| File name: | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27 (1).zip |
| Full analysis: | https://app.any.run/tasks/72787783-33ac-4e85-88f5-3b0767a84f90 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | March 24, 2025, 18:22:47 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | 959AB1B97EEB2B0FB22D60FB2C210B92 |
| SHA1: | FD3E0373D6560B58131F98B04EFE19B74A6DC829 |
| SHA256: | 89BD59900F54C67DD1F476DAF47400767E823345118941DC9671A689C203E31A |
| SSDEEP: | 24576:pkg12FsWHs25vH/quV5U8hEKdR7mRYIUrrEC+j7R:px12FsWHs2pH/qubU8hEKdR7mRY5rYCs |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0003 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2025:03:24 18:08:32 |
| ZipCRC: | 0x8af4af29 |
| ZipCompressedSize: | 506594 |
| ZipUncompressedSize: | 604160 |
| ZipFileName: | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1188 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb4692.39012\2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb4692.39012\2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Report Manager Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1804 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4692 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27 (1).zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 4724 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5124 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6480 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7204 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7244 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7276 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7320 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb4692.39012\2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb4692.39012\2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Report Manager Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27 (1).zip | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4692) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (7204) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5124 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1ba505bc-c34e-425d-ba6e-c987eede01fd.down_data | — | |
MD5:— | SHA256:— | |||
| 5124 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4872BABAF39AA62B8D32695EBB7E9173 | SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999 | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5FB7.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 5124 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\73a87edc-7cf9-4ae4-a872-40e3b935cbdf.up_meta_secure | binary | |
MD5:40ECB4E0EA0750F2558C4BD0710E4C5F | SHA256:072A6FADABE8C2099F360C608868633605B9B0262465BB71A2589C24AC65632A | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5FA4.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5FB6.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5FA5.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5F93.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5FD9.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | C:\Users\admin\AppData\Local\Temp\tmp5FD8.tmp | sqlite | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7476 | backgroundTaskHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
5124 | BackgroundTransferHost.exe | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.24.77.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4756 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4756 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | POST | 200 | 185.222.57.71:55615 | http://185.222.57.71:55615/ | unknown | — | — | unknown |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | POST | 200 | 185.222.57.71:55615 | http://185.222.57.71:55615/ | unknown | — | — | unknown |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | POST | 200 | 185.222.57.71:55615 | http://185.222.57.71:55615/ | unknown | — | — | unknown |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | POST | 200 | 185.222.57.71:55615 | http://185.222.57.71:55615/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.24.77.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6544 | svchost.exe | 40.126.32.136:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 23.54.109.203:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
300 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7476 | backgroundTaskHost.exe | 20.74.47.205:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | Malware Command and Control Activity Detected | ET MALWARE RedLine Stealer - CheckConnect Response |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | A Network Trojan was detected | AV TROJAN RedLine Stealer Config Download |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
1188 | 2d8a45f0de92aeb5fc5495c2df0072a00e4d2215b0b2c1ccfd1580d752e32f27.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |