URL:

https://www.google.com/search?q=virusmaker&rlz=1C1AVFC_enCZ881CZ881&oq=virusmaker&aqs=chrome..69i57j0i10l2j0i10i30l3j5i30i44.3750j0j7&sourceid=chrome&ie=UTF-8

Full analysis: https://app.any.run/tasks/763a7d9f-a1dd-4e83-95f5-87bf4cc6cedc
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 12:52:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MD5:

4C9BA58CEBB351FB929A062B7CB3B7E3

SHA1:

D7C62B4C2D5AE2B6D4366F8D3EB1C04AF3F5853D

SHA256:

8FB14A660923AC8570D743DFCC044606AFC978DFD2E5344662B158B844FB6399

SSDEEP:

3:N8DSLIwAEXGpzXD9DXHj5goP9DEPYMA/Q0+IX+NS2qlwUX9GiVzjId:2OLIwBGdhbNgo1YPYMA/d+IX+XqlwUTy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • vbc.exe (PID: 3424)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 1456)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 2784)
      • Virus Maker.exe (PID: 3060)

  • SUSPICIOUS

    • Executes scripts

      • Virus Maker.exe (PID: 3060)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 2784)

    • Executable content was dropped or overwritten

      • vbc.exe (PID: 3424)
      • WinRAR.exe (PID: 2208)

    • Drops a file with a compile date too recent

      • vbc.exe (PID: 3424)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2208)

    • Reads internet explorer settings

      • Virus Maker.exe (PID: 3060)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2656)
      • chrome.exe (PID: 2024)

    • Manual execution by user

      • setup.exe (PID: 2784)

    • Application launched itself

      • chrome.exe (PID: 2656)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
23
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe notepad.exe no specs chrome.exe no specs virus maker.exe no specs vbc.exe cvtres.exe no specs setup.exe no specs cmd.exe no specs shutdown.exe no specs net.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
380"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,17076322646669331494,12739207595516864616,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9235875166101994035 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1016"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,17076322646669331494,12739207595516864616,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15878870810220253934 --mojo-platform-channel-handle=1052 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1456cmd /c ""C:\Users\admin\AppData\Local\Temp\cmd.bat" "C:\Windows\system32\cmd.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1073807364
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1516C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES1FF.tmp" "C:\Users\admin\AppData\Local\Temp\vbcAE9F92EE694B4257BC274FCDC878502F.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—vbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.52519.0 built by: VSWINSERVICING
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\cryptsp.dll
2024"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,17076322646669331494,12739207595516864616,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=10801526809522028597 --mojo-platform-channel-handle=1540 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,17076322646669331494,12739207595516864616,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=589751079019249064 --mojo-platform-channel-handle=3532 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
2176"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb2208.21281\readme.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2208"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Virus Maker.rar"C:\Program Files\WinRAR\WinRAR.exe
chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1073807364
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2292"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,17076322646669331494,12739207595516864616,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4795215737137254145 --mojo-platform-channel-handle=3160 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2552"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2288 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
2 478
Read events
2 330
Write events
142
Delete events
6

Modification events

(PID) Process:(2552) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2656-13251127942134500
Value:
259
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2656) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2656) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
2
Suspicious files
37
Text files
99
Unknown types
7

Dropped files

PID
Process
Filename
Type
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FC39986-A60.pma —
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\8444954b-ce11-44ac-8a8c-d77e2707dab7.tmp —
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF15b5cc.TMPtext
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old~RF15b6c6.TMPtext
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2656chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF15b7ff.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
41
DNS requests
22
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/?id=vm
IT
html
3.87 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=8f60a1b552edf9587d5b4f1ff12203ba
IT
image
34.5 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=15927d9ab6ea93229b4f22a561664ec1
IT
image
29.3 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=9b306ab04ef5e25f9fb89c998a6aedab
IT
image
37.2 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=a7a6dde8918ebb00461d54e1f3830482
IT
image
35.3 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=dff2bc1c709aa5ed65731979e8697f5c
IT
image
31.9 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=a6fbf64ae6089351cf46c2438e774ed1
IT
image
37.5 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://www.blackhost.xyz/classes/i.php?u=8f60a1b552edf9587d5b4f1ff12203ba
IT
image
34.5 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=2510c39011c5be704182423e3a695e91
IT
image
36.0 Kb
suspicious
2024
chrome.exe
GET
200
2.238.145.99:80
http://blackhost.xyz/classes/i.php?u=d16d377af76c99d27093abc22244b342
IT
image
36.7 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2024
chrome.exe
172.217.20.77:443
accounts.google.com
Google Inc.
US
whitelisted
2024
chrome.exe
136.144.144.230:443
f.jwwb.nl
Transip B.V.
NL
unknown
2024
chrome.exe
34.120.151.89:443
cdn.jwwb.nl
—
US
unknown
2024
chrome.exe
172.217.17.110:443
consent.google.com
Google Inc.
US
whitelisted
2024
chrome.exe
35.204.150.5:443
virusmakernl.jouwweb.nl
Google Inc.
US
malicious
2024
chrome.exe
2.238.145.99:80
blackhost.xyz
Fastweb
IT
suspicious
2024
chrome.exe
216.58.207.130:443
adservice.google.com
Google Inc.
US
whitelisted
2024
chrome.exe
172.217.20.110:443
consent.youtube.com
Google Inc.
US
whitelisted
2024
chrome.exe
216.58.207.142:443
ogs.google.com
Google Inc.
US
whitelisted
2024
chrome.exe
172.217.22.206:443
clients1.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.19.196
malicious
accounts.google.com
  • 172.217.20.77
shared
fonts.gstatic.com
  • 216.58.214.3
whitelisted
consent.google.com
  • 172.217.17.110
shared
virusmakernl.jouwweb.nl
  • 35.204.150.5
malicious
www.gstatic.com
  • 172.217.22.227
whitelisted
cdn.jwwb.nl
  • 34.120.151.89
whitelisted
f.jwwb.nl
  • 136.144.144.230
unknown
www.jouwweb.nl
  • 34.90.225.198
suspicious
apis.google.com
  • 172.217.23.46
whitelisted

Threats

PID
Process
Class
Message
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2024
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.google.com/search?q=virusmaker&rlz=1C1AVFC_enCZ881CZ881&oq=virusmaker&aqs=chrome..69i57j0i10l2j0i10i30l3j5i30i44.3750j0j7&sourceid=chrome&ie=UTF-8