File name:

888 PASS.rar

Full analysis: https://app.any.run/tasks/b84c0e5c-92a5-4e14-adf7-052ef69b9e52
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: October 14, 2019, 13:49:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

BBA3C2554A760CFED06A33B8623CDB0D

SHA1:

BDE296B975BB455FDDC94CC41BFEE78AA3B1F851

SHA256:

7D4DD04C3A74A8714D6DAE89C5698CE302013EE5502B6FF272432E5B3587B214

SSDEEP:

49152:my9NoEK9a+Ur4fmOZ9QfecRxU5HaIpGyWV1ZPUDw/UIN2WI1F+oB:my9g9ahr44mcvU56IwfZPUDw8Rl1F+2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • bild3r.exe (PID: 2252)
      • build.exe (PID: 3352)
      • builder.exe (PID: 1908)
    • Stealing of credential data

      • build.exe (PID: 3352)
    • AZORULT was detected

      • build.exe (PID: 3352)
    • Connects to CnC server

      • build.exe (PID: 3352)
    • Actions looks like stealing of personal data

      • build.exe (PID: 3352)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2108)
      • bild3r.exe (PID: 2252)
      • builder.exe (PID: 1908)
    • Reads the cookies of Google Chrome

      • build.exe (PID: 3352)
    • Connects to server without host name

      • build.exe (PID: 3352)
    • Reads the cookies of Mozilla Firefox

      • build.exe (PID: 3352)
  • INFO

    • Manual execution by user

      • bild3r.exe (PID: 2252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe bild3r.exe #AZORULT build.exe builder.exe

Process information

PID
CMD
Path
Indicators
Parent process
1908"C:\Users\admin\AppData\Local\Temp\builder.exe" C:\Users\admin\AppData\Local\Temp\builder.exe
bild3r.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\builder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2108"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\888 PASS.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2252"C:\Users\admin\Desktop\bild3r.exe" C:\Users\admin\Desktop\bild3r.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\bild3r.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3352"C:\Users\admin\AppData\Local\Temp\build.exe" C:\Users\admin\AppData\Local\Temp\build.exe
bild3r.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\build.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
807
Read events
779
Write events
28
Delete events
0

Modification events

(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2108) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\888 PASS.rar
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2108) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
4
Suspicious files
1
Text files
301
Unknown types
6

Dropped files

PID
Process
Filename
Type
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\cfg.txttext
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\html\fullpage.htmlhtml
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\db\DBStruct.txttext
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\css\style.csstext
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\info\Install.txttext
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\html\passwords.htmltext
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\html\menu.htmlhtml
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\index.phptext
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\html\home.htmlhtml
MD5:
SHA256:
2108WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2108.49125\Panel\css\paginate.csstext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
0
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3352
build.exe
POST
200
194.61.0.3:80
http://194.61.0.3/gate.php
unknown
malicious
3352
build.exe
POST
200
194.61.0.3:80
http://194.61.0.3/gate.php
unknown
text
181 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3352
build.exe
194.61.0.3:80
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3352
build.exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no accept headers
3352
build.exe
A Network Trojan was detected
ET TROJAN Likely Zbot Generic Request to gate.php Dotted-Quad
3352
build.exe
A Network Trojan was detected
REMOTE [PTsecurity] AZORULT
3352
build.exe
A Network Trojan was detected
REMOTE [PTsecurity] AZORULT
3352
build.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult stealer CnC Response (for any 3byte XOR key)
3352
build.exe
A Network Trojan was detected
ET TROJAN Likely Zbot Generic Request to gate.php Dotted-Quad
3352
build.exe
A Network Trojan was detected
REMOTE [PTsecurity] AZORULT
3352
build.exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no accept headers
2 ETPRO signatures available at the full report
No debug info