File name:

10.rar

Full analysis: https://app.any.run/tasks/dd1cc3dd-4abe-47e5-af43-b4aeac206060
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 08:12:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
trojan
loader
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

EE5913019F84F46ED0C51B6F9A54DAEB

SHA1:

962BF52CBDC623E58A183B072D7587E608B74F99

SHA256:

8C2884D079A373E60B03C666E117E9F45192AF864F54D019D268C99C34C9DF28

SSDEEP:

98304:dGVjRLWShF9fKS34MXmExsjH+hbfIhmQbFme1yq77aKk5:dGVUMoMXByOIhbD1yq77a3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NetFlix GC Checker by xRisky.exe (PID: 296)
      • puty.exe (PID: 2128)
      • pu.exe (PID: 916)
      • puy.exe (PID: 2480)
      • putty.exe (PID: 344)
      • NetFlix GC Checker by xRisky.exe (PID: 2520)

    • Uses SVCHOST.EXE for hidden code execution

      • putty.exe (PID: 344)
      • svchost.exe (PID: 988)
      • svchost.exe (PID: 3132)

    • Writes to a start menu file

      • putty.exe (PID: 344)
      • pu.exe (PID: 916)
      • puty.exe (PID: 2128)
      • puy.exe (PID: 2480)
      • NetFlix GC Checker by xRisky.exe (PID: 296)

    • Downloads executable files from the Internet

      • NetFlix GC Checker by xRisky.exe (PID: 296)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2044)

    • NJRAT was detected

      • RegAsm.exe (PID: 3636)

    • Changes settings of System certificates

      • RegAsm.exe (PID: 2668)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3640)
      • putty.exe (PID: 344)
      • NetFlix GC Checker by xRisky.exe (PID: 296)
      • puy.exe (PID: 2480)
      • puty.exe (PID: 2128)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 1024)
      • rundll32.exe (PID: 2904)
      • rundll32.exe (PID: 1540)
      • rundll32.exe (PID: 3328)
      • rundll32.exe (PID: 644)

    • Creates files in the user directory

      • putty.exe (PID: 344)
      • puty.exe (PID: 2128)
      • rundll32.exe (PID: 1024)
      • NetFlix GC Checker by xRisky.exe (PID: 296)
      • puy.exe (PID: 2480)
      • svchost.exe (PID: 3132)

    • Application launched itself

      • svchost.exe (PID: 3132)
      • svchost.exe (PID: 988)

    • Uses RUNDLL32.EXE to load library

      • NetFlix GC Checker by xRisky.exe (PID: 296)

    • Uses NETSH.EXE for network configuration

      • RegAsm.exe (PID: 3636)

    • Adds / modifies Windows certificates

      • RegAsm.exe (PID: 2668)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
21
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe netflix gc checker by xrisky.exe rundll32.exe no specs putty.exe rundll32.exe no specs puty.exe rundll32.exe no specs svchost.exe no specs puy.exe svchost.exe rundll32.exe no specs regasm.exe pu.exe svchost.exe no specs rundll32.exe no specs regasm.exe regsvcs.exe no specs searchprotocolhost.exe no specs netflix gc checker by xrisky.exe no specs #NJRAT regasm.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\NetFlix GC Checker by xRisky.exe" C:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\NetFlix GC Checker by xRisky.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\netflix gift card checker by xrisky\netflix gc checker by xrisky.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
344"C:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\putty.exe" C:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\putty.exe
NetFlix GC Checker by xRisky.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\netflix gift card checker by xrisky\putty.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
644"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—NetFlix GC Checker by xRisky.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
916"C:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\pu.exe" C:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\pu.exe
NetFlix GC Checker by xRisky.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\netflix gift card checker by xrisky\pu.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
988"C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe—putty.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1024"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—NetFlix GC Checker by xRisky.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1136"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
puy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1248"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—pu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1540"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1 C:\Windows\system32\rundll32.exe—NetFlix GC Checker by xRisky.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2044"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 829
Read events
1 685
Write events
144
Delete events
0

Modification events

(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3640) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\10.rar
(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3640) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2044) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
18
Suspicious files
1
Text files
2 893
Unknown types
3

