (PID: 1840)
      • CL_Debug_Log.txt (PID: 2424)
      • chcp.com (PID: 2416)
      • chcp.com (PID: 3108)
      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3600)
      • Helper.exe (PID: 3060)
      • tor.exe (PID: 3888)
      • flagx.exe (PID: 2916)
      • Helper.exe (PID: 3348)

    • Reads the computer name

      • 888 Rat v1.2.6.exe (PID: 844)
      • Bubbles.scr (PID: 448)
      • SetupTCPDriver.exe (PID: 3556)
      • CL_Debug_Log.txt (PID: 2424)
      • 888 Builder.exe (PID: 1840)
      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3060)
      • tor.exe (PID: 3888)
      • flagx.exe (PID: 2916)
      • Helper.exe (PID: 3348)

    • Application launched itself

      • iexplore.exe (PID: 2124)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2124)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2504)
      • iexplore.exe (PID: 2124)

    • Create files in a temporary directory

      • 888 Rat v1.2.6.exe (PID: 844)
      • SetupTCPDriver.exe (PID: 3556)
      • 888 Builder.exe (PID: 1840)
      • flagx.exe (PID: 2916)
      • CL_Debug_Log.txt (PID: 2424)
      • Bubbles.scr (PID: 448)

    • Reads mouse settings

      • SetupTCPDriver.exe (PID: 3556)
      • 888 Builder.exe (PID: 1840)
      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3600)

    • Reads the machine GUID from the registry

      • Bubbles.scr (PID: 448)
      • SetupTCPDriver.exe (PID: 3556)
      • 888 Builder.exe (PID: 1840)
      • Helper.exe (PID: 2032)
      • tor.exe (PID: 3888)

    • Reads Environment values

      • Bubbles.scr (PID: 448)

    • Reads the software policy settings

      • SetupTCPDriver.exe (PID: 3556)
      • Bubbles.scr (PID: 448)

    • Creates files or folders in the user directory

      • SetupTCPDriver.exe (PID: 3556)
      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3060)
      • Bubbles.scr (PID: 448)
      • tor.exe (PID: 3888)

    • Reads CPU info

      • Bubbles.scr (PID: 448)

    • The dropped object may contain a URL to Tor Browser

      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3060)

    • Dropped object may contain TOR URL's

      • Helper.exe (PID: 2032)
      • Helper.exe (PID: 3060)

    • Checks proxy server information

      • 888 Builder.exe (PID: 1840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

StormKitty

(PID) Process(448) Bubbles.scr
C2 (1)127.0.0.1
Ports (3)6606
7707
8808
Credentials
Protocoltelegram
URLhttps://api.telegram.org/bot5292408150:AAHAPbTr2Jc9L4hgsfkDkvfw_hISg6lPMMI/send
Token5393393816:AAEAXp-5zN1DxlsNGsPhc99RWe99d19vZ3I
ChatId-1001523505230
BotnetDefault
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OB...
Server_SignatureJ7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3...
Keys
AESe5e3972eba013063607e705973dfdf80a8555bcfd8fe09651da2ab43b5773d9b
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
27
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs 888 rat v1.2.6.exe no specs 888 rat v1.2.6.exe powershell.exe no specs setuptcpdriver.exe #STORMKITTY bubbles.scr 888 builder.exe cl_debug_log.txt cmd.exe no specs schtasks.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs cmd.exe no specs netsh.exe no specs chcp.com no specs helper.exe helper.exe no specs helper.exe tor.exe flagx.exe no specs helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
448"C:\Windows\Bubbles.scr" /SC:\Windows\Bubbles.scr
888 Rat v1.2.6.exe
User:
admin
Integrity Level:
HIGH
Description:
Client
Version:
1.0.0.0
Modules
Images
c:\windows\bubbles.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
StormKitty
(PID) Process(448) Bubbles.scr
C2 (1)127.0.0.1
Ports (3)6606
7707
8808
Credentials
Protocoltelegram
URLhttps://api.telegram.org/bot5292408150:AAHAPbTr2Jc9L4hgsfkDkvfw_hISg6lPMMI/send
Token5393393816:AAEAXp-5zN1DxlsNGsPhc99RWe99d19vZ3I
ChatId-1001523505230
BotnetDefault
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OB...
Server_SignatureJ7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3...
Keys
AESe5e3972eba013063607e705973dfdf80a8555bcfd8fe09651da2ab43b5773d9b
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
844"C:\Users\admin\AppData\Local\Temp\Rar$EXa2504.27943\888 Rat v1.2.6.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2504.27943\888 Rat v1.2.6.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2504.27943\888 rat v1.2.6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
896netsh wlan show profile C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1544"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAYgB2ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAagBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAZQBhACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAagBkACMAPgA="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—888 Rat v1.2.6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1652"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr AllC:\Windows\System32\cmd.exe—Bubbles.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1820timeout /t 0C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
1840"C:\Users\admin\AppData\Local\Temp\888 Builder.exe" C:\Users\admin\AppData\Local\Temp\888 Builder.exe
888 Rat v1.2.6.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225547
Modules
Images
c:\users\admin\appdata\local\temp\888 builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2032C:\Users\admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheckC:\Users\admin\AppData\Roaming\Microsoft\Windows\Helper.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2080netsh wlan show networks mode=bssidC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2124"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.upload.ee/files/15529307/888_Rat_v1.2.6.zip.html"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
51 618
Read events
51 203
Write events
367
Delete events
48

