File name:

Extreme Injector V3 (1).rar

Full analysis: https://app.any.run/tasks/6706faee-d26c-4a24-9281-ec65605d077b
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 03, 2024, 18:38:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

13D7AD8E46DAA94F672431BD98DF1F61

SHA1:

3E6001D16B7670F39D6F09F429947EB289BD8FC5

SHA256:

8560B827D1A58DCC81C2D94DCE540443D3720C73AD7F3B854593E0CE837C83E7

SSDEEP:

98304:DGT24G+mz3CPnb4JpT7c7EcdLWf1Plob5KI/gjb9VSb654xAyuvAUpBOdgpmgAKu:S9L/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2076)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Extreme Injector V3.exe (PID: 324)
      • wscript.exe (PID: 2076)
      • FonthostDhcp.exe (PID: 1588)
      • FonthostDhcp.exe (PID: 2344)
      • dllhost.exe (PID: 948)

    • The process executes VB scripts

      • Extreme Injector V3.exe (PID: 324)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2076)
      • FonthostDhcp.exe (PID: 1588)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2076)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2076)

    • The process creates files with name similar to system file names

      • FonthostDhcp.exe (PID: 2344)

    • Reads settings of System Certificates

      • dllhost.exe (PID: 948)

  • INFO

    • Reads the computer name

      • Extreme Injector V3.exe (PID: 324)
      • FonthostDhcp.exe (PID: 1588)
      • FonthostDhcp.exe (PID: 2344)
      • dllhost.exe (PID: 948)

    • Checks supported languages

      • Extreme Injector V3.exe (PID: 324)
      • FonthostDhcp.exe (PID: 1588)
      • FonthostDhcp.exe (PID: 2344)
      • dllhost.exe (PID: 948)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 116)
      • Extreme Injector V3.exe (PID: 324)
      • FonthostDhcp.exe (PID: 2344)

    • Reads the machine GUID from the registry

      • FonthostDhcp.exe (PID: 1588)
      • FonthostDhcp.exe (PID: 2344)
      • dllhost.exe (PID: 948)

    • Reads Environment values

      • FonthostDhcp.exe (PID: 1588)
      • FonthostDhcp.exe (PID: 2344)
      • dllhost.exe (PID: 948)

    • Reads product name

      • FonthostDhcp.exe (PID: 1588)
      • FonthostDhcp.exe (PID: 2344)
      • dllhost.exe (PID: 948)

    • Creates files in the program directory

      • FonthostDhcp.exe (PID: 2344)

    • Executed via WMI

      • schtasks.exe (PID: 2740)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 996)
      • schtasks.exe (PID: 2592)
      • schtasks.exe (PID: 2808)
      • schtasks.exe (PID: 376)
      • schtasks.exe (PID: 148)
      • schtasks.exe (PID: 1852)
      • schtasks.exe (PID: 1528)
      • schtasks.exe (PID: 2560)
      • schtasks.exe (PID: 552)
      • schtasks.exe (PID: 2388)
      • schtasks.exe (PID: 1424)
      • schtasks.exe (PID: 980)
      • schtasks.exe (PID: 2484)
      • schtasks.exe (PID: 2828)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 2688)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 2804)
      • schtasks.exe (PID: 2728)
      • schtasks.exe (PID: 2748)
      • schtasks.exe (PID: 2892)
      • schtasks.exe (PID: 1956)
      • schtasks.exe (PID: 2904)
      • schtasks.exe (PID: 2816)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 1812)
      • schtasks.exe (PID: 2540)
      • schtasks.exe (PID: 908)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 2368)
      • schtasks.exe (PID: 2360)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 2848)

    • Starts itself from another location

      • FonthostDhcp.exe (PID: 2344)

    • DCRAT has been detected (SURICATA)

