File name:

SMS-Bomber [0.2.1] by Artem Zolotarevskiy.rar

Full analysis: https://app.any.run/tasks/36300a3e-026c-476f-9a72-04329867fddf
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 18, 2020, 07:46:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1D1220A55D65E67F30324C3708BC5FF7

SHA1:

CA9AF55711A5B4CB1A56C8A2BCC55C641BB7CBB8

SHA256:

784C18E27262ECEAE8579DAB14E277C4B662FC8431960422C062C80A2C4F9E52

SSDEEP:

49152:XEZv+5wfncf63453ajuSlS0FiQRKVMUbB1EJm:Xuyw/BCayShiWGMUd1EA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe (PID: 2720)
      • SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe (PID: 3364)

    • Loads dropped or rewritten executable

      • SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe (PID: 3364)
      • SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe (PID: 2720)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe (PID: 3364)
      • SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe (PID: 2720)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2844)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sms-bomber [0.2.1] by artem zolotarevskiy.exe sms-bomber [0.2.1] by artem zolotarevskiy.exe

Process information

PID
CMD
Path
Indicators
Parent process
2720"C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
WinRAR.exe
User:
admin
Company:
ScripTop Company
Integrity Level:
MEDIUM
Description:
SMS-Bomber [0.2.1] by Artem Zolotarevskiy
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2844.24964\sms-bomber [0.2.1] by artem zolotarevskiy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3364"C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
WinRAR.exe
User:
admin
Company:
ScripTop Company
Integrity Level:
MEDIUM
Description:
SMS-Bomber [0.2.1] by Artem Zolotarevskiy
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2844.23777\sms-bomber [0.2.1] by artem zolotarevskiy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
493
Read events
476
Write events
17
Delete events
0

Modification events

(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.rar
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
8
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\libeay32.dllexecutable
MD5:177BDA0C92482DFA2C162A3750932B9C
SHA256:17A4B75EF43A4FDEEDAEF86C39BEAD6719144E3E368B55898B79ECB371012854
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exeexecutable
MD5:83F6419032487A8D15DDDC566970A8BF
SHA256:CF2D9D354909FE3C4642C104B0F6E7566713BAF466BC4FDE1208A7202CF2417E
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exeexecutable
MD5:83F6419032487A8D15DDDC566970A8BF
SHA256:CF2D9D354909FE3C4642C104B0F6E7566713BAF466BC4FDE1208A7202CF2417E
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\ssleay32.dllexecutable
MD5:5023F4C4AAAA1B6E9D992D6BBDCD340B
SHA256:59B1BE1072DD4ACA5DDCF9B66D5DF8BEC327B4891925BA2339FE6AC6A1BF6D19
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\Skins\default.aszbinary
MD5:58D2975CCB969D5C8AC1D13103139159
SHA256:8968820FD2780710E90B861DAC7ED5870B46EED95E94011374679A659DC15BED
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\ssleay32.dllexecutable
MD5:5023F4C4AAAA1B6E9D992D6BBDCD340B
SHA256:59B1BE1072DD4ACA5DDCF9B66D5DF8BEC327B4891925BA2339FE6AC6A1BF6D19
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\Skins\default.aszbinary
MD5:58D2975CCB969D5C8AC1D13103139159
SHA256:8968820FD2780710E90B861DAC7ED5870B46EED95E94011374679A659DC15BED
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\msvcr71.dllexecutable
MD5:86F1895AE8C5E8B17D99ECE768A70732
SHA256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.23777\msvcr71.dllexecutable
MD5:86F1895AE8C5E8B17D99ECE768A70732
SHA256:8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.24964\libeay32.dllexecutable
MD5:177BDA0C92482DFA2C162A3750932B9C
SHA256:17A4B75EF43A4FDEEDAEF86C39BEAD6719144E3E368B55898B79ECB371012854
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
10
DNS requests
8
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
POST
—
194.58.56.111:80
http://www.theyeru.ru/api/sms-bomber/method/description.get.php
RU
—
—
malicious
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
POST
303
31.31.196.146:80
http://www.777taxi.ru/swift-online/ValidateViaSms.php
RU
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3364
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
194.58.56.111:80
www.theyeru.ru
Domain names registrar REG.RU, Ltd
RU
malicious
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
194.58.56.111:80
www.theyeru.ru
Domain names registrar REG.RU, Ltd
RU
malicious
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
31.31.196.146:80
www.777taxi.ru
Domain names registrar REG.RU, Ltd
RU
unknown
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
34.98.85.228:443
beepcar.ru
—
US
unknown
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
178.248.237.53:443
taximaxim.ru
HLL LLC
RU
unknown
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
81.19.78.90:443
id.rambler.ru
Rambler Internet Holding LLC
RU
suspicious
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
213.180.204.24:443
passport.yandex.ru
YANDEX LLC
RU
whitelisted
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
104.18.29.46:443
ru.gett.com
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
www.theyeru.ru
  • 194.58.56.111
malicious
www.777taxi.ru
  • 31.31.196.146
suspicious
beepcar.ru
  • 34.98.85.228
whitelisted
taximaxim.ru
  • 178.248.237.53
whitelisted
id.rambler.ru
  • 81.19.78.90
  • 81.19.78.88
  • 81.19.78.89
  • 81.19.78.87
whitelisted
ru.gett.com
  • 104.18.29.46
  • 104.18.28.46
suspicious
passport.yandex.ru
  • 213.180.204.24
whitelisted

Threats

PID
Process
Class
Message
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
A Network Trojan was detected
ET TROJAN SMS-Bomber Activity
2720
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SMS-Bomber [0.2.1] by Artem Zolotarevskiy.rar