analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Cyberghost Latest Version [Cracked] (1).rar

Full analysis: https://app.any.run/tasks/22297505-a682-497a-b1d1-609a2adc62a9
Verdict: Malicious activity
Analysis date: November 08, 2018, 09:15:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

8C49252FB9FD5EF3F4644D7A4C96D605

SHA1:

5758F16F35BD2B6608CED7F3F3F46F3734248CB0

SHA256:

6D469A023AE548C7B80BEAC3BFCB2E1B7E45D5DBF4C9C943AC02DFF2B9F8E31F

SSDEEP:

393216:zzZZ/HTs8FYJa2QdVwz2XUu17vapO1bHWEcZ/u5S//lkk99QexkcvI8:zznbs8+JB/ziUI7ipO1bH6J/ya5qcA8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CyberGhost.Service.exe (PID: 2620)
      • CyberGhost.Service.exe (PID: 3112)
      • CyberGhost.exe (PID: 2560)
      • tap-windows-9.21.2.exe (PID: 2036)
      • tapinstall.exe (PID: 3988)
      • nsCF15.tmp (PID: 3120)
      • nsD06D.tmp (PID: 1880)
      • tapinstall.exe (PID: 2304)
      • wyUpdate.exe (PID: 1100)

    • Loads dropped or rewritten executable

      • CyberGhost.Service.exe (PID: 3112)
      • CyberGhost.exe (PID: 2560)
      • CyberGhost.Service.exe (PID: 2620)
      • tap-windows-9.21.2.exe (PID: 2036)

    • Actions looks like stealing of personal data

      • CyberGhost.exe (PID: 2560)
      • CyberGhost.Service.exe (PID: 2620)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Full CyberGhost_6.0.6.2540_Cracksu.com.exe (PID: 3028)
      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)
      • tap-windows-9.21.2.exe (PID: 2036)
      • DrvInst.exe (PID: 2232)
      • tapinstall.exe (PID: 2304)
      • DrvInst.exe (PID: 1256)

    • Reads Windows owner or organization settings

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Creates or modifies windows services

      • CyberGhost.Service.exe (PID: 2620)
      • CyberGhost.Service.exe (PID: 3112)
      • DrvInst.exe (PID: 2232)

    • Creates files in the user directory

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Creates files in the program directory

      • CyberGhost.Service.exe (PID: 3112)
      • tap-windows-9.21.2.exe (PID: 2036)

    • Reads Environment values

      • CyberGhost.exe (PID: 2560)
      • CyberGhost.Service.exe (PID: 2620)

    • Reads the Windows organization settings

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Changes IE settings (feature browser emulation)

      • CyberGhost.exe (PID: 2560)

    • Starts application with an unusual extension

      • tap-windows-9.21.2.exe (PID: 2036)

    • Creates files in the Windows directory

      • tapinstall.exe (PID: 2304)
      • DrvInst.exe (PID: 2232)
      • wyUpdate.exe (PID: 1100)
      • DrvInst.exe (PID: 1256)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2232)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2232)
      • wyUpdate.exe (PID: 1100)
      • DrvInst.exe (PID: 1256)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2232)
      • DrvInst.exe (PID: 1256)

    • Searches for installed software

      • DrvInst.exe (PID: 2232)

  • INFO

    • Application was dropped or rewritten from another process

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Creates a software uninstall entry

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Dropped object may contain Bitcoin addresses

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Creates files in the program directory

      • Full CyberGhost_6.0.6.2540_Cracksu.com.tmp (PID: 3252)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2232)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3316)

