File name:

Universal.zip

Full analysis: https://app.any.run/tasks/08a4c01e-ca79-425d-802a-c7bd01dcf0eb
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Malware Trends Tracker     >>>
Analysis date: December 24, 2023, 10:43:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
metastealer
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

32D319D9677635F995F4E009DB2E85A1

SHA1:

4770AF11A733C00EE8C1E7613F64690361F7D9AF

SHA256:

7CE94C2008D904E10DDECB401307F4CB5182B5989D594E416C9891B817C3D356

SSDEEP:

49152:U9yC2Jml/0DrutWzteuw/t2OoSf1tKqcBBA3XeewDTeRhw9Q/QD8pYBZ7E:Usml/Aach7ZONOxBBA3XaX90QD0GZ7E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • METASTEALER has been detected (YARA)

      • RegAsm.exe (PID: 1112)
      • RegAsm.exe (PID: 2328)
      • Universal.exe (PID: 2544)
      • RegAsm.exe (PID: 2860)
      • Universal.exe (PID: 2824)
      • RegAsm.exe (PID: 3152)
      • RegAsm.exe (PID: 2796)

  • SUSPICIOUS

    • Connects to unusual port

      • RegAsm.exe (PID: 1112)
      • RegAsm.exe (PID: 2328)
      • RegAsm.exe (PID: 2860)
      • RegAsm.exe (PID: 2796)
      • RegAsm.exe (PID: 3152)

  • INFO

    • Checks supported languages

      • Universal.exe (PID: 1840)
      • RegAsm.exe (PID: 1112)
      • Universal.exe (PID: 1844)
      • RegAsm.exe (PID: 2328)
      • RegAsm.exe (PID: 2860)
      • Universal.exe (PID: 2544)
      • Universal.exe (PID: 2824)
      • RegAsm.exe (PID: 2796)
      • RegAsm.exe (PID: 3152)
      • Universal.exe (PID: 3216)

    • Manual execution by a user

      • Universal.exe (PID: 1840)
      • Universal.exe (PID: 1844)
      • rundll32.exe (PID: 2780)
      • rundll32.exe (PID: 2060)
      • Universal.exe (PID: 2544)
      • Universal.exe (PID: 3216)
      • Universal.exe (PID: 2824)
      • explorer.exe (PID: 1628)

    • Reads the computer name

      • RegAsm.exe (PID: 1112)
      • RegAsm.exe (PID: 2328)
      • RegAsm.exe (PID: 2796)
      • RegAsm.exe (PID: 3152)
      • RegAsm.exe (PID: 2860)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 116)

    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 1112)
      • RegAsm.exe (PID: 2328)
      • RegAsm.exe (PID: 2860)
      • RegAsm.exe (PID: 2796)
      • RegAsm.exe (PID: 3152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

MetaStealer

(PID) Process(1112) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
(PID) Process(2328) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
(PID) Process(2860) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
(PID) Process(2796) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
(PID) Process(3152) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2023:07:17 00:00:54
ZipCRC: 0xfd8a91ae
ZipCompressedSize: 324146
ZipUncompressedSize: 981592
ZipFileName: Universal.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
15
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs universal.exe #METASTEALER regasm.exe universal.exe #METASTEALER regasm.exe rundll32.exe no specs rundll32.exe no specs #METASTEALER universal.exe #METASTEALER regasm.exe #METASTEALER universal.exe #METASTEALER regasm.exe universal.exe #METASTEALER regasm.exe explorer.exe no specs Copy/Move/Rename/Delete/Link Object no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Universal.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1112"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Universal.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
MetaStealer
(PID) Process(1112) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
1628"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1840"C:\Users\admin\Desktop\Universal.exe" C:\Users\admin\Desktop\Universal.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\universal.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\apphelp.dll
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
1844"C:\Users\admin\Desktop\Universal.exe" C:\Users\admin\Desktop\Universal.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\universal.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\apphelp.dll
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
2060"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\AMD_OpenCL_ICD64.dllC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2328"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Universal.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
MetaStealer
(PID) Process(2328) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
2544"C:\Users\admin\Desktop\Universal.exe" C:\Users\admin\Desktop\Universal.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\universal.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\apphelp.dll
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
2780"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\AMD_OpenCL_ICD64.dllC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2796"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Universal.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
MetaStealer
(PID) Process(2796) RegAsm.exe
C2 (1)138.201.198.8:40128
Botnetcrypto_s
Options
ErrorMessage
Keys
XorUnsatiate
Total events
2 492
Read events
2 459
Write events
27
Delete events
6

Modification events

(PID) Process:(116) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
4
Suspicious files
118
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.008.etlbinary
MD5:8BCF7932F4B8D690F65722616AC05DF0
SHA256:21D3D33548610CC38B91BC3BD4A290C8C7B7438C29B2D40012E7A133D43CBD0B
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.001.etlbinary
MD5:5820DCA6B366128CC26955E2DB6A8865
SHA256:402B88A7856A00ED173E496294CF98AC576F132E40E799BEA4AC0E33B3C84119
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.004.etlbinary
MD5:99E8A4BE1D2460866F5996240CFE8CF7
SHA256:758C1AD9371ACEFF742D87BCAB491C0D26A63E7C965CD9FA1DAC719140188988
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.003.etlbinary
MD5:A63F9B672CB5E3B753D880253724932B
SHA256:B444E807D51F270B920EA5B3A2241ED47748C4F0317E333F608B2299EDE0478F
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.002.etlbinary
MD5:2FAD184377AE44FBAAF7A3F2620EF876
SHA256:5370A440AAD74307186CFF8C7E3C983B944969509EEABA574D366FFE3CCCF5E7
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.005.etlbinary
MD5:0FA16EF023F31C9015764076041E2194
SHA256:47761BEE2A236678B57F197B0D333257419FFC31FA82F8B43669B065FD19DB70
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.006.etlbinary
MD5:C67C36E3869C1CF4F19FE6107B1408C7
SHA256:F55E93A235402833CEDDE122F4E924A354F6AE2A3C79D31CCC78D1DBF20AC3AE
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.010.etlbinary
MD5:DB615C2C416AF23D5311ABEF0CB7C0E4
SHA256:DB5522116998F8856A65E4B175F1FD8DD18CA52264300860657EAB12EA2997CD
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.007.etlbinary
MD5:3B23FC85E728278F0B988ABA70DA6FD6
SHA256:897DF8705B9EDD425CDC94B33E6FF2C411113CC5A8448154E235F717F149C9C9
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.13060\Base\LauncherRemediation.012.etlbinary
MD5:A83388B9A288450CD1D29B40439AD9C7
SHA256:A1F3FE748517CF21774EE9D8686EDA16F36E2A0E0F9D4369F20A4E0B29547733
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
56
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1112
RegAsm.exe
138.201.198.8:40128
—
Hetzner Online GmbH
DE
malicious
2328
RegAsm.exe
138.201.198.8:40128
—
Hetzner Online GmbH
DE
malicious
2860
RegAsm.exe
138.201.198.8:40128
—
Hetzner Online GmbH
DE
malicious
2360
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2796
RegAsm.exe
138.201.198.8:40128
—
Hetzner Online GmbH
DE
malicious
3152
RegAsm.exe
138.201.198.8:40128
—
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Universal.zip