analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

CSGOhack(6.0).zip

Full analysis: https://app.any.run/tasks/db93acce-44fe-4055-867f-f005c470f510
Verdict: Malicious activity
Analysis date: July 11, 2019, 19:38:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

627F430280E40799C2025344A205B806

SHA1:

4C61888622C330E60696102875D6B9DEEB5CC94A

SHA256:

8AFB7BCBF2090756C3CE59592FE19DD565C7E90B7B3244AD12B15A35D98B18C4

SSDEEP:

3072:zOuOQ0Q2AVZnOZ1DnP7NH+EX5ePWlouzT9ciMlpQDc1T+Oyl2iakm:s7iurT9duaT9v4pdKVlDHm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • svhost.exe (PID: 588)
      • CSGOhack.exe (PID: 3968)

    • Runs app for hidden code execution

      • CSGOhack.exe (PID: 3968)

    • Changes the autorun value in the registry

      • reg.exe (PID: 4008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3024)
      • CSGOhack.exe (PID: 3968)
      • cmd.exe (PID: 2996)

    • Starts CMD.EXE for commands execution

      • CSGOhack.exe (PID: 3968)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2996)

  • INFO

    • Application was crashed

      • svhost.exe (PID: 588)

    • Manual execution by user

      • CSGOhack.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: igdusc64.dll
ZipUncompressedSize: 1945
ZipCompressedSize: 292
ZipCRC: 0x00d076fa
ZipModifyDate: 2018:06:20 23:38:20
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe csgohack.exe cmd.exe reg.exe svhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
3024"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CSGOhack(6.0).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3968"C:\Users\admin\Desktop\virus\CSGOhack.exe" C:\Users\admin\Desktop\virus\CSGOhack.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Antimalware Service Executable
Exit code:
0
Version:
4.18.1807.18075 (GitEnlistment(winpbld).180719-0853)
2996"cmd.exe"C:\Windows\system32\cmd.exe
CSGOhack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4008reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\admin\AppData\Local\Temp\FolderN\name.exe.lnk" /fC:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
588"C:\Users\admin\AppData\Local\Temp\svhost.exe"C:\Users\admin\AppData\Local\Temp\svhost.exe
CSGOhack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Version:
9.0.30729.5420
Total events
633
Read events
616
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
3024WinRAR.exeC:\Users\admin\Desktop\virus\pbshr125.dlltext
MD5:7053588E535CF76B8C5B99FB1502A2C8
SHA256:7087FC2B9A0FDC00632656F46D4674E2AF99516449712BE2091922751A5B66D3
3968CSGOhack.exeC:\Users\admin\AppData\Local\Temp\svhost.exeexecutable
MD5:32827E69B293B99013BBBE37D029245D
SHA256:9250B89157770E3AB59A2C7E2DD6B12B3C61D9B7C6620C3B4727E4BFFF10F01F
2996cmd.exeC:\Users\admin\AppData\Local\Temp\FolderN\name.exeexecutable
MD5:DF8F312CB227E8E1D5755287B8EB1BE2
SHA256:0AD546E71C49D794B736D167406FE491FFBC3399662AD69D992FAEE025D44215
3024WinRAR.exeC:\Users\admin\Desktop\virus\CSGOhack.exeexecutable
MD5:DF8F312CB227E8E1D5755287B8EB1BE2
SHA256:0AD546E71C49D794B736D167406FE491FFBC3399662AD69D992FAEE025D44215
3024WinRAR.exeC:\Users\admin\Desktop\virus\TUTORIAL.txttext
MD5:1EFAEED48B3F875D6A129FD2FD2E5088
SHA256:9E31C13E2801DBB38FCC9B346EAE96F1FCDAA6489D7FD088935473B0EA38319C
3024WinRAR.exeC:\Users\admin\Desktop\virus\igdusc64.dlltext
MD5:9239DD34BA4D28E20B792FE010CA29B8
SHA256:58F7654BF9F5FFC6609A235379BA13D929E37E25488860DBFC41872A3123D35D
2996cmd.exeC:\Users\admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifiertext
MD5:130A75A932A2FE57BFEA6A65B88DA8F6
SHA256:F2B79CAE559D6772AFC1C2ED9468988178F8B6833D5028A15DEA73CE47D0196E
3968CSGOhack.exeC:\Users\admin\AppData\Local\Temp\FolderN\name.exe.lnklnk
MD5:B7F2CFEC6823A438DBA7530A8F4AE648
SHA256:612F6D646DAAA368D40443AB894042EBB8B93AC485658E78682731BAD9AB52CC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CSGOhack(6.0).zip