    • Creates or modifies windows services

      • vssvc.exe (PID: 3316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
17
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winrar.exe no specs full cyberghost_6.0.6.2540_cracksu.com.exe full cyberghost_6.0.6.2540_cracksu.com.tmp cyberghost.exe cyberghost.service.exe no specs cyberghost.service.exe tap-windows-9.21.2.exe nscf15.tmp no specs tapinstall.exe no specs nsd06d.tmp no specs tapinstall.exe drvinst.exe rundll32.exe no specs wyupdate.exe vssvc.exe no specs drvinst.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
3984"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Cyberghost Latest Version [Cracked] (1).rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3028"C:\Users\admin\Desktop\Cyberghost Latest Version [Cracked]\Setup\Full CyberGhost_6.0.6.2540_Cracksu.com.exe" C:\Users\admin\Desktop\Cyberghost Latest Version [Cracked]\Setup\Full CyberGhost_6.0.6.2540_Cracksu.com.exe
explorer.exe
User:
admin
Company:
CyberGhost S.R.L.
Integrity Level:
HIGH
Description:
CyberGhost 6
Version:
6.0.4
3252"C:\Users\admin\AppData\Local\Temp\is-R9G5K.tmp\Full CyberGhost_6.0.6.2540_Cracksu.com.tmp" /SL5="$901DE,15011427,150528,C:\Users\admin\Desktop\Cyberghost Latest Version [Cracked]\Setup\Full CyberGhost_6.0.6.2540_Cracksu.com.exe" C:\Users\admin\AppData\Local\Temp\is-R9G5K.tmp\Full CyberGhost_6.0.6.2540_Cracksu.com.tmp
Full CyberGhost_6.0.6.2540_Cracksu.com.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
2560"C:\Program Files\CyberGhost 6\CyberGhost.exe" /installC:\Program Files\CyberGhost 6\CyberGhost.exe
Full CyberGhost_6.0.6.2540_Cracksu.com.tmp
User:
admin
Company:
CyberGhost S.R.L.
Integrity Level:
HIGH
Description:
CyberGhost
Version:
6.0.6.2540
3112"C:\Program Files\CyberGhost 6\CyberGhost.Service.exe" --installC:\Program Files\CyberGhost 6\CyberGhost.Service.exe—CyberGhost.exe
User:
admin
Company:
CyberGhost S.R.L
Integrity Level:
HIGH
Description:
CyberGhost Service
Exit code:
0
Version:
6.0.6.2540
2620"C:\Program Files\CyberGhost 6\CyberGhost.Service.exe"C:\Program Files\CyberGhost 6\CyberGhost.Service.exe
services.exe
User:
SYSTEM
Company:
CyberGhost S.R.L
Integrity Level:
SYSTEM
Description:
CyberGhost Service
Version:
6.0.6.2540
2036"C:\Program Files\CyberGhost 6\Data\OpenVPN\tap-windows-9.21.2.exe" /SC:\Program Files\CyberGhost 6\Data\OpenVPN\tap-windows-9.21.2.exe
CyberGhost.exe
User:
admin
Integrity Level:
HIGH
3120"C:\Users\admin\AppData\Local\Temp\nslCEF4.tmp\nsCF15.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901C:\Users\admin\AppData\Local\Temp\nslCEF4.tmp\nsCF15.tmp—tap-windows-9.21.2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3988"C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901C:\Program Files\TAP-Windows\bin\tapinstall.exe—nsCF15.tmp
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
6.1.7600.16385 built by: WinDDK
1880"C:\Users\admin\AppData\Local\Temp\nslCEF4.tmp\nsD06D.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901C:\Users\admin\AppData\Local\Temp\nslCEF4.tmp\nsD06D.tmp—tap-windows-9.21.2.exe
User:
admin
Integrity Level:
HIGH
Total events
1 475
Read events
1 068
Write events
0
Delete events
0

Modification events

No data
Executable files
65
Suspicious files
31
Text files
725
Unknown types
25

Dropped files

PID
Process
Filename
Type
3984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3984.8149\Cyberghost Latest Version [Cracked]\Setup\Full CyberGhost_6.0.6.2540_Cracksu.com.exe —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-ED6BE.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-SG843.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-P3MJM.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-KM36T.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-QKV16.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-0027Q.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-FMIP7.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-RQG1I.tmp —
MD5:—
SHA256:—
3252Full CyberGhost_6.0.6.2540_Cracksu.com.tmpC:\Program Files\CyberGhost 6\is-S7V1E.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1100
wyUpdate.exe
GET
404
108.177.127.82:80
http://wyupdate.googlecode.com/files/client.net4.wys
US
html
1.54 Kb
whitelisted
1100
wyUpdate.exe
GET
301
104.20.63.85:80
http://wyday.com/files/wyupdate/updates/client.net4.wys
US
html
162 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1100
wyUpdate.exe
104.20.27.8:443
download.cyberghostvpn.com
Cloudflare Inc
US
shared
1100
wyUpdate.exe
104.20.63.85:443
wyday.com
Cloudflare Inc
US
shared
1100
wyUpdate.exe
104.20.63.85:80
wyday.com
Cloudflare Inc
US
shared
1100
wyUpdate.exe
108.177.127.82:80
wyupdate.googlecode.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.cyberghostvpn.com
  • 104.20.27.8
  • 104.20.26.8
whitelisted
wyupdate.googlecode.com
  • 108.177.127.82
whitelisted
wyday.com
  • 104.20.63.85
  • 104.20.62.85
unknown

Threats

No threats detected
Process
Message
CyberGhost.Service.exe
Checking for Update on https://download.cyberghostvpn.com/windows/updates/6/
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Cyberghost Latest Version [Cracked] (1).rar