Dropped files

PID
Process
Filename
Type
3640WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3640.49935\Netflix Gift Card Checker by xRisky\PRIVATE COMBOLIST.txt —
MD5:—
SHA256:—
344putty.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppReadiness.urltext
MD5:—
SHA256:—
296NetFlix GC Checker by xRisky.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\c[1].exeexecutable
MD5:—
SHA256:—
344putty.exeC:\Users\admin\AppData\Local\Temp\MaxxAudioMeters64\AppReadiness.vbstext
MD5:—
SHA256:—
296NetFlix GC Checker by xRisky.exeC:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\putty.exeexecutable
MD5:—
SHA256:—
3640WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3640.49935\Netflix Gift Card Checker by xRisky\Leaf.xNet.dllexecutable
MD5:42CF916DF4EA1D300201EC9559B7BEF3
SHA256:939C8980BCB9BD9A2279714F6086714229E7AF194EC4E32677C5A4ED96DB5EDD
296NetFlix GC Checker by xRisky.exeC:\Users\admin\Desktop\Netflix Gift Card Checker by xRisky\puy.exeexecutable
MD5:—
SHA256:—
1024rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H7SPBY9W\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1024rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IS4SVBAK\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
296NetFlix GC Checker by xRisky.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\l[1].exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
20
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
296
NetFlix GC Checker by xRisky.exe
GET
—
88.13.146.179:80
http://Chrome.theworkpc.com/i.exe
ES
—
—
malicious
296
NetFlix GC Checker by xRisky.exe
GET
200
88.13.146.179:80
http://Chrome.theworkpc.com/l4.exe
ES
executable
926 Kb
malicious
296
NetFlix GC Checker by xRisky.exe
GET
200
88.13.146.179:80
http://Chrome.theworkpc.com/l.exe
ES
executable
926 Kb
malicious
296
NetFlix GC Checker by xRisky.exe
GET
200
88.13.146.179:80
http://Chrome.theworkpc.com/r.exe
ES
executable
908 Kb
malicious
296
NetFlix GC Checker by xRisky.exe
GET
200
88.13.146.179:80
http://Chrome.theworkpc.com/c.exe
ES
executable
1.40 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
296
NetFlix GC Checker by xRisky.exe
88.13.146.179:80
chrome.theworkpc.com
Telefonica De Espana
ES
malicious
2668
RegAsm.exe
88.13.146.179:9898
chrome.theworkpc.com
Telefonica De Espana
ES
malicious
3132
svchost.exe
88.13.146.179:1552
chrome.theworkpc.com
Telefonica De Espana
ES
malicious
1136
RegAsm.exe
88.13.146.179:3344
chrome.theworkpc.com
Telefonica De Espana
ES
malicious
2668
RegAsm.exe
104.20.209.21:443
pastebin.com
Cloudflare Inc
US
shared
3636
RegAsm.exe
88.13.146.179:5553
chrome.theworkpc.com
Telefonica De Espana
ES
malicious
—
—
88.13.146.179:3344
chrome.theworkpc.com
Telefonica De Espana
ES
malicious

DNS requests

Domain
IP
Reputation
chrome.theworkpc.com
  • 88.13.146.179
malicious
redlan.hopto.org
  • 88.13.146.179
malicious
pastebin.com
  • 104.20.209.21
  • 104.20.208.21
malicious

Threats

PID
Process
Class
Message
296
NetFlix GC Checker by xRisky.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
296
NetFlix GC Checker by xRisky.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
296
NetFlix GC Checker by xRisky.exe
A Network Trojan was detected
ET INFO AutoIt User Agent Downloading EXE
296
NetFlix GC Checker by xRisky.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
296
NetFlix GC Checker by xRisky.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
296
NetFlix GC Checker by xRisky.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
296
NetFlix GC Checker by xRisky.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
296
NetFlix GC Checker by xRisky.exe
A Network Trojan was detected
ET INFO AutoIt User Agent Downloading EXE
296
NetFlix GC Checker by xRisky.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
296
NetFlix GC Checker by xRisky.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
10.rar