File name:

MyLanViewer v6.0.1 Enterprise Fix FINAL.zip

Full analysis: https://app.any.run/tasks/a5f9a75b-e91d-4be3-96f9-606dcf219e94
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 21, 2022, 14:46:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

4DD3C3347BBEBAD0A12FCB454940F744

SHA1:

8BF25A133E232744F1EBB8D93DC75E62D8E14955

SHA256:

8AC20D70D360B050F29173870C97C8A3BC008A1FD10A6A9377EE5EEF2B10FFD9

SSDEEP:

98304:UhEyy3dvGNvZ1VDCzVrc9caIKeY9kxI92IMiyDW2UuF6/vH:UhPMdy9AAcNxykm92uR/P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MyLanViewer_setup.exe (PID: 4028)
      • MyLanViewer-setup.exe (PID: 3372)
      • chromedev32.exe (PID: 3672)
      • mylanviewer_5.x-patch.exe (PID: 3524)
      • chromedev32.exe (PID: 2632)
      • mylanviewer_5.x-patch.exe (PID: 1256)
      • chromedev32.exe (PID: 3176)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3364)
      • schtasks.exe (PID: 3280)
      • schtasks.exe (PID: 496)
      • schtasks.exe (PID: 3816)

    • Drops executable file immediately after starts

      • MyLanViewer-setup.exe (PID: 3372)
      • cmd.exe (PID: 2856)
      • WinRAR.exe (PID: 3860)
      • DllHost.exe (PID: 2640)
      • mylanviewer_5.x-patch.exe (PID: 3524)
      • mylanviewer_5.x-patch.exe (PID: 1256)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 2428)
      • cmd.exe (PID: 1548)
      • cmd.exe (PID: 636)

    • REDLINE was detected

      • vbc.exe (PID: 4036)
      • vbc.exe (PID: 3572)
      • vbc.exe (PID: 2268)

    • Connects to CnC server

      • vbc.exe (PID: 4036)
      • vbc.exe (PID: 3572)
      • vbc.exe (PID: 2268)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 4036)

    • Loads dropped or rewritten executable

      • mylanviewer_5.x-patch.exe (PID: 3524)
      • mylanviewer_5.x-patch.exe (PID: 1256)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2824)
      • MyLanViewer_setup.exe (PID: 4028)
      • vbc.exe (PID: 4036)
      • MyLanViewer-setup.tmp (PID: 3180)
      • chromedev32.exe (PID: 3672)
      • vbc.exe (PID: 3572)
      • WinRAR.exe (PID: 3860)
      • vbc.exe (PID: 2268)
      • chromedev32.exe (PID: 2632)
      • chromedev32.exe (PID: 3176)
      • vbc.exe (PID: 2952)

    • Checks supported languages

      • WinRAR.exe (PID: 2824)
      • MyLanViewer_setup.exe (PID: 4028)
      • vbc.exe (PID: 4036)
      • MyLanViewer-setup.exe (PID: 3372)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 2856)
      • MyLanViewer-setup.tmp (PID: 3180)
      • chromedev32.exe (PID: 3672)
      • vbc.exe (PID: 3572)
      • cmd.exe (PID: 3368)
      • cmd.exe (PID: 2428)
      • WinRAR.exe (PID: 3860)
      • mylanviewer_5.x-patch.exe (PID: 3524)
      • chromedev32.exe (PID: 2632)
      • vbc.exe (PID: 2268)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 1548)
      • mylanviewer_5.x-patch.exe (PID: 1256)
      • chromedev32.exe (PID: 3176)
      • vbc.exe (PID: 2952)
      • cmd.exe (PID: 4088)
      • cmd.exe (PID: 636)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2824)
      • cmd.exe (PID: 2856)
      • MyLanViewer-setup.tmp (PID: 3180)

