analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Request.for Pr.list (2).zip

Full analysis: https://app.any.run/tasks/5c4679e8-f5c6-4eca-82be-2b4acbd7e9cc
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: March 21, 2019, 08:22:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FE7F173061E0A8565EBA5E80F878C417

SHA1:

46CB389EB394AFFDE22A273EAF0D51A0560B40A6

SHA256:

719B5377BBADD87D5051C4F2024BACD3E25DB48C84B448E047A6F01D5F2362ED

SSDEEP:

6144:r/QrIMSzcAxG1dVz2E1ZDXjsC9yYrSbM2qmd/wkFdzN16rgfYgJgGLDP+1D3aCsb:r/yIMSzcr1dRPPd9yWSAnmdwkXzN1eno

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Request..for Pr...list.exe (PID: 944)
      • Request..for Pr...list.exe (PID: 2428)
    • Changes the autorun value in the registry

      • Request..for Pr...list.exe (PID: 944)
    • Connects to CnC server

      • Request..for Pr...list.exe (PID: 944)
    • NanoCore was detected

      • Request..for Pr...list.exe (PID: 944)
  • SUSPICIOUS

    • Creates files in the user directory

      • Request..for Pr...list.exe (PID: 944)
    • Application launched itself

      • Request..for Pr...list.exe (PID: 2428)
    • Connects to unusual port

      • Request..for Pr...list.exe (PID: 944)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 864)
      • Request..for Pr...list.exe (PID: 944)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Request..for Pr...list.exe
ZipUncompressedSize: 757760
ZipCompressedSize: 363466
ZipCRC: 0x51cd1a5e
ZipModifyDate: 2019:03:20 20:00:13
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe request..for pr...list.exe no specs #NANOCORE request..for pr...list.exe

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Request.for Pr.list (2).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2428"C:\Users\admin\AppData\Local\Temp\Rar$EXa864.9878\Request..for Pr...list.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa864.9878\Request..for Pr...list.exeWinRAR.exe
User:
admin
Company:
Mozilla
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
4.42
944"C:\Users\admin\AppData\Local\Temp\Rar$EXa864.9878\Request..for Pr...list.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa864.9878\Request..for Pr...list.exe
Request..for Pr...list.exe
User:
admin
Company:
Mozilla
Integrity Level:
MEDIUM
Description:
Firefox
Version:
4.42
Total events
564
Read events
540
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
944Request..for Pr...list.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:6CE2910EAC4C0DFDD09F4D1A5B010891
SHA256:3F412DC4947032CD26B082376D401FD330B7E47A5F381BE962567FE780EA6637
864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa864.9878\Request..for Pr...list.exeexecutable
MD5:759616F80ABEA9CBB499D0E120607313
SHA256:7281FF9D6FEC5D51EB91C2FFE6E3615A05C6B17D7DCC20806693C7B19CBCB78D
944Request..for Pr...list.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:759616F80ABEA9CBB499D0E120607313
SHA256:7281FF9D6FEC5D51EB91C2FFE6E3615A05C6B17D7DCC20806693C7B19CBCB78D
2428Request..for Pr...list.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\win.initext
MD5:D2A2412BDDBA16D60EC63BD9550D933F
SHA256:79FF2254E38192BE1626D05BEC6C82E10C85E1CF91DF7440C4C443380A1E877A
944Request..for Pr...list.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:963D5E2C9C0008DFF05518B47C367A7F
SHA256:5EACF2974C9BB2C2E24CDC651C4840DD6F4B76A98F0E85E90279F1DBB2E6F3C0
944Request..for Pr...list.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\win.initext
MD5:D2A2412BDDBA16D60EC63BD9550D933F
SHA256:79FF2254E38192BE1626D05BEC6C82E10C85E1CF91DF7440C4C443380A1E877A
944Request..for Pr...list.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
944Request..for Pr...list.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
944
Request..for Pr...list.exe
91.192.100.54:54967
divinevilla.hopto.org
SOFTplus Entwicklungen GmbH
CH
malicious

DNS requests

Domain
IP
Reputation
divinevilla.hopto.org
  • 91.192.100.54
malicious

Threats

PID
Process
Class
Message
944
Request..for Pr...list.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
944
Request..for Pr...list.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
944
Request..for Pr...list.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
944
Request..for Pr...list.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
944
Request..for Pr...list.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
944
Request..for Pr...list.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
944
Request..for Pr...list.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
944
Request..for Pr...list.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
944
Request..for Pr...list.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
944
Request..for Pr...list.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
20 ETPRO signatures available at the full report
No debug info