analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IP Camera Hacker.exe

Full analysis: https://app.any.run/tasks/40d0df36-4c65-4260-931c-600a769ffba2
Verdict: Malicious activity
Analysis date: September 30, 2020, 11:25:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

0E2A3BA46B9B73C4669301B09BB3FE29

SHA1:

799CFA43885154E85ACE19E9389E46B987962E9F

SHA256:

A4DFA71A80905D73772A6F315C008C1A57B6A59FE01ACD0B61C545FEC4FEBE00

SSDEEP:

196608:Ggeb1wbrISB9I/woyd9WPatLQl6ygqUtf1C+m3fV89csR:mbSzK/woyFLQlAqUtUbW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Pbanccvckxt.exe (PID: 3972)
      • Oskhoajlfv.exe (PID: 1700)
      • Oskhoajlfv.exe (PID: 3524)
      • Pbanccvckxt.exe (PID: 1076)
      • Oskhoajlfv.exe (PID: 3600)

    • Loads dropped or rewritten executable

      • Pbanccvckxt.exe (PID: 3972)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • IP Camera Hacker.exe (PID: 4084)
      • Pbanccvckxt.exe (PID: 1076)

    • Loads Python modules

      • Pbanccvckxt.exe (PID: 3972)

    • Application launched itself

      • Oskhoajlfv.exe (PID: 3524)
      • Pbanccvckxt.exe (PID: 1076)

    • Checks for external IP

      • Oskhoajlfv.exe (PID: 3600)

    • Reads Environment values

      • Oskhoajlfv.exe (PID: 3600)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Pbanccvckxt.exe (PID: 1076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

AssemblyVersion: 0.0.0.0
ProductVersion: 0.0.0.0
OriginalFileName: hgjghj.exe
LegalCopyright:
InternalName: hgjghj.exe
FileVersion: 0.0.0.0
FileDescription:
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x92901e
UninitializedDataSize: -
InitializedDataSize: 61952
CodeSize: 9597440
LinkerVersion: 11
PEType: PE32
TimeStamp: 2020:08:27 17:48:01+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Aug-2020 15:48:01
FileDescription: -
FileVersion: 0.0.0.0
InternalName: hgjghj.exe
LegalCopyright: -
OriginalFilename: hgjghj.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 27-Aug-2020 15:48:01
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x00927024
0x00927200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.99894
.rsrc
0x0092A000
0x0000EEF8
0x0000F000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.29026
.reloc
0x0093A000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST
2
5.58652
3752
UNKNOWN
UNKNOWN
RT_ICON
3
6.05629
2216
UNKNOWN
UNKNOWN
RT_ICON
4
5.5741
1384
UNKNOWN
UNKNOWN
RT_ICON
5
7.95079
37019
UNKNOWN
UNKNOWN
RT_ICON
6
5.29119
9640
UNKNOWN
UNKNOWN
RT_ICON
7
5.43869
4264
UNKNOWN
UNKNOWN
RT_ICON
8
5.89356
1128
UNKNOWN
UNKNOWN
RT_ICON
32512
2.72742
104
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start start ip camera hacker.exe oskhoajlfv.exe no specs pbanccvckxt.exe pbanccvckxt.exe oskhoajlfv.exe no specs oskhoajlfv.exe

Process information

PID
CMD
Path
Indicators
Parent process
4084"C:\Users\admin\AppData\Local\Temp\IP Camera Hacker.exe" C:\Users\admin\AppData\Local\Temp\IP Camera Hacker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3524"C:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exe" C:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exe—IP Camera Hacker.exe
User:
admin
Company:
Free
Integrity Level:
MEDIUM
Description:
Free
Exit code:
0
Version:
7.2.9.5
1076"C:\Users\admin\AppData\Local\Temp\Pbanccvckxt.exe" C:\Users\admin\AppData\Local\Temp\Pbanccvckxt.exe
IP Camera Hacker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
3972"C:\Users\admin\AppData\Local\Temp\Pbanccvckxt.exe" C:\Users\admin\AppData\Local\Temp\Pbanccvckxt.exe
Pbanccvckxt.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
1700"C:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exe"C:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exe—Oskhoajlfv.exe
User:
admin
Company:
Free
Integrity Level:
MEDIUM
Description:
Free
Exit code:
4294967295
Version:
7.2.9.5
3600"C:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exe"C:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exe
Oskhoajlfv.exe
User:
admin
Company:
Free
Integrity Level:
MEDIUM
Description:
Free
Version:
7.2.9.5
Total events
429
Read events
403
Write events
0
Delete events
0

