analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Simple Roblox Cracker.rar

Full analysis: https://app.any.run/tasks/ecef002f-ea29-4984-90ba-dda9f383f773
Verdict: Malicious activity
Analysis date: December 06, 2018, 14:40:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

3ABD9E3083C717AE93D4B4C11D12F04A

SHA1:

6440BD9E58BF9761DAAAD0DD97DA565DC57F8FD7

SHA256:

9E1EFD1C7C6EDD275AF0AF9F415753EDACA9B2AC2E863B1FD74CE9A2BBB890E6

SSDEEP:

12288:gcdu7gfMazkIDcAszqepOO7MVaxnhfxQlgQ9cov2Lmum4v32d8egvbtP4+Uy:3dGgfZYccAsOXh8vil7VKmB4O3mpP4+j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Cracker.exe (PID: 2868)
      • stub.exe (PID: 2252)
      • RobloxChecker.exe (PID: 2508)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 416)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RobloxChecker.exe (PID: 2508)
      • stub.exe (PID: 2252)
      • WinRAR.exe (PID: 2940)

    • Reads the cookies of Google Chrome

      • stub.exe (PID: 2252)

  • INFO

    • Reads settings of System Certificates

      • Cracker.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: Roblox Cracker\checking.txt
PackingMethod: Normal
ModifyDate: 2018:11:17 14:59:16
OperatingSystem: Win32
UncompressedSize: 19223
CompressedSize: 11289
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe searchprotocolhost.exe no specs robloxchecker.exe stub.exe cracker.exe

Process information

PID
CMD
Path
Indicators
Parent process
2940"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Simple Roblox Cracker.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
416"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2508"C:\Users\admin\Desktop\RobloxChecker.exe" C:\Users\admin\Desktop\RobloxChecker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
4294967295
Version:
1.0.0.0
2252"C:\Users\admin\AppData\Local\Temp\stub.exe" C:\Users\admin\AppData\Local\Temp\stub.exe
RobloxChecker.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
4294967295
Version:
0.0.0.0
2868"C:\Users\admin\AppData\Local\Temp\Cracker.exe" C:\Users\admin\AppData\Local\Temp\Cracker.exe
stub.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ConsoleApp6
Exit code:
3221225786
Version:
1.0.0.0
Total events
1 379
Read events
1 289
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\README.txt —
MD5:—
SHA256:—
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\RobloxChecker.exe —
MD5:—
SHA256:—
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\xNet.dll —
MD5:—
SHA256:—
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\checking.txttext
MD5:FF14D6912B3EC8A2DD45BB94DFD40D8B
SHA256:C6BD13973857C1DC3417F718D9492D366797686F60F2702FDD46AE83F6909814
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\Hits.txttext
MD5:53EAF4A8ECDB4AD06C328A1637623FE1
SHA256:5E44C3B7D049A35EC8B77677D0A498B726014AF9D05617248D4F0C3727BFCD0C
2252stub.exeC:\Users\admin\AppData\Local\Temp\Cracker.exeexecutable
MD5:778D8C0225856AD02D46BAF8967DB9FF
SHA256:A295BD36584E6476783C41F6ABC14DEF62F0FD00F50F977114DC4329F4F4AEE2
2868Cracker.exeC:\Users\admin\Desktop\Hits.txttext
MD5:AD8ECC85A87312CEC09F6DB0BE9B0814
SHA256:AE49663C9E18068335347E4AFD86A3A5202C309A9F3C3C90FF99EFD52CFA7918
2508RobloxChecker.exeC:\Users\admin\AppData\Local\Temp\stub.exeexecutable
MD5:5FC49619385840C90978B0F4B1962436
SHA256:2E178363CDD4292AFD6F62AF058640B5048AFD8817865536C34D318CEE9F71BA
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\Newtonsoft.Json.dllexecutable
MD5:5AFDA7C7D4F7085E744C2E7599279DB3
SHA256:F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
2940WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2940.28635\Roblox Cracker\devices.txttext
MD5:AC2A5DE2E25D46D9C712C3534A092DF5
SHA256:26B1B5435A81CDB7E5611118F7F5AFAB9B94EC1CA129D9325B101F1427F45311
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
47
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
203 b
whitelisted
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
198 b
whitelisted
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
197 b
whitelisted
2252
stub.exe
GET
200
198.91.80.25:80
http://cookiemuncher.x10host.com/CMR7Files/check.php?hwid=OTM7v7nJFts6B5pbS5SSB5GqILMeEBpoqyZIIXo/HlDyA9Xy5eVRmFyiCsN6nmnzeRexvimhnU6kOsBWM2IF4V%2BCxq3kGY6Vt7KhntxkPZUnCVFcOwbVn2XwWps4/sWl
US
html
6.03 Kb
malicious
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
203 b
whitelisted
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
202 b
whitelisted
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
208 b
whitelisted
2868
Cracker.exe
GET
200
209.206.41.46:80
http://www.roblox.com/mobileapi/userinfo
US
text
201 b
whitelisted
2508
RobloxChecker.exe
GET
200
198.91.80.25:80
http://cookiemuncher.x10host.com/CMR7Files/check.php?hwid=OTM7v7nJFts6B5pbS5SSB5GqILMeEBpoqyZIIXo/HlDyA9Xy5eVRmFyiCsN6nmnzeRexvimhnU6kOsBWM2IF4V%2BCxq3kGY6Vt7KhntxkPZUnCVFcOwbVn2XwWps4/sWl
US
html
6.03 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2252
stub.exe
104.16.58.5:443
discordapp.com
Cloudflare Inc
US
shared
2868
Cracker.exe
209.206.41.3:443
api.roblox.com
Roblox
US
unknown
2508
RobloxChecker.exe
198.91.80.25:80
cookiemuncher.x10host.com
SingleHop, Inc.
US
malicious
2252
stub.exe
198.91.80.25:80
cookiemuncher.x10host.com
SingleHop, Inc.
US
malicious
2868
Cracker.exe
209.206.41.46:443
www.roblox.com
Roblox
US
unknown
2868
Cracker.exe
209.206.41.46:80
www.roblox.com
Roblox
US
unknown

DNS requests

Domain
IP
Reputation
cookiemuncher.x10host.com
  • 198.91.80.25
malicious
discordapp.com
  • 104.16.58.5
  • 104.16.59.5
whitelisted
api.roblox.com
  • 209.206.41.3
malicious
www.roblox.com
  • 209.206.41.46
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Simple Roblox Cracker.rar