Modification events

(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31096143
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31096143
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2124) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
34
Suspicious files
96
Text files
494
Unknown types
123

Dropped files

PID
Process
Filename
Type
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ubr__style[1].csstext
MD5:7B9692D4CAECCCF38E40D2333F8E00B0
SHA256:C4042306388924B75AA7D584C1E61165264967A52D09544ECBA836F0D00EB9B9
2856iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14561BF7422BB6F70A9CB14F5AA8A7DA_582DC597430784041BB93D3718D1C412binary
MD5:63367A0EA158FE0C71C9C4B85CF3163E
SHA256:2A4F6A4740D580DE7919CE4C57B295C04F1357D339FD798ECA7E6F379D15001D
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\js__file_upload[1].jstext
MD5:66684709338F7239056FF3302E16BC4A
SHA256:5163E50A8FE4549A8CA064E266DE9C8E6AEBD1D848185E0931959824A4D32C0F
2856iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:E58D69C8560519E99356DA1DF1036C42
SHA256:D1E1CE38F220893CBC070EC3ED94EACF546C1F5A9FF1F1D0F4AD1356C03879A0
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\888_Rat_v1.2.6.zip[1].htmhtml
MD5:22142E08758D52B1097A2E71EE8A0EF1
SHA256:B30AA42DC2ECEE5FBFC829BDED7C17E6B1BCB0E96AA8D1637549FDB0FD2477F0
2856iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\62RRP814.txttext
MD5:0AF7C5D5B3E0827DD123B11026D6EF72
SHA256:5C5AF6F664DF405DAC9473B7396FBFD1F42E1B1841EE461060356122352DE736
2856iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:9C347BEA7CC577EBC3B0707CC1FA262E
SHA256:702BF21F57FEB6D1A0E7F16509F61271CE1D99B1874C940F10D96C7CCE74D59D
2856iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:F93CC3F7BDB370A0D2D248EA6C6F4B1D
SHA256:AC74F045858ECC235DC541A0C988070C0F2DCF54DF88F1AC9F8F567BFBF3EF26
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\dl_[1].pngimage
MD5:F3E8F284A4E98CDB91B6ABFC142D94A4
SHA256:2F13919383F54CA21E5B87F5644DF8A875B99815C821DCBBABEA352D854C6882
2856iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:2852C388E499E79993FFD4E5E3688077
SHA256:D4293558313FB74D73D58A7C65D9D69AB8AD9E5A2CAF3A6D12C73BA52B576173
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
61
DNS requests
32
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2856
iexplore.exe
GET
304
184.24.77.186:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4a9ffd2bb8e04402
unknown
—
—
unknown
2856
iexplore.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a08f35fbea17b647
unknown
—
—
unknown
2856
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
binary
471 b
unknown
2856
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEAHqRFnqJyQkmYqUpX34D7k%3D
unknown
binary
727 b
unknown
2856
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
2856
iexplore.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
2856
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2856
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
2856
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
2856
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD6BeWhIbleexId20FpK0af
unknown
binary
472 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2856
iexplore.exe
51.91.30.159:443
www.upload.ee
OVH SAS
FR
unknown
2856
iexplore.exe
184.24.77.186:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2856
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2856
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2856
iexplore.exe
143.204.205.91:443
du0pud0sdlmzf.cloudfront.net
AMAZON-02
US
unknown
2856
iexplore.exe
142.250.185.72:443
www.googletagmanager.com
GOOGLE
US
unknown
2856
iexplore.exe
142.250.186.98:443
pagead2.googlesyndication.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.upload.ee
  • 51.91.30.159
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.186
  • 184.24.77.193
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
s7.addthis.com
  • 23.45.238.53
whitelisted
www.googletagmanager.com
  • 142.250.185.72
whitelisted
du0pud0sdlmzf.cloudfront.net
  • 143.204.205.91
  • 143.204.205.67
  • 143.204.205.52
  • 143.204.205.78
unknown
pagead2.googlesyndication.com
  • 142.250.186.98
whitelisted
o.ss2.us
  • 108.138.2.173
  • 108.138.2.107
  • 108.138.2.10
  • 108.138.2.195
whitelisted
ocsp.pki.goog
  • 142.250.181.227
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.245.39.64
whitelisted

Threats

PID
Process
Class
Message
3556
SetupTCPDriver.exe
Potential Corporate Privacy Violation
ET POLICY IP Logger Redirect Domain in SNI
448
Bubbles.scr
Potential Corporate Privacy Violation
ET POLICY Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI)
448
Bubbles.scr
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
448
Bubbles.scr
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
1080
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
448
Bubbles.scr
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
448
Bubbles.scr
Misc activity
ET HUNTING Telegram API Certificate Observed
448
Bubbles.scr
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
—
—
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.upload.ee/files/15529307/888_Rat_v1.2.6.zip.html