    • Executable content was dropped or overwritten

      • MyLanViewer-setup.exe (PID: 3372)
      • WinRAR.exe (PID: 2824)
      • MyLanViewer_setup.exe (PID: 4028)
      • cmd.exe (PID: 2856)
      • MyLanViewer-setup.tmp (PID: 3180)
      • WinRAR.exe (PID: 3860)
      • DllHost.exe (PID: 2640)
      • mylanviewer_5.x-patch.exe (PID: 3524)
      • mylanviewer_5.x-patch.exe (PID: 1256)

    • Starts CMD.EXE for commands execution

      • MyLanViewer_setup.exe (PID: 4028)
      • chromedev32.exe (PID: 3672)
      • chromedev32.exe (PID: 2632)
      • chromedev32.exe (PID: 3176)

    • Executes scripts

      • MyLanViewer_setup.exe (PID: 4028)
      • chromedev32.exe (PID: 3672)
      • chromedev32.exe (PID: 2632)
      • chromedev32.exe (PID: 3176)

    • Drops a file with too old compile date

      • MyLanViewer_setup.exe (PID: 4028)
      • MyLanViewer-setup.exe (PID: 3372)
      • MyLanViewer-setup.tmp (PID: 3180)

    • Creates files in the user directory

      • cmd.exe (PID: 2856)

    • Reads Windows owner or organization settings

      • MyLanViewer-setup.tmp (PID: 3180)

    • Reads the Windows organization settings

      • MyLanViewer-setup.tmp (PID: 3180)

    • Creates a directory in Program Files

      • MyLanViewer-setup.tmp (PID: 3180)

    • Reads Environment values

      • vbc.exe (PID: 4036)

    • Executed via Task Scheduler

      • chromedev32.exe (PID: 3672)
      • chromedev32.exe (PID: 2632)
      • chromedev32.exe (PID: 3176)

    • Drops a file that was compiled in debug mode

      • MyLanViewer-setup.tmp (PID: 3180)

    • Executed via COM

      • DllHost.exe (PID: 2640)

    • Creates files in the program directory

      • DllHost.exe (PID: 2640)

  • INFO

    • Reads the computer name

      • schtasks.exe (PID: 3364)
      • DllHost.exe (PID: 2640)
      • schtasks.exe (PID: 3280)
      • schtasks.exe (PID: 496)
      • schtasks.exe (PID: 3816)

    • Manual execution by user

      • MyLanViewer_setup.exe (PID: 4028)
      • WinRAR.exe (PID: 3860)
      • mylanviewer_5.x-patch.exe (PID: 3524)
      • mylanviewer_5.x-patch.exe (PID: 1256)

    • Checks supported languages

      • schtasks.exe (PID: 3364)
      • DllHost.exe (PID: 2640)
      • schtasks.exe (PID: 3280)
      • schtasks.exe (PID: 496)
      • schtasks.exe (PID: 3816)

    • Application was dropped or rewritten from another process

      • MyLanViewer-setup.tmp (PID: 3180)

    • Creates a software uninstall entry

      • MyLanViewer-setup.tmp (PID: 3180)

