File name:

LuxNET RAT Cracked.zip

Full analysis: https://app.any.run/tasks/dd79b824-3e0e-43de-9976-679cf069b394
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: March 31, 2022, 10:04:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

3B360BDD209B336819B828F1B5F3302B

SHA1:

93DBF754A0264164AC48853F9570FF4161F819FF

SHA256:

6F787CB460DA3589F4C21D303DE5432A2A5091904EF9D029B79FAAE7A5A6F013

SSDEEP:

98304:zR0PvOj3uQrJbTHr2rrJe3erv+OBhwFvbSROT:z4O3uCJb3ygeqOByOW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3616)

    • Application was dropped or rewritten from another process

      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)
      • Stub.exe (PID: 1764)
      • Stub.exe (PID: 3812)
      • j.exe (PID: 2652)

    • Drops executable file immediately after starts

      • vbc.exe (PID: 2108)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2832)
      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)
      • Stub.exe (PID: 1764)
      • j.exe (PID: 2652)
      • Stub.exe (PID: 3812)

    • Checks supported languages

      • WinRAR.exe (PID: 2832)
      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)
      • Stub.exe (PID: 1764)
      • vbc.exe (PID: 2108)
      • cvtres.exe (PID: 2416)
      • j.exe (PID: 2652)
      • Stub.exe (PID: 3812)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2832)

    • Reads Environment values

      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2832)
      • vbc.exe (PID: 2108)

    • Executes scripts

      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)

    • Drops a file with a compile date too recent

      • vbc.exe (PID: 2108)

    • Reads default file associations for system extensions

      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)

  • INFO

    • Manual execution by user

      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)
      • Stub.exe (PID: 1764)
      • Stub.exe (PID: 3812)
      • j.exe (PID: 2652)

    • Reads settings of System Certificates

      • LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe (PID: 2140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: LuxNET RAT Cracked/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2020:12:21 12:27:27
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs luxnet cracked by[ıllıllımя.hackeяsıllıllı] .exe stub.exe no specs stub.exe vbc.exe cvtres.exe no specs j.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1764"C:\Users\admin\Desktop\LuxNET RAT Cracked\Stub.exe" C:\Users\admin\Desktop\LuxNET RAT Cracked\Stub.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ILMerge
Exit code:
0
Version:
2.12.803.0
Modules
Images
c:\users\admin\desktop\luxnet rat cracked\stub.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2108"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\admin\AppData\Local\Temp\yjapfbly.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2140"C:\Users\admin\Desktop\LuxNET RAT Cracked\LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe" C:\Users\admin\Desktop\LuxNET RAT Cracked\LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe
Explorer.EXE
User:
admin
Company:
XilluX
Integrity Level:
MEDIUM
Description:
LuxNET
Exit code:
0
Version:
1.1.0.4
Modules
Images
c:\users\admin\desktop\luxnet rat cracked\luxnet cracked by[ıllıllımя.hackeяsıllıllı] .exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\rpcrt4.dll
2416C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES48D.tmp" "C:\Users\admin\AppData\Local\Temp\vbc48C.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—vbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2652"C:\Users\admin\Desktop\LuxNET RAT Cracked\j.exe" C:\Users\admin\Desktop\LuxNET RAT Cracked\j.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\luxnet rat cracked\j.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2832"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\LuxNET RAT Cracked.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3616"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3812"C:\Users\admin\Desktop\LuxNET RAT Cracked\Stub.exe" C:\Users\admin\Desktop\LuxNET RAT Cracked\Stub.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
ILMerge
Exit code:
0
Version:
2.12.803.0
Modules
Images
c:\users\admin\desktop\luxnet rat cracked\stub.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
8 628
Read events
8 426
Write events
192
Delete events
10

Modification events

(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2832) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\LuxNET RAT Cracked.zip
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
8
Suspicious files
1
Text files
35
Unknown types
2

Dropped files

PID
Process
Filename
Type
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\AForge.dllexecutable
MD5:D47353F1879F76E52D45B8C308A63ECC
SHA256:1B0E8CF7E435A552E45EC60ECAFBCBC53DFAD0180E9972484267D4BF67648337
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\AForge.Video.dllexecutable
MD5:3F2E8E0FA359AADD41190C07D23920DD
SHA256:942DBF85423F37093FD1C51E4DC31A423627568E6555E7AE29EE22B03AD32DD9
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\Icons\aac.icoimage
MD5:B9E947AD8B963E3C6D0CF42A4337FFD8
SHA256:B682C75548BF7D9AB9269C71B125180EC6AE8300F40B1053BFFEAFEEB829410E
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\Icons\bmp.icoimage
MD5:98DBD8CA36A25D03B7FA010F24299589
SHA256:FF24343F77B884279B2936ECC908AC7A07B0D4C55AAE689DE3EA5CCF19FA858D
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\Dissembler Lib.dllexecutable
MD5:4127D00B294F09835929297A6CC8FA79
SHA256:263634C93E459CE3497D54903675619C3D4B5BADBB83E26E4015CCD9035C798E
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\Icons\ini.icoimage
MD5:C61E936360BB0DDDBD170E84124ABF1B
SHA256:1F26066839008157AB55ADC34BBA75F7228A86D1B9B632ED71DC48DE1ED84CD7
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\AForge.Controls.dllexecutable
MD5:7C219D50F9E29DBB2FCA2704729405D5
SHA256:906635A17234A19795404B5AD70C763118D15722F52DC30D95D18464FF4F4A48
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\AForge.Video.DirectShow.dllexecutable
MD5:31421DBF0F52A75142839742D718858D
SHA256:1A51E214FFA7718284614D81333B2FD2F1100FE67042B24AB078F817C26950D5
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\Icons\html.icoimage
MD5:8899A9C25F10D5D175BAC0E88016AC82
SHA256:B6080B7A69D7BA032124BC29A749E75F18D22910B122D49AA9742A4994FC426F
2832WinRAR.exeC:\Users\admin\Desktop\LuxNET RAT Cracked\Icons\bat.icoimage
MD5:66F9A1D849CA4E7BF4C7E7A9FBC84410
SHA256:644E913915939711CB190A3FDD7C911CDDDD0A0CB5FABFB07EC135DB868D1C98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2140
LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe
GET
301
104.23.99.190:80
http://pastebin.com/raw.php?i=Y7A9LibH
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
104.23.99.190:80
pastebin.com
Cloudflare Inc
US
malicious
2140
LuxNET Cracked By[ıllıllıMя.Hackeяsıllıllı] .exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.23.99.190
  • 104.23.98.190
malicious

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LuxNET RAT Cracked.zip