| download: | MobiHok%202020.zip |
| Full analysis: | https://app.any.run/tasks/c6a3cf8e-bdb4-41cc-a6c0-23e627954261 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | March 23, 2020, 12:41:51 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 200F6A767F7B500C222982E1E0B8A0B6 |
| SHA1: | 9D3F05AB9268FC8CFD2E8D9C3E9E654674E19BCC |
| SHA256: | 9CA26D9552F6287E544407C06AB2ADE15368D90B39CE43190C2E5B4E1C9A8CB8 |
| SSDEEP: | 786432:ysVoXwyq9Tux+hWduaDfHGbFzrX0KxzB/MS:Fygy1+h2uaDfK5EKxzBUS |
MALICIOUS
Application was dropped or rewritten from another process
- MobiHok 2020.exe (PID: 3892)
- MobiHok 2020.exe (PID: 1784)
- WSReset.exe (PID: 1692)
- WSReset.exe (PID: 956)
- Mobihok v4.exe (PID: 2552)
- WSReset.exe (PID: 3296)
- WSReset.exe (PID: 1780)
- MobiHok.exe (PID: 2464)
- MobiHok.exe (PID: 1500)
Writes to a start menu file
- WSReset.exe (PID: 1780)
Changes the autorun value in the registry
- WSReset.exe (PID: 1780)
Uses Task Scheduler to run other applications
- WSReset.exe (PID: 1780)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 2532)
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 3036)
SUSPICIOUS
Reads internet explorer settings
- Mobihok v4.exe (PID: 2552)
Executable content was dropped or overwritten
- MobiHok 2020.exe (PID: 1784)
- WinRAR.exe (PID: 2128)
- WSReset.exe (PID: 1780)
- WSReset.exe (PID: 956)
- Mobihok v4.exe (PID: 2552)
Reads Internet Cache Settings
- Mobihok v4.exe (PID: 2552)
Creates files in the user directory
- WSReset.exe (PID: 956)
- WSReset.exe (PID: 1780)
Connects to unusual port
- WSReset.exe (PID: 956)
- WSReset.exe (PID: 1780)
Starts itself from another location
- WSReset.exe (PID: 956)
Writes to a desktop.ini file (may be used to cloak folders)
- Mobihok v4.exe (PID: 2552)
INFO
Manual execution by user
- MobiHok 2020.exe (PID: 1784)
- MobiHok 2020.exe (PID: 3892)
- MobiHok.exe (PID: 1500)
- MobiHok.exe (PID: 2464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2020:03:23 20:37:22 |
| ZipCRC: | 0x3ebbcf17 |
| ZipCompressedSize: | 29841717 |
| ZipUncompressedSize: | 30085010 |
| ZipFileName: | MobiHok 2020.exe |
Total processes
56
Monitored processes
12
Malicious processes
7
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 956 | "C:\Users\admin\AppData\Local\Temp\WSReset.exe" | C:\Users\admin\AppData\Local\Temp\WSReset.exe | WSReset.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: WSReset Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1500 | "C:\Users\admin\Desktop\Mobihok v4\MobiHok.exe" | C:\Users\admin\Desktop\Mobihok v4\MobiHok.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Android Remote Administration Exit code: 3221226540 Version: 6.4.0.0 Modules
| |||||||||||||||
| 1692 | "C:\Users\admin\AppData\Local\Temp\WSReset.exe" | C:\Users\admin\AppData\Local\Temp\WSReset.exe | — | MobiHok 2020.exe | |||||||||||
User: admin Integrity Level: HIGH Description: WSReset Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1780 | "C:\Users\admin\AppData\Roaming\WSReset.exe" | C:\Users\admin\AppData\Roaming\WSReset.exe | WSReset.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: WSReset Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1784 | "C:\Users\admin\Desktop\MobiHok 2020.exe" | C:\Users\admin\Desktop\MobiHok 2020.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2128 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\f37cce29-13e0-44eb-8309-4c39e3111405.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2464 | "C:\Users\admin\Desktop\Mobihok v4\MobiHok.exe" | C:\Users\admin\Desktop\Mobihok v4\MobiHok.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Android Remote Administration Exit code: 0 Version: 6.4.0.0 Modules
| |||||||||||||||
