analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zip

Full analysis: https://app.any.run/tasks/48c48b38-b33a-43a5-bdb7-b836fdd80051
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 25, 2022, 00:38:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

088AC78C1A6F8DDBEC274D9F4148A1EE

SHA1:

4391240C1D2A0A6BBA9D45448EEDAAC5E5417536

SHA256:

7B010B42859073976C027CE2C40FA24D9BA6365C0F64B7497C83AFBD24152BC1

SSDEEP:

6144:tNV2RK9VkiYk+IsdMdXRm+WanSrBFlL6pSUAS+k3l+m5gD92Az5XE7rdzAXlh85z:tf2REV0Yhm+zYmCS+srGZAh/y30Hn/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE was detected

      • AISetup.exe (PID: 2580)

    • Application was dropped or rewritten from another process

      • AISetup.exe (PID: 2580)

    • Connects to CnC server

      • AISetup.exe (PID: 2580)

    • Actions looks like stealing of personal data

      • AISetup.exe (PID: 2580)

    • Steals credentials from Web Browsers

      • AISetup.exe (PID: 2580)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 1472)
      • WinRAR.exe (PID: 3936)
      • WinRAR.exe (PID: 1372)
      • WinRAR.exe (PID: 828)
      • AISetup.exe (PID: 2580)

    • Checks supported languages

      • WinRAR.exe (PID: 1472)
      • WinRAR.exe (PID: 3936)
      • WinRAR.exe (PID: 1372)
      • WinRAR.exe (PID: 828)
      • AISetup.exe (PID: 2580)

    • Application launched itself

      • WinRAR.exe (PID: 1472)
      • WinRAR.exe (PID: 3936)
      • WinRAR.exe (PID: 1372)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 828)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 828)

    • Reads Windows owner or organization settings

      • AISetup.exe (PID: 2580)

    • Reads the cookies of Google Chrome

      • AISetup.exe (PID: 2580)

    • Reads Environment values

      • AISetup.exe (PID: 2580)

    • Reads the cookies of Mozilla Firefox

      • AISetup.exe (PID: 2580)

    • Searches for installed software

      • AISetup.exe (PID: 2580)

  • INFO

    • Checks supported languages

      • NOTEPAD.EXE (PID: 2476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2022:01:24 07:32:22
ZipCRC: 0xd28f0790
ZipCompressedSize: 436883
ZipUncompressedSize: 436813
ZipFileName: Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe no specs winrar.exe #REDLINE aisetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
1472"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
3936"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1472.30522\Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zip"C:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
2476"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3936.36546\Password.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1372"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3936.36844\Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zip"C:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
828"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb1372.37038\setup.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
2580"C:\Users\admin\AppData\Local\Temp\Rar$EXa828.38383\setup\AISetup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa828.38383\setup\AISetup.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
5 623
Read events
5 480
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3936.36844\Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zipcompressed
MD5:F0AC1C4F0C407E2B8A2DC7B8B0918E99
SHA256:1D64C665B920AEEFD042CA95BCC5291570E102402833277DE1EA8FB1E33CD699
828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa828.38383\setup\AISetup.exeexecutable
MD5:836C8A8E5F929D9655063F01DC2D8C7E
SHA256:A8A7F19E786A719143C69225FD4706597B122DD0A9364EE65ABB2AAC81CB420A
1472WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1472.30522\Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zipcompressed
MD5:F0AC1C4F0C407E2B8A2DC7B8B0918E99
SHA256:1D64C665B920AEEFD042CA95BCC5291570E102402833277DE1EA8FB1E33CD699
3936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3936.36546\Password.txttext
MD5:9A8911AC6E7D6A1975402DE4178DDFAD
SHA256:85795BDF60B99500212F63BF207B654F70A4DE2D047F762FA44D16F2C793F2BB
1372WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb1372.37038\setup.zipcompressed
MD5:62DB55DAB3DA0056C14E1E94A16FB36B
SHA256:5162C7E6059CF31196CCBE227676C91E62D23AF466B9446F5EE0E40D8D26945C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2580
AISetup.exe
185.215.113.121:15386
—
Ebonyhorizon Telecomunicacoes S.A.
PT
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2580
AISetup.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 24
18 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Bagas31 Adobe P Crack ddc2eadf5e3aa1f4.zip