analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RFQ-20203003.arj

Full analysis: https://app.any.run/tasks/0d5bdff7-f704-4ffb-b815-9ab22cdb65a3
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: March 31, 2020, 07:15:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F9374F181A491DA15DFEE90074071BAA

SHA1:

497DC7F3505B560B85E1B9B814EF3E12796ABD73

SHA256:

69B060D207D96639BACFF19687FD2F8C9028E5E799C6C8B92A4DD1140E8D7692

SSDEEP:

384:JtMehGk7b9HwklPRtD9q9mLssYb3IpAi69iV:jMg3Z7lPR1fLsRb4OXQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RFQ-20203003.exe (PID: 2972)
      • RFQ-20203003.exe (PID: 2348)
    • Connects to CnC server

      • RFQ-20203003.exe (PID: 2972)
    • AZORULT was detected

      • RFQ-20203003.exe (PID: 2972)
    • Loads dropped or rewritten executable

      • RFQ-20203003.exe (PID: 2972)
    • Actions looks like stealing of personal data

      • RFQ-20203003.exe (PID: 2972)
    • Changes settings of System certificates

      • RFQ-20203003.exe (PID: 2972)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • RFQ-20203003.exe (PID: 2972)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2728)
      • RFQ-20203003.exe (PID: 2972)
    • Creates files in the user directory

      • RFQ-20203003.exe (PID: 2972)
    • Connects to server without host name

      • RFQ-20203003.exe (PID: 2972)
    • Reads the cookies of Google Chrome

      • RFQ-20203003.exe (PID: 2972)
    • Reads the cookies of Mozilla Firefox

      • RFQ-20203003.exe (PID: 2972)
    • Adds / modifies Windows certificates

      • RFQ-20203003.exe (PID: 2972)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe rfq-20203003.exe no specs #AZORULT rfq-20203003.exe

Process information

PID
CMD
Path
Indicators
Parent process
2728"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RFQ-20203003.arj.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2348"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
2972"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exe
RFQ-20203003.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Total events
4 024
Read events
455
Write events
0
Delete events
0

Modification events

No data
Executable files
49
Suspicious files
6
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2972RFQ-20203003.exeC:\Users\admin\AppData\Local\Temp\Cab4EFE.tmp
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\Local\Temp\Tar4EFF.tmp
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29der
MD5:75D636BF532AFFBC75F461235C3B4D5C
SHA256:727247C8DCAC2B6B8A4F5890F1BCE6F8AF87B49BC38F97308E706A6A313B66AF
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:1197217DACC647FB30F0B9DDE3861ADA
SHA256:5CEB5261E9D36646D64846091A0CC0D8DC3FF0600D573F371A56F531BEB75D8C
2728WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exeexecutable
MD5:A2705F1F0C1D11E023F8772534129695
SHA256:2C0F228D1B14721509922904FF7F9E5B89B06C60E54EAD20147643B9A0D02735
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72der
MD5:F26B1B29960D99AD1C44E71E3D2ABE4C
SHA256:7910B27AFDEE20EA27C4FA19221B1B63E00235E261E1A3FB9F1FB3456CBBB7AC
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bder
MD5:E550DA03AEE5B546B436CD553D3233B9
SHA256:9ABFD4E29B96CCA442502B1DE6071FE0293455DF22B4EFF19FA3E6DF060947E7
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72binary
MD5:E29EAE88EBFD538CB22D3035ED37D3B6
SHA256:6EF6E38DE2BE5E4FD41CB65077057154E25328F5E481960435A1FFD35A6993DD
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29binary
MD5:4D38F54B6ABEB7EDDD09393C10A6019D
SHA256:80FD0203B11FA79D3CFDFE71CD80F72211FB05BA9FEBF2164F240E2988666CC5
2972RFQ-20203003.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\I4XN5B6K.txttext
MD5:41CDE32F59823D3041225062F83F3E12
SHA256:2F54482D13F0ABE2FEFDE61F75E17997A083374CD8195BBA9886DD6653065C02
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
RFQ-20203003.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFOOHQjK5IlqCAAAAAAyCmA%3D
US
der
471 b
whitelisted
2972
RFQ-20203003.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDL%2FQslYWVuogIAAAAAXGdc
US
der
472 b
whitelisted
2972
RFQ-20203003.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2972
RFQ-20203003.exe
POST
200
192.227.215.147:80
http://192.227.215.147/panel/index.php
US
txt
4.27 Mb
malicious
2972
RFQ-20203003.exe
POST
200
192.227.215.147:80
http://192.227.215.147/panel/index.php
US
text
5 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
RFQ-20203003.exe
216.58.207.78:443
drive.google.com
Google Inc.
US
whitelisted
2972
RFQ-20203003.exe
192.227.215.147:80
ColoCrossing
US
malicious
2972
RFQ-20203003.exe
172.217.23.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2972
RFQ-20203003.exe
172.217.23.97:443
doc-00-cc-docs.googleusercontent.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 216.58.207.78
shared
ocsp.pki.goog
  • 172.217.23.99
whitelisted
doc-00-cc-docs.googleusercontent.com
  • 172.217.23.97
whitelisted

Threats

PID
Process
Class
Message
2972
RFQ-20203003.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2972
RFQ-20203003.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.2 Client Checkin M3
2972
RFQ-20203003.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2972
RFQ-20203003.exe
A Network Trojan was detected
AV TROJAN AZORult CnC Beacon
2972
RFQ-20203003.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult
2972
RFQ-20203003.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2972
RFQ-20203003.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
2972
RFQ-20203003.exe
A Network Trojan was detected
ET TROJAN AZORult v3.2 Server Response M2
2972
RFQ-20203003.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2972
RFQ-20203003.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
1 ETPRO signatures available at the full report
No debug info