File name:

SLAYER_Leecher_v0.6.rar

Full analysis: https://app.any.run/tasks/4c324408-d23d-4b9d-8574-471bf78a433d
Verdict: Malicious activity
Analysis date: July 11, 2020, 12:50:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

13732DB9B6E61FC390009ADBA76C251D

SHA1:

D4B9DDCEF1B781777BBCB848D6397DAF5843C37C

SHA256:

A489F71F24DB00FBDB463753CD51ECABB9291CA8234A942B90F9C9FBF1F7D0A7

SSDEEP:

98304:S0URD7QPRhqYhQolAu2UVuEuVhiy4zZjDmdvh9Qbujr9C:S0M7uRhNDlAu2UAEChi72XQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3616)
      • SLAYER Leecher v0.6.exe (PID: 3492)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2252)
      • SLAYER Leecher v0.6.exe (PID: 3492)

    • Reads Environment values

      • SLAYER Leecher v0.6.exe (PID: 3492)

  • INFO

    • Manual execution by user

      • SLAYER Leecher v0.6.exe (PID: 3492)

    • Reads settings of System Certificates

      • SLAYER Leecher v0.6.exe (PID: 3492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 357
UncompressedSize: 486
OperatingSystem: Win32
ModifyDate: 2018:01:06 23:25:10
PackingMethod: Best Compression
ArchivedFileName: SLAYER Leecher v0.6\Keywords & Regex\Keywords.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs slayer leecher v0.6.exe

Process information

PID
CMD
Path
Indicators
Parent process
2252"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SLAYER_Leecher_v0.6.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3492"C:\Users\admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe" C:\Users\admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe
explorer.exe
User:
admin
Company:
Iheb Briki
Integrity Level:
MEDIUM
Description:
SLAYER Leecher
Exit code:
0
Version:
0.4.1
Modules
Images
c:\users\admin\desktop\slayer leecher v0.6\slayer leecher v0.6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3616"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
857
Read events
803
Write events
54
Delete events
0

