File name:

0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.gz

Full analysis: https://app.any.run/tasks/c8113776-fa3d-4ad7-90bb-d94cfc26404e
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: August 18, 2020, 12:27:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
blue
bot
Indicators:
MIME: application/gzip
File info: gzip compressed data, max speed, from Unix
MD5:

5F9701A06980D4A5792325144F12860D

SHA1:

934E36BC7CC95D4C554B37F1BF06CA80FF70301C

SHA256:

813DFB767A5CB777ECF20C9BF0E43DAF75A84DBA23EE9021A3FC1D7EB1549B49

SSDEEP:

768:c9r8vm0w2Fsd1eWBJVvz0X+8hgzuhjZd6XhkhGhDY6r1dQrLhx56ZVz9MYcpA66p:cavxw2uJ6Xh6CBnwiAhY6r1dQrL/56Zb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)

    • Changes the autorun value in the registry

      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)

    • BLUE was detected

      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2188)
      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)

    • Creates files in the user directory

      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)

    • Changes tracing settings of the file or console

      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)

  • INFO

    • Manual execution by user

      • 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe (PID: 3344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

Compression: Deflated
Flags: (none)
ModifyDate: 0000:00:00 00:00:00
ExtraFlags: Fastest Algorithm
OperatingSystem: Unix
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #BLUE 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe

Process information

PID
CMD
Path
Indicators
Parent process
2188"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.gz.z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3344"C:\Users\admin\Desktop\0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe" C:\Users\admin\Desktop\0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Drivers Handler
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
339
Read events
317
Write events
22
Delete events
0

Modification events

(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2188) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2188) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.gz.z
(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2188) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3344) 0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:sysDrvHandler
Value:
C:\Users\admin\AppData\Roaming\drvhandler.exe
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
33440e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exeC:\Users\admin\AppData\Roaming\drvhandler.exeexecutable
MD5:—
SHA256:—
2188WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2188.1643\0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.gzexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
613
DNS requests
1
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/target
unknown
text
21 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/botlogger.php
unknown
text
93 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/botlogger.php
unknown
text
93 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/target
unknown
text
21 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
404
103.127.196.87:80
http://volamthailan.com/bot300/proxy
unknown
html
292 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/target
unknown
text
21 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/botlogger.php
unknown
text
93 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/target
unknown
text
21 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/target
unknown
text
21 b
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
GET
200
103.127.196.87:80
http://volamthailan.com/bot300/botlogger.php
unknown
text
93 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
103.127.196.87:80
volamthailan.com
—
—
malicious
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
103.200.23.8:5622
—
The Corporation for Financing & Promoting Technology
VN
unknown

DNS requests

Domain
IP
Reputation
volamthailan.com
  • 103.127.196.87
malicious

Threats

PID
Process
Class
Message
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Proxy Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Blog Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Target Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Logger Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Target Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Logger Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Target Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Logger Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Target Request
3344
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.exe
A Network Trojan was detected
ET TROJAN Blue Bot DDoS Logger Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0e9c478fe3a20ccdc433b9d88c655b2168b6dbdab0a789d686441b657d461389.bin.gz