    • Creates files in the program directory

      • MyLanViewer-setup.tmp (PID: 3180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: MyLanViewer v6.0.1 Enterprise Fix FINAL/Instructions.txt
ZipUncompressedSize: 1155
ZipCompressedSize: 1155
ZipCRC: 0x9dea1082
ZipModifyDate: 2022:01:21 14:43:19
ZipCompression: None
ZipBitFlag: 0x0800
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
27
Malicious processes
10
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe mylanviewer_setup.exe #REDLINE vbc.exe cmd.exe no specs mylanviewer-setup.exe cmd.exe schtasks.exe no specs mylanviewer-setup.tmp chromedev32.exe no specs #REDLINE vbc.exe cmd.exe no specs cmd.exe no specs schtasks.exe no specs winrar.exe Copy/Move/Rename/Delete/Link Object mylanviewer_5.x-patch.exe chromedev32.exe no specs #REDLINE vbc.exe cmd.exe no specs cmd.exe no specs schtasks.exe no specs mylanviewer_5.x-patch.exe chromedev32.exe no specs vbc.exe cmd.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\admin\AppData\Roaming\chromedev32.exe'" /fC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
636"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\admin\AppData\Roaming\chromedev32.exe'" /fC:\Windows\system32\cmd.exe—chromedev32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
1244"cmd" /c copy "C:\Users\admin\AppData\Roaming\chromedev32.exe" "C:\Users\admin\AppData\Roaming\chromedev32.exe"C:\Windows\system32\cmd.exe—chromedev32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1256"C:\Program Files\MyLanViewer\mylanviewer_5.x-patch.exe" C:\Program Files\MyLanViewer\mylanviewer_5.x-patch.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\mylanviewer\mylanviewer_5.x-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\dup2patcher.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1548"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\admin\AppData\Roaming\chromedev32.exe'" /fC:\Windows\system32\cmd.exe—chromedev32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2268"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
chromedev32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
12.0.51209.34209
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2340"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\admin\AppData\Roaming\chromedev32.exe'" /fC:\Windows\system32\cmd.exe—MyLanViewer_setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2428"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\admin\AppData\Roaming\chromedev32.exe'" /fC:\Windows\system32\cmd.exe—chromedev32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\imm32.dll
2632C:\Users\admin\AppData\Roaming\chromedev32.exe C:\Users\admin\AppData\Roaming\chromedev32.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\roaming\chromedev32.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2640C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 709
Read events
5 642
Write events
61
Delete events
6

Modification events

(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2824) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MyLanViewer v6.0.1 Enterprise Fix FINAL.zip
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2824) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
18
Suspicious files
1
Text files
10
Unknown types
27

Dropped files

PID
Process
Filename
Type
2824WinRAR.exeC:\Users\admin\Desktop\MyLanViewer v6.0.1 Enterprise Fix FINAL\Patch Fix\Patch Fix.zipcompressed
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\Desktop\MyLanViewer v6.0.1 Enterprise Fix FINAL\Instructions.txttext
MD5:—
SHA256:—
2856cmd.exeC:\Users\admin\AppData\Roaming\chromedev32.exeexecutable
MD5:—
SHA256:—
4028MyLanViewer_setup.exeC:\Users\admin\AppData\Local\Temp\MyLanViewer-setup.exeexecutable
MD5:—
SHA256:—
2824WinRAR.exeC:\Users\admin\Desktop\MyLanViewer v6.0.1 Enterprise Fix FINAL\Setup\MyLanViewer_setup.exeexecutable
MD5:—
SHA256:—
3372MyLanViewer-setup.exeC:\Users\admin\AppData\Local\Temp\is-4FNQ4.tmp\MyLanViewer-setup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
3180MyLanViewer-setup.tmpC:\Program Files\MyLanViewer\is-37131.tmpexecutable
MD5:—
SHA256:—
3180MyLanViewer-setup.tmpC:\Program Files\MyLanViewer\is-JHN0I.tmpexecutable
MD5:FD62895E95B997E8A6243F855C756C54
SHA256:6458FEAEFFA99508978949FD055623D882C9982AF853674EAA73E73113172767
3180MyLanViewer-setup.tmpC:\Program Files\MyLanViewer\Help\is-7AMM4.tmpchm
MD5:4188594CA9B462DFF342C71FF49DF9BF
SHA256:A207438CC648AEA05E7B89C6BEDBACB98A5806CB01EB0B25705FC4858B5DEDF6
3180MyLanViewer-setup.tmpC:\Program Files\MyLanViewer\ssleay32.dllexecutable
MD5:2117E31688AEF8ECF267978265BFCDCD
SHA256:0A4031AB00664CC5E202C8731798800F0475EF76800122CEBD71D249655D725F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
43

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
vbc.exe
207.32.217.89:14588
—
—
US
malicious
4036
vbc.exe
207.32.217.89:14588
—
—
US
malicious
2268
vbc.exe
207.32.217.89:14588
—
—
US
malicious
2952
vbc.exe
207.32.217.89:14588
—
—
US
malicious

DNS requests

No data

Threats

Found threats are available for the paid subscriptions
43 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MyLanViewer v6.0.1 Enterprise Fix FINAL.zip