analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Archive-0e45.zip

Full analysis: https://app.any.run/tasks/7ae7599f-8909-4495-9b22-3eeeba4960af
Verdict: Malicious activity
Analysis date: May 30, 2020, 18:25:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C23C69BDAB63099F1B0EE16631D299C0

SHA1:

0F41EE8DE5D78530774C8D9D7AFDA261C90D26B6

SHA256:

8CB369CF3BA0300A96C3CBD2507F39959F08FA901171FA79F7E082DDA7BFFB9B

SSDEEP:

98304:+/mTQ3nUnSGZOUIaZJ/QCYcFxspQ5nVa9H6hcDh5A+MUzbGf3nUnSGZOUIa8J/Ee:KBjGIYQHcGSW62/IjGIjEHcGSW62yh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RuBotTools.exe (PID: 1004)
      • RuTools.exe (PID: 860)

    • Loads dropped or rewritten executable

      • RuBotTools.exe (PID: 1004)
      • RuTools.exe (PID: 860)

    • Writes to a start menu file

      • RuBotTools.exe (PID: 1004)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 2732)

    • Creates files in the user directory

      • RuBotTools.exe (PID: 1004)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2880)

    • Starts Internet Explorer

      • RuTools.exe (PID: 860)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2880)
      • iexplore.exe (PID: 2416)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3936)
      • iexplore.exe (PID: 2416)

    • Application launched itself

      • iexplore.exe (PID: 3936)

    • Changes internet zones settings

      • iexplore.exe (PID: 3936)

    • Creates files in the user directory

      • iexplore.exe (PID: 2416)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2416)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2416)
      • iexplore.exe (PID: 3936)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3936)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: None
ZipModifyDate: 2020:04:24 10:31:05
ZipCRC: 0x7e8bb955
ZipCompressedSize: 8509164
ZipUncompressedSize: 8509164
ZipFileName: RuBotTools Twitch ViewerBOT.rar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs winrar.exe rubottools.exe rutools.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2732"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Archive-0e45.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2880"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2732.511\RuBotTools Twitch ViewerBOT.rar"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1004"C:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\RuBotTools.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\RuBotTools.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
interface
Exit code:
0
Version:
1.0.0.0
860"C:\Users\admin\AppData\Local\Temp\Rar$EXa2880.2888\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\RuTools.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2880.2888\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\RuTools.exe—WinRAR.exe
User:
admin
Company:
RuBot.OVH
Integrity Level:
MEDIUM
Description:
RuBot_Tools
Version:
6.6.7.0
3936"C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/Evx7u7fC:\Program Files\Internet Explorer\iexplore.exe
RuTools.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2416"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3936 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
6 512
Read events
1 726
Write events
0
Delete events
0

Modification events

No data
Executable files
28
Suspicious files
14
Text files
37
Unknown types
19

Dropped files

PID
Process
Filename
Type
2732WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2732.511\RuBotTools Twitch ViewerBOT.rar —
MD5:—
SHA256:—
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\Microsoft Windows Protocol Services Host.exeexecutable
MD5:7E4EC49968CDFEB455C1F56C5A944287
SHA256:C68300968C576203725E09EDF1AC9B069B903EE06A4321C8C8FE5582898C10E4
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\RuBotTools.pdbpdb
MD5:341857FE147A98E1D9762558F79C5462
SHA256:096EFB49057785421801697431324917531C58D0B82BEB17A04954E90B81128A
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\Settings.initext
MD5:B9A2CA72F3080F67A4078EC056FA37D9
SHA256:32B9AA24C0E5B6001BDFF069E58ED0C366A8EF4E2C5DE4B6F9AEAD572FCCF4F6
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\System.Windows.Forms.dllexecutable
MD5:B4B04ABB3277F22993FD82C3D5A14BCE
SHA256:99D1E2C307C542202E163590E6EDDA3D5C5AFB60FF00E86A5EF3D3C96423A265
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\RuTools.exeexecutable
MD5:DD77563B285AA93793C04C2EDDCA3708
SHA256:671C0DC9A209FAEB501C7C17E7D9014D97C8B22000EFAFE8E4F215CA26ED89CA
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\System.dllexecutable
MD5:C4327ED4F66AA82D06291392EE738EFD
SHA256:C622798E5ECB5FFF65B90250A53B9FFDDAD686595177943BEF7D0FD8F44896F8
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.2888\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\Microsoft Windows Protocol Services Host.exeexecutable
MD5:7E4EC49968CDFEB455C1F56C5A944287
SHA256:C68300968C576203725E09EDF1AC9B069B903EE06A4321C8C8FE5582898C10E4
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.2888\RuBotTools Twitch ViewerBOT\RuBotTools.exe\Data\Settings.initext
MD5:B9A2CA72F3080F67A4078EC056FA37D9
SHA256:32B9AA24C0E5B6001BDFF069E58ED0C366A8EF4E2C5DE4B6F9AEAD572FCCF4F6
2880WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2880.1800\RuBotTools Twitch ViewerBOT\RuBotTools.exe\RuBotTools.exeexecutable
MD5:45A03773B256772E4CA1BE64D6E8515D
SHA256:C0EABCEC01F2B0B83CD71296A5A24D25B39ECBFEFA7594F65513970A6A7A2488
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
15
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEDsJGKKiFxWJllawuNqPxXw%3D
US
der
278 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEBblhnjgcJQ5S9%2FbTvymO98%3D
US
der
471 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D
US
der
313 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEBblhnjgcJQ5S9%2FbTvymO98%3D
US
der
471 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D
US
der
313 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQCML6NXQdejdBJDG5j4aa9U
US
der
280 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQCML6NXQdejdBJDG5j4aa9U
US
der
280 b
whitelisted
2416
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEDsJGKKiFxWJllawuNqPxXw%3D
US
der
278 b
whitelisted
3936
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3936
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2416
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2416
iexplore.exe
162.159.135.232:443
discord.com
Cloudflare Inc
—
malicious
2416
iexplore.exe
162.159.135.234:443
discord.gg
Cloudflare Inc
—
shared
—
—
162.159.135.232:443
discord.com
Cloudflare Inc
—
malicious

DNS requests

Domain
IP
Reputation
discord.gg
  • 162.159.135.234
  • 162.159.130.234
  • 162.159.136.234
  • 162.159.133.234
  • 162.159.134.234
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.comodoca4.com
  • 151.139.128.14
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.138.232
  • 162.159.136.232
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Archive-0e45.zip