Modification events

(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2252) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2252) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SLAYER_Leecher_v0.6.rar
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2252) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
2
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2252.18430\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe —
MD5:—
SHA256:—
2252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2252.18430\SLAYER Leecher v0.6\xNet.dll —
MD5:—
SHA256:—
2252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2252.18430\SLAYER Leecher v0.6\Keywords & Regex\Keywords.txttext
MD5:47A04EDE025EA68051E15A4139F393EA
SHA256:1F0DC0620FC73DA35873F759DA3D7A1CCC75EBE2597DE44C135E3DD35B29CDE2
2252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2252.18430\SLAYER Leecher v0.6\Keywords & Regex\Regex List.rtftext
MD5:31025A21B63C80C8C235B28BB03F04BE
SHA256:888C359087D562D7790A027C49B764B09254A49B1C4565F481E8BE3B4274482B
3492SLAYER Leecher v0.6.exeC:\Users\admin\AppData\Local\SkinSoft\VisualStyler\2.3.5.0\x86\ssapihook.dllexecutable
MD5:D7F644C06B4CDE60651D02AED6B4174D
SHA256:A99EA2F5759B34859B484AFA3A58CE82A7F3BF792886A6C838DB852D517D9C0D
2252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2252.18430\SLAYER Leecher v0.6\READ THIS PLZ !!.rtftext
MD5:F54E55486D835BC47E2916AB5D98262C
SHA256:43B4C33522B9F4BD08D70182ECFE7A58CD09C6BD1F30468B3D54F37F27D84285
2252WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2252.18430\SLAYER Leecher v0.6\SkinSoft.VisualStyler.dllexecutable
MD5:2D84A619D4BD339F860CB48AF0C9B6C8
SHA256:365FFDE7DF914840EB21C96F34C39912A4B031E3814B8E902B67ACEE6DFF65A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
45
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3492
SLAYER Leecher v0.6.exe
GET
302
216.58.208.35:80
http://www.google.tn/search?q=hq%20combolist&num=100&tbs=qdr:w&ei=-d2PUqnoIOyp7AbP2IGoBQ&start=50&sa=N&biw=1366&bih=604
US
html
456 b
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
429
216.58.207.68:80
http://www.google.com/sorry/index?continue=http://www.google.tn/search%3Fq%3Dhq%2520combolist%26num%3D100%26tbs%3Dqdr:d%26ei%3D-d2PUqnoIOyp7AbP2IGoBQ%26start%3D50%26sa%3DN%26biw%3D1366%26bih%3D604&q=EgSflLr2GJHspvgFIhkA8aeDS4_1VhkSipYcETbKFpSyJtTsqjasMgFy
US
html
3.10 Kb
malicious
3492
SLAYER Leecher v0.6.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=combo&start=55
US
html
72.0 Kb
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
302
216.58.208.35:80
http://www.google.tn/search?q=%0Acombolist%20hq&num=100&tbs=qdr:d&ei=-d2PUqnoIOyp7AbP2IGoBQ&start=50&sa=N&biw=1366&bih=604
US
html
461 b
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
302
216.58.212.163:80
http://www.google.ru/search?q=%0A@gmail.com&num=100&tbs=qdr:d&ei=-d2PUqnoIOyp7AbP2IGoBQ&start=50&sa=N&biw=1366&bih=604
US
html
457 b
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
302
172.217.16.131:80
http://www.google.fr/search?q=combo&num=100&tbs=qdr:d&ei=-d2PUqnoIOyp7AbP2IGoBQ&start=50&sa=N&biw=1366&bih=604
US
html
445 b
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
302
216.58.208.35:80
http://www.google.tn/search?q=%0A@gmail.com&num=100&tbs=qdr:w&ei=-d2PUqnoIOyp7AbP2IGoBQ&start=50&sa=N&biw=1366&bih=604
US
html
457 b
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
302
216.58.208.35:80
http://www.google.tn/search?q=hq%20combolist&num=100&tbs=qdr:d&ei=-d2PUqnoIOyp7AbP2IGoBQ&start=50&sa=N&biw=1366&bih=604
US
html
456 b
whitelisted
3492
SLAYER Leecher v0.6.exe
GET
429
216.58.207.68:80
http://www.google.com/sorry/index?continue=http://www.google.ru/search%3Fq%3D%250Acombolist%2520hq%26num%3D100%26tbs%3Dqdr:w%26ei%3D-d2PUqnoIOyp7AbP2IGoBQ%26start%3D50%26sa%3DN%26biw%3D1366%26bih%3D604&q=EgSflLr2GKPspvgFIhkA8aeDS-WePJqJyW1UOCPzFv_wGX2DpaMjMgFy
US
html
3.11 Kb
malicious
3492
SLAYER Leecher v0.6.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=%0Acombolist%20hq&start=55
US
html
47.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3492
SLAYER Leecher v0.6.exe
216.58.207.68:443
www.google.com
Google Inc.
US
whitelisted
3492
SLAYER Leecher v0.6.exe
104.23.98.190:443
pastebin.com
Cloudflare Inc
US
malicious
3492
SLAYER Leecher v0.6.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3492
SLAYER Leecher v0.6.exe
40.114.177.156:443
duckduckgo.com
Microsoft Corporation
NL
suspicious
3492
SLAYER Leecher v0.6.exe
5.255.255.50:443
yandex.ru
YANDEX LLC
RU
whitelisted
3492
SLAYER Leecher v0.6.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3492
SLAYER Leecher v0.6.exe
216.58.207.68:80
www.google.com
Google Inc.
US
whitelisted
3492
SLAYER Leecher v0.6.exe
216.58.208.35:80
www.google.tn
Google Inc.
US
whitelisted
3492
SLAYER Leecher v0.6.exe
216.58.212.163:80
www.google.ru
Google Inc.
US
whitelisted
—
—
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
malicious
www.google.com
  • 216.58.207.68
malicious
yandex.ru
  • 5.255.255.50
  • 77.88.55.88
  • 5.255.255.5
  • 77.88.55.50
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
duckduckgo.com
  • 40.114.177.156
whitelisted
www.google.fr
  • 172.217.16.131
whitelisted
www.google.tn
  • 216.58.208.35
whitelisted
www.google.ru
  • 216.58.212.163
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SLAYER_Leecher_v0.6.rar