| 2532 | schtasks /create /sc minute /mo 60 /tn "WSReset" /tr "C:\Users\admin\AppData\Roaming\WSReset.exe" | C:\Windows\system32\schtasks.exe | — | WSReset.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2552 | "C:\Users\admin\AppData\Local\Temp\Mobihok v4.exe" | C:\Users\admin\AppData\Local\Temp\Mobihok v4.exe | MobiHok 2020.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3036 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 946
Read events
1 896
Write events
50
Delete events
0
Modification events
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\f37cce29-13e0-44eb-8309-4c39e3111405.zip | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
| (PID) Process: | (2128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
Executable files
15
Suspicious files
8
Text files
568
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\MobiHok.exe | executable | |
MD5:0031BD81932AE7D6B2275D807CDE2542 | SHA256:37C5BBA90CB1AE5A961E78A460738CEC3D75240C99DD37046D43E4BBBE8CB40E | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\AxInterop.WMPLib.dll | executable | |
MD5:6A92562239A3BBC311CACD0323D8D76F | SHA256:4F338A4370BC36D4BE25DDEB48A89C8D1D24FBE704039BCF4026208620DD81F3 | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\Resources\Icons\AccountManager\account.png | image | |
MD5:37B34268C25A9BF7EBF61DD220382F5F | SHA256:2D522164E403478E178483DFD9D1F31BA2E8E8E9056F967AA626308E39AA6BD0 | |||
| 956 | WSReset.exe | C:\Users\admin\AppData\Roaming\WSReset.exe | executable | |
MD5:46BAF3BD134A74C21DC2598A8220E148 | SHA256:70FCB45F0ED8CEFFDD8BC394A6DC6F22D6F79735980955145047E8729846F848 | |||
| 2128 | WinRAR.exe | C:\Users\admin\Desktop\MobiHok 2020.exe | executable | |
MD5:6BA3CC8EB06405B63045AC8990C3422E | SHA256:FE4E725986B43F110793C559A2B2B23B7B0BCB4931E970B5A140BE917ACDC679 | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\Resources\Audio\c.wav | wav | |
MD5:27096BEF1DC9B799CDA15F750F03DEBE | SHA256:59AC30EA0CC45B94A8D5DFA7A2066DEC9C9510629999326FBD95FB92E8B06AB9 | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\Interop.WMPLib.dll | executable | |
MD5:522DD830A68D499774FF1C174D156CC1 | SHA256:C8A3B5C6F557F6D6EC9BC2D7A761894B9E0964F628125438DBB4CDEF8A08E73C | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\Resources\Audio\desktop.ini | ini | |
MD5:F8C52BCC9B2653E4D896C2334DE3756C | SHA256:B5A2D1E4F8BB55FD6A31E56B03812B7523FFC89DAB103A559750BA0D08BB7E0F | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\CoreAudioApi.dll | executable | |
MD5:6A009B7C4B252788D80D4E40ADCF51CE | SHA256:DF6115987161EE1238F9564BD10C998D9016F582E5B7B9D23D21A74D6955BDD3 | |||
| 2552 | Mobihok v4.exe | C:\Users\admin\Desktop\Mobihok v4\Resources\Icons\AccountManager\com.android.email.png | image | |
MD5:1FC4ABE2F26276C04B55591BD0A584C3 | SHA256:6E68465A4C4E86F84517A3B230510E4D5D2F163744CD592C55DA8A89B0C866F5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
26
DNS requests
13
Threats
13
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
956 | WSReset.exe | 79.151.109.211:3333 | nibiru3.duckdns.org | Telefonica De Espana | ES | unknown |
1780 | WSReset.exe | 79.151.109.211:3333 | nibiru3.duckdns.org | Telefonica De Espana | ES | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
nibiru3.duckdns.org |
| malicious |
nibiru4.duckdns.org |
| malicious |
nibiru5.duckdns.org |
| malicious |
karmina113.sytes.net |
| malicious |
karmina117.sytes.net |
| malicious |
karmina118.sytes.net |
| malicious |
karmina119.sytes.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1052 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1052 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1052 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1052 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1052 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1052 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
7 ETPRO signatures available at the full report