Modification events

No data
Executable files
26
Suspicious files
3
Text files
916
Unknown types
2

Dropped files

PID
Process
Filename
Type
4084IP Camera Hacker.exeC:\Users\admin\AppData\Local\Temp\Oskhoajlfv.exeexecutable
MD5:CCA96CB34B2308B0CB153D8F0ADB4B95
SHA256:1078F76DA8B260B54B9B488CA1FD4381EA67619DFFDD0F3D9CD73109F68E6838
4084IP Camera Hacker.exeC:\Users\admin\AppData\Local\Temp\Pbanccvckxt.exeexecutable
MD5:F95FB29801EC7411CC6D29ECC035364A
SHA256:9C6CB3E1BF8A2477945E50EFA3497D868E51A840A28238BE4D0181F646E06D07
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\libffi-7.dllexecutable
MD5:BC20614744EBF4C2B8ACD28D1FE54174
SHA256:0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\_bz2.pydexecutable
MD5:0F75C236C4CCFEA1B16F132F6C139236
SHA256:5DC26DCBF58CC7F5BFDEC0BADD5240D6724DB3E34010AAF35A31876FE4057158
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\_multiprocessing.pydexecutable
MD5:8901E96BB7A8EEAD994AF2BDF54A2447
SHA256:823A96F080A3424F4C5327CF61FF517723E19A69679EBE93EA97061063D8D593
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\_ctypes.pydexecutable
MD5:3A2E78784B929003A6BACEEBDB0EFA4D
SHA256:F205948B01B29CB244AE09C5B57FD4B6C8F356DFCD2F8CB49E7CFD177A748CF9
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\libssl-1_1.dllexecutable
MD5:AD77250DBAA7FAF0C2C9E13D717FAEC7
SHA256:CCBA760E6607FB6B08215452A8C0B6F84B2CB13937E86514995E9E86352F487A
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\_hashlib.pydexecutable
MD5:05362ADD80824B06014645A7951337D8
SHA256:20B3A3D3350B3D4D57911ECFDB15F77512A6E73C3BF72B410724F81C79A5B1AF
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\VCRUNTIME140.dllexecutable
MD5:4C360F78DE1F5BAAA5F110E65FAC94B4
SHA256:AD1B0992B890BFE88EF52D0A830873ACC0AECC9BD6E4FC22397DBCCF4D2B4E37
1076Pbanccvckxt.exeC:\Users\admin\AppData\Local\Temp\_MEI10762\_decimal.pydexecutable
MD5:8601C853146A4BE85238A57C9FD56865
SHA256:2A57023D4F355E3857187C02577FA4641A4D1DFF195196B3C33B90322EDF9FD4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3600
Oskhoajlfv.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3600
Oskhoajlfv.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
3600
Oskhoajlfv.exe
151.101.64.133:443
raw.githubusercontent.com
Fastly
US
suspicious
3600
Oskhoajlfv.exe
151.101.0.133:443
raw.githubusercontent.com
Fastly
US
malicious
3600
Oskhoajlfv.exe
151.101.192.133:443
raw.githubusercontent.com
Fastly
US
suspicious
3600
Oskhoajlfv.exe
151.101.128.133:443
raw.githubusercontent.com
Fastly
US
suspicious
3972
Pbanccvckxt.exe
104.18.50.121:443
www.insecam.org
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
www.insecam.org
  • 104.18.50.121
  • 172.67.196.114
  • 104.18.51.121
malicious
ip-api.com
  • 208.95.112.1
shared
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3600
Oskhoajlfv.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3600
Oskhoajlfv.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3600
Oskhoajlfv.exe
Misc activity
SUSPICIOUS [PTsecurity] External IP Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
IP Camera Hacker.exe