analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

loader.rar

Full analysis: https://app.any.run/tasks/ae68b02e-38c6-424d-b3ca-6b6018f6729f
Verdict: Malicious activity
Analysis date: April 15, 2019, 13:57:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7BC892D109ECE72C9AD4FEC7AA57BA80

SHA1:

04875DDD3E90305C3751F977040FE87B4325FBB4

SHA256:

92D7354B6BA641E4056C2EBBEE837409160E35D623EBB0981612425B54CBE5E0

SSDEEP:

6144:eYMkveZ0gROPc/kRSLIJQy8jHTCvVdtMUQZZfvPxNm69BSKF+jxfJt2Kp+:evZ01Mkv8jHWLtQZx5Nm6LS9p+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3948)
      • LuminaryLoader.exe (PID: 1388)
      • LuminaryLoader.exe (PID: 2964)
      • LuminaryLoader.exe (PID: 476)
      • LuminaryLoader.exe (PID: 2732)
    • Application was dropped or rewritten from another process

      • LuminaryLoader.exe (PID: 1388)
      • LuminaryLoader.exe (PID: 2964)
      • LuminaryLoader.exe (PID: 476)
      • LuminaryLoader.exe (PID: 2732)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1700)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs luminaryloader.exe luminaryloader.exe luminaryloader.exe luminaryloader.exe

Process information

PID
CMD
Path
Indicators
Parent process
1700"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\loader.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3948"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2964"C:\Users\admin\Desktop\LuminaryLoader.exe" C:\Users\admin\Desktop\LuminaryLoader.exe
explorer.exe
User:
admin
Company:
pasters.cc/User-root
Integrity Level:
MEDIUM
Description:
LuminaryLoader
Version:
1.0.0.0
1388"C:\Users\admin\Desktop\LuminaryLoader.exe" C:\Users\admin\Desktop\LuminaryLoader.exe
explorer.exe
User:
admin
Company:
pasters.cc/User-root
Integrity Level:
MEDIUM
Description:
LuminaryLoader
Version:
1.0.0.0
476"C:\Users\admin\Desktop\LuminaryLoader.exe" C:\Users\admin\Desktop\LuminaryLoader.exe
explorer.exe
User:
admin
Company:
pasters.cc/User-root
Integrity Level:
MEDIUM
Description:
LuminaryLoader
Version:
1.0.0.0
2732"C:\Users\admin\Desktop\LuminaryLoader.exe" C:\Users\admin\Desktop\LuminaryLoader.exe
explorer.exe
User:
admin
Company:
pasters.cc/User-root
Integrity Level:
MEDIUM
Description:
LuminaryLoader
Version:
1.0.0.0
Total events
923
Read events
858
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\configs\Configs.txttext
MD5:A0A5433C4F8B187BB6DA7E933FF5E6F6
SHA256:2D59D541BD4C87FAE630F17DA44F6699BE42DDDA5610943AEC006A3BF9A09D74
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\LuminaryLoader.exeexecutable
MD5:24D7EC9F1E948558161643971B1BB46C
SHA256:FFF4F24EA4EEED478126B2A010CD7F760A5E8F4324A729DF5E38E169837801DC
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\jose-jwt.dllexecutable
MD5:77FF6F4DA066FD54EC20777FBD9154FA
SHA256:11D733CE3C48EC116AB81F23E0A6232332C55BCDEFB10386C1E0400EE5A0464A
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\ReadME_PL.txttext
MD5:B2B2F92619A8C5F41FFB7B90559F4F38
SHA256:B9F2919D30BA619045EFAA9116BFE232236C00F7FC46F4A3A4676679799D81B2
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\Authed.dllexecutable
MD5:DA5404D098B1FC3F40D8E473E9676656
SHA256:88D03EBEBB16BD8F1311D8C03E238C5579CF3ABA8828751F5B35E36F110A7E99
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\configs\Rage.initext
MD5:1ACA0A69819A3012017B57A7C18170AD
SHA256:429754621DA48182269D80113A9586A90C08492276DE898C7BAFB6FB7FB5A324
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\configs\Legit.initext
MD5:D8A7DD5C069CCC3D182079EF5327EBF9
SHA256:05D4B36813082DEC4C90491B878241A61F7CB567C1FCD16435F9DA121DF0FC2E
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\ReadME_ENG.txttext
MD5:CBD34450E4B28A28C4BC978359A048D0
SHA256:7129FD5BEA38A888D05B1C237F0C6A77E22AABCB5ACF1724B3458FAC984DF40E
1700WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\Newtonsoft.Json.dllexecutable
MD5:C53737821B861D454D5248034C3C097C
SHA256:575E30F98E4EA42C9E516EDC8BBB29AD8B50B173A3E6B36B5BA39E133CCE9406
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1388
LuminaryLoader.exe
104.24.113.5:443
authed.io
Cloudflare Inc
US
shared
476
LuminaryLoader.exe
104.24.113.5:443
authed.io
Cloudflare Inc
US
shared
2964
LuminaryLoader.exe
104.24.113.5:443
authed.io
Cloudflare Inc
US
shared
2732
LuminaryLoader.exe
104.24.113.5:443
authed.io
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
authed.io
  • 104.24.113.5
  • 104.24.112.5
suspicious

Threats

No threats detected
No debug info