File name:

Extreme.Injector.v3.7.3.-.by.master131.rar

Full analysis: https://app.any.run/tasks/cab34ade-7c86-4113-bb35-a22b3f49fbc0
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: April 29, 2021, 13:22:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nanocore
rat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

0A22EFE1EBD78874113CDFEE1B95A79A

SHA1:

D53FE1D771CE12490D964B0C2A0D99BE065E45E4

SHA256:

6BDE3323810EA414F9C0EF3CE270198EFBAD0766D1BD569048CDC2065DCA9106

SSDEEP:

49152:m5OL2kcXusNDEtkxqvOt9E6Jce2aBU2ibC1cKyO46QKcKyAwDnx:msL2kMEtKqKE6JBpibCtOtnx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Extreme Injector v3.exe (PID: 1736)
      • WinRAR.exe (PID: 4052)
      • crypted554.exe (PID: 1336)
      • cmd.exe (PID: 3808)

    • Application was dropped or rewritten from another process

      • Extreme Injector v3.exe (PID: 1736)
      • crypted554.exe (PID: 1336)
      • Extreme Injector v3.exe (PID: 3152)
      • cmd.exe (PID: 3212)
      • Extreme Injector v3.exe (PID: 2616)

    • Changes the autorun value in the registry

      • crypted554.exe (PID: 1336)

    • Connects to CnC server

      • cmd.exe (PID: 3212)

    • NANOCORE was detected

      • cmd.exe (PID: 3212)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • Extreme Injector v3.exe (PID: 1736)
      • crypted554.exe (PID: 1336)
      • cmd.exe (PID: 3808)

    • Uses REG.EXE to modify Windows registry

      • crypted554.exe (PID: 1336)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)
      • Extreme Injector v3.exe (PID: 1736)
      • crypted554.exe (PID: 1336)
      • cmd.exe (PID: 3808)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 4052)
      • crypted554.exe (PID: 1336)

    • Starts CMD.EXE for commands execution

      • crypted554.exe (PID: 1336)
      • wscript.exe (PID: 3064)

    • Executes scripts

      • cmd.exe (PID: 2192)

    • Creates files in the Windows directory

      • crypted554.exe (PID: 1336)

    • Creates files in the user directory

      • cmd.exe (PID: 3212)

    • Reads Environment values

      • Extreme Injector v3.exe (PID: 2616)

    • Application launched itself

      • Extreme Injector v3.exe (PID: 3152)

  • INFO

    • Manual execution by user

      • Extreme Injector v3.exe (PID: 1736)
      • WinRAR.exe (PID: 4052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: Extreme.Injector.v3.7.3.-.by.master131\Extreme Injector v3.exe
PackingMethod: Normal
ModifyDate: 2021:04:29 17:17:06
OperatingSystem: Win32
UncompressedSize: 2072700
CompressedSize: 1945416
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs winrar.exe extreme injector v3.exe extreme injector v3.exe no specs crypted554.exe cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs #NANOCORE cmd.exe wscript.exe no specs cmd.exe extreme injector v3.exe

Process information

PID
CMD
Path
Indicators
Parent process
900REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /fC:\Windows\system32\REG.exe—crypted554.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1336"C:\Users\admin\AppData\Local\Temp\crypted554.exe" C:\Users\admin\AppData\Local\Temp\crypted554.exe
Extreme Injector v3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Offer Library Container
Exit code:
0
Version:
1.0.0.88
Modules
Images
c:\users\admin\appdata\local\temp\crypted554.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1544"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Extreme.Injector.v3.7.3.-.by.master131.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1736"C:\Users\admin\Desktop\Extreme.Injector.v3.7.3.-.by.master131\Extreme Injector v3.exe" C:\Users\admin\Desktop\Extreme.Injector.v3.7.3.-.by.master131\Extreme Injector v3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\extreme.injector.v3.7.3.-.by.master131\extreme injector v3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2192cmd /c ""C:\Users\admin\AppData\Local\Temp\mata.bat" "C:\Windows\system32\cmd.exe—crypted554.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2404REG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /fC:\Windows\system32\REG.exe—crypted554.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2440REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\system32\REG.exe—crypted554.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2616"C:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exe" C:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exe
Extreme Injector v3.exe
User:
admin
Company:
master131
Integrity Level:
HIGH
Description:
Extreme Injector
Exit code:
0
Version:
3.7.3.0
Modules
Images
c:\users\admin\appdata\local\temp\extreme injector v3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2708REG add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /fC:\Windows\system32\REG.exe—crypted554.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3064wscript.exe "C:\Users\admin\AppData\Local\Temp\invs.vbs" "C:\Users\admin\AppData\Local\Temp\mata2.batC:\Windows\system32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 916
Read events
1 861
Write events
55
Delete events
0

Modification events

(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1544) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1544) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Extreme.Injector.v3.7.3.-.by.master131.rar
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
6
Suspicious files
0
Text files
6
Unknown types
2

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\Desktop\Extreme.Injector.v3.7.3.-.by.master131\Extreme Injector v3.exeexecutable
MD5:—
SHA256:—
4052WinRAR.exeC:\Users\admin\Desktop\Extreme.Injector.v3.7.3.-.by.master131\readme.txttext
MD5:—
SHA256:—
1736Extreme Injector v3.exeC:\Users\admin\AppData\Local\Temp\crypted554.exeexecutable
MD5:—
SHA256:—
1336crypted554.exeC:\Users\admin\AppData\Local\Temp\per.battext
MD5:—
SHA256:—
3808cmd.exeC:\Users\admin\AppData\Local\Temp\yaoffer50160.exeexecutable
MD5:—
SHA256:—
3212cmd.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datfli
MD5:—
SHA256:—
1736Extreme Injector v3.exeC:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exeexecutable
MD5:EC801A7D4B72A288EC6C207BB9FF0131
SHA256:B65F40618F584303CA0BCF9B5F88C233CC4237699C0C4BF40BA8FACBE8195A46
1336crypted554.exeC:\Users\admin\AppData\Local\Temp\rundll32-.txtexecutable
MD5:—
SHA256:—
1336crypted554.exeC:\Users\admin\AppData\Local\Temp\mata2.battext
MD5:—
SHA256:—
2616Extreme Injector v3.exeC:\Users\admin\AppData\Local\Temp\settings.xmlxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3212
cmd.exe
8.8.8.8:53
—
Google Inc.
US
malicious
3212
cmd.exe
37.1.218.71:1602
qwertyontop.ddns.net
Leaseweb Deutschland GmbH
DE
malicious
2616
Extreme Injector v3.exe
185.199.108.133:443
raw.githubusercontent.com
GitHub, Inc.
NL
malicious

DNS requests

Domain
IP
Reputation
qwertyontop.ddns.net
  • 37.1.218.71
unknown
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared

Threats

PID
Process
Class
Message
3212
cmd.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3212
cmd.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Extreme.Injector.v3.7.3.-.by.master131.rar