analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7b31cd039cf1a0d6680444f52c940361e07ad403d611f036c45af41631694bd7

Full analysis: https://app.any.run/tasks/8975031d-85a0-4cbc-a9d3-e6078175ab3e
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: August 13, 2019, 18:20:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
agenttesla
evasion
trojan
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9ED24B688075570D9408C6696713BBF8

SHA1:

F8D53F8E5BF7F3CD923F27B6B8FCF86105BD7C42

SHA256:

7B31CD039CF1A0D6680444F52C940361E07AD403D611F036C45AF41631694BD7

SSDEEP:

12288:KymQrzmudqI+Hln6/VxSS7GPVjZG3ChJVA0:KymQrzl4IULSMgi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 11 2O GMDSS.exe (PID: 2156)
      • 11 2O GMDSS.exe (PID: 3588)
    • AGENTTESLA was detected

      • 11 2O GMDSS.exe (PID: 2156)
    • Actions looks like stealing of personal data

      • 11 2O GMDSS.exe (PID: 2156)
  • SUSPICIOUS

    • Application launched itself

      • 11 2O GMDSS.exe (PID: 3588)
    • Reads the cookies of Google Chrome

      • 11 2O GMDSS.exe (PID: 2156)
    • Creates files in the user directory

      • 11 2O GMDSS.exe (PID: 2156)
    • Reads the cookies of Mozilla Firefox

      • 11 2O GMDSS.exe (PID: 2156)
    • Checks for external IP

      • 11 2O GMDSS.exe (PID: 2156)
  • INFO

    • Manual execution by user

      • 11 2O GMDSS.exe (PID: 3588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 11 2O GMDSS.exe
ZipUncompressedSize: 827392
ZipCompressedSize: 393663
ZipCRC: 0x9671d8e3
ZipModifyDate: 2019:08:03 11:37:05
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs 11 2o gmdss.exe no specs #AGENTTESLA 11 2o gmdss.exe

Process information

PID
CMD
Path
Indicators
Parent process
2620"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7b31cd039cf1a0d6680444f52c940361e07ad403d611f036c45af41631694bd7.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3588"C:\Users\admin\Desktop\11 2O GMDSS.exe" C:\Users\admin\Desktop\11 2O GMDSS.exeexplorer.exe
User:
admin
Company:
Biolateblesser
Integrity Level:
MEDIUM
Description:
Biolateinfamonize7
Exit code:
0
Version:
9.08.0005
2156C:\Users\admin\Desktop\11 2O GMDSS.exe" C:\Users\admin\Desktop\11 2O GMDSS.exe
11 2O GMDSS.exe
User:
admin
Company:
Biolateblesser
Integrity Level:
MEDIUM
Description:
Biolateinfamonize7
Version:
9.08.0005
Total events
497
Read events
477
Write events
20
Delete events
0

Modification events

(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2620) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\7b31cd039cf1a0d6680444f52c940361e07ad403d611f036c45af41631694bd7.zip
(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2620) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2156) 11 2O GMDSS.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\11 2O GMDSS_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2156) 11 2O GMDSS.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\11 2O GMDSS_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
1
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2620.45807\11 2O GMDSS.exe
MD5:
SHA256:
215611 2O GMDSS.exeC:\Users\admin\AppData\Roaming\en5op3u5.ye1\Chrome\Default\Cookies
MD5:
SHA256:
215611 2O GMDSS.exeC:\Users\admin\AppData\Roaming\en5op3u5.ye1\Firefox\Profiles\qldyz51w.default\cookies.sqlite
MD5:
SHA256:
215611 2O GMDSS.exeC:\Users\admin\AppData\Local\Temp\637013209134313750_4bdef398-5941-4125-a1f9-717c831189ef.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
215611 2O GMDSS.exeC:\Users\admin\AppData\Roaming\en5op3u5.ye1.zipcompressed
MD5:36E15EE71A0E6B34437FC0333B05B176
SHA256:2E9303024953B7AD97CD93234E6FD91F998C708781BF165945475A6BFB7747A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2156
11 2O GMDSS.exe
GET
200
18.204.189.102:80
http://checkip.amazonaws.com/
US
text
14 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2156
11 2O GMDSS.exe
18.204.189.102:80
checkip.amazonaws.com
US
shared
2156
11 2O GMDSS.exe
208.91.198.143:587
smtp.deartzss.com
PDR
US
shared

DNS requests

Domain
IP
Reputation
checkip.amazonaws.com
  • 18.204.189.102
  • 34.196.181.158
  • 3.224.145.145
  • 18.205.71.63
  • 52.55.255.113
  • 52.44.169.135
shared
smtp.deartzss.com
  • 208.91.198.143
  • 208.91.199.224
  • 208.91.199.223
  • 208.91.199.225
malicious

Threats

PID
Process
Class
Message
2156
11 2O GMDSS.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2156
11 2O GMDSS.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2156
11 2O GMDSS.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3 ETPRO signatures available at the full report
No debug info