File name: | loader.rar |
Full analysis: | https://app.any.run/tasks/ae68b02e-38c6-424d-b3ca-6b6018f6729f |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 13:57:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 7BC892D109ECE72C9AD4FEC7AA57BA80 |
SHA1: | 04875DDD3E90305C3751F977040FE87B4325FBB4 |
SHA256: | 92D7354B6BA641E4056C2EBBEE837409160E35D623EBB0981612425B54CBE5E0 |
SSDEEP: | 6144:eYMkveZ0gROPc/kRSLIJQy8jHTCvVdtMUQZZfvPxNm69BSKF+jxfJt2Kp+:evZ01Mkv8jHWLtQZx5Nm6LS9p+ |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1700 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\loader.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3948 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
2964 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | |
User: admin Company: pasters.cc/User-root Integrity Level: MEDIUM Description: LuminaryLoader Version: 1.0.0.0 | ||||
1388 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | |
User: admin Company: pasters.cc/User-root Integrity Level: MEDIUM Description: LuminaryLoader Version: 1.0.0.0 | ||||
476 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | |
User: admin Company: pasters.cc/User-root Integrity Level: MEDIUM Description: LuminaryLoader Version: 1.0.0.0 | ||||
2732 | "C:\Users\admin\Desktop\LuminaryLoader.exe" | C:\Users\admin\Desktop\LuminaryLoader.exe | explorer.exe | |
User: admin Company: pasters.cc/User-root Integrity Level: MEDIUM Description: LuminaryLoader Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\configs\Configs.txt | text | |
MD5:A0A5433C4F8B187BB6DA7E933FF5E6F6 | SHA256:2D59D541BD4C87FAE630F17DA44F6699BE42DDDA5610943AEC006A3BF9A09D74 | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\LuminaryLoader.exe | executable | |
MD5:24D7EC9F1E948558161643971B1BB46C | SHA256:FFF4F24EA4EEED478126B2A010CD7F760A5E8F4324A729DF5E38E169837801DC | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\jose-jwt.dll | executable | |
MD5:77FF6F4DA066FD54EC20777FBD9154FA | SHA256:11D733CE3C48EC116AB81F23E0A6232332C55BCDEFB10386C1E0400EE5A0464A | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\ReadME_PL.txt | text | |
MD5:B2B2F92619A8C5F41FFB7B90559F4F38 | SHA256:B9F2919D30BA619045EFAA9116BFE232236C00F7FC46F4A3A4676679799D81B2 | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\Authed.dll | executable | |
MD5:DA5404D098B1FC3F40D8E473E9676656 | SHA256:88D03EBEBB16BD8F1311D8C03E238C5579CF3ABA8828751F5B35E36F110A7E99 | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\configs\Rage.ini | text | |
MD5:1ACA0A69819A3012017B57A7C18170AD | SHA256:429754621DA48182269D80113A9586A90C08492276DE898C7BAFB6FB7FB5A324 | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\configs\Legit.ini | text | |
MD5:D8A7DD5C069CCC3D182079EF5327EBF9 | SHA256:05D4B36813082DEC4C90491B878241A61F7CB567C1FCD16435F9DA121DF0FC2E | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\ReadME_ENG.txt | text | |
MD5:CBD34450E4B28A28C4BC978359A048D0 | SHA256:7129FD5BEA38A888D05B1C237F0C6A77E22AABCB5ACF1724B3458FAC984DF40E | |||
1700 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1700.19281\Newtonsoft.Json.dll | executable | |
MD5:C53737821B861D454D5248034C3C097C | SHA256:575E30F98E4EA42C9E516EDC8BBB29AD8B50B173A3E6B36B5BA39E133CCE9406 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1388 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
476 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
2964 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
2732 | LuminaryLoader.exe | 104.24.113.5:443 | authed.io | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
authed.io |
| suspicious |