      • dllhost.exe (PID: 948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
45
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs extreme injector v3.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs fonthostdhcp.exe no specs cmd.exe fonthostdhcp.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Extreme Injector V3 (1).rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
148schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
324"C:\Users\admin\AppData\Local\Temp\Rar$EXb116.13481\Extreme Injector V3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb116.13481\Extreme Injector V3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb116.13481\extreme injector v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
376schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
552schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\lsass.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
908schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\PortCombrowserIntocrt\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
948"C:\MSOCache\All Users\{90140000-006E-0411-0000-0000000FF1CE}-C\1041\dllhost.exe" C:\MSOCache\All Users\{90140000-006E-0411-0000-0000000FF1CE}-C\1041\dllhost.exe
FonthostDhcp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\msocache\all users\{90140000-006e-0411-0000-0000000ff1ce}-c\1041\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
980schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\DVD Maker\Shared\winlogon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
996schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\lsass.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1040C:\Windows\system32\cmd.exe /c ""C:\PortCombrowserIntocrt\9ooFS78ALNPOm.bat" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 929
Read events
5 866
Write events
63
Delete events
0

Modification events

(PID) Process:(116) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
14
Suspicious files
1
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
2344FonthostDhcp.exeC:\MSOCache\All Users\lsass.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
324Extreme Injector V3.exeC:\PortCombrowserIntocrt\FonthostDhcp.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
324Extreme Injector V3.exeC:\PortCombrowserIntocrt\file.vbstext
MD5:677CC4360477C72CB0CE00406A949C61
SHA256:F1CCCB5AE4AA51D293BD3C7D2A1A04CB7847D22C5DB8E05AC64E9A6D7455AA0B
2344FonthostDhcp.exeC:\MSOCache\All Users\{90140000-0016-0410-0000-0000000FF1CE}-C\6ccacd8608530ftext
MD5:EB0D3B2E3E5DC60AF6797DBB852E98B2
SHA256:94ED4F4571DB154B5C139610F0FF637F7BC0C293DE8F225FFCAD9671D7AE6C48
2344FonthostDhcp.exeC:\Program Files\DVD Maker\Shared\winlogon.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2344FonthostDhcp.exeC:\Users\Public\Libraries\lsass.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2344FonthostDhcp.exeC:\MSOCache\All Users\{90140000-0016-0410-0000-0000000FF1CE}-C\Idle.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2344FonthostDhcp.exeC:\Users\Public\Libraries\6203df4a6bafc7text
MD5:E8B27818C3C972C2FD104D85008FB2E4
SHA256:6473AAF37FD32EF4BBAD5A6CE6AE36B92D565AE386044747D01D0D4D39C2CDA9
324Extreme Injector V3.exeC:\PortCombrowserIntocrt\9ooFS78ALNPOm.battext
MD5:F190F7F19BB37D9FD4F72586514CCEB1
SHA256:D3AE983A4BDE4226B109EED16A55AC4E123D422EC17C2B9F23B773A5D431DB39
2344FonthostDhcp.exeC:\MSOCache\All Users\{90140000-006E-0411-0000-0000000FF1CE}-C\1041\5940a34987c991text
MD5:4289CB78A6DEB3FDBD1C85B85A31D6A2
SHA256:41A609293E1BA1A0C16DA6253E6D7F6FB1D00CE6AA1F867BC8B7B0D0E00A595E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?qoBdyXSURxompSYN9b6Z77LyLHN=Xe&Hhhw2=ykdxOcDFrBmjCtqOK3tcNRqKR6x&d910117de1a31e3e3912b057c0b12822=bea1bc314bb95217d6e743e5ee7ae803&c0abd845fefa6cccd022caa19260d7d8=QMlJTZ2cTMiBjNxUTNwMmY2MTNyIGN2QDZ0U2YwYGN4IWZlFGNkFjY&qoBdyXSURxompSYN9b6Z77LyLHN=Xe&Hhhw2=ykdxOcDFrBmjCtqOK3tcNRqKR6x
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
948
dllhost.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
948
dllhost.exe
141.8.192.103:80
a0900442.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
a0900442.xsph.ru
  • 141.8.192.103
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
948
dllhost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Extreme Injector V3 (1).rar