analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BLTools-v2.2-Cracked-by-Injuan.zip

Full analysis: https://app.any.run/tasks/b77a572b-b248-44ac-a43e-330e1e838c15
Verdict: Malicious activity
Analysis date: April 01, 2023, 18:37:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D0B708E456AB1BB46EDFD06F877DCD8B

SHA1:

AC3021C7FBFEF4B5644D0B42936D09104F5E9977

SHA256:

A5C52E2F9CF2CC5C398BD56F9475D6AAC94E13B3160480A85AFFD82CB97CADF6

SSDEEP:

196608:DWbxs/7JmdJ37Fb4ujXfnXzhvg+S2HO2zvvf2vA7RG66AsbcKCMbLznldwrM:DWbxs/7cdddRjLhvgv2HO2rf2VhFNLzZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • UserOOBE.exe (PID: 1832)
      • BLTools-v2.2.exe (PID: 3892)
      • winsrvhost.exe (PID: 1624)

    • Create files in the Startup directory

      • BLTools-v2.2.exe (PID: 3892)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1936)
      • BLTools-v2.2.exe (PID: 3892)
      • svchost.exe (PID: 860)
      • winsrvhost.exe (PID: 1624)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BLTools-v2.2.exe (PID: 3892)

    • The process creates files with name similar to system file names

      • BLTools-v2.2.exe (PID: 3892)

    • Reads the BIOS version

      • UserOOBE.exe (PID: 1832)

  • INFO

    • The process checks LSA protection

      • BLTools-v2.2.exe (PID: 3892)
      • winsrvhost.exe (PID: 1624)

    • Reads the computer name

      • BLTools-v2.2.exe (PID: 3892)
      • winsrvhost.exe (PID: 1624)

    • Manual execution by a user

      • BLTools-v2.2.exe (PID: 3892)

    • Creates files or folders in the user directory

      • BLTools-v2.2.exe (PID: 3892)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2644)

    • Checks supported languages

      • BLTools-v2.2.exe (PID: 3892)
      • UserOOBE.exe (PID: 1832)
      • winsrvhost.exe (PID: 1624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: AlphaFS.dll
ZipUncompressedSize: 367616
ZipCompressedSize: 367676
ZipCRC: 0xb1b27091
ZipModifyDate: 2018:08:18 20:39:52
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe searchprotocolhost.exe no specs bltools-v2.2.exe useroobe.exe no specs winsrvhost.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2644"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\BLTools-v2.2-Cracked-by-Injuan.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\comdlg32.dll
1936"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3892"C:\Users\admin\Desktop\BLTools-v2.2.exe" C:\Users\admin\Desktop\BLTools-v2.2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bltools-v2.2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
1832C:\Users\admin\AppData\Local\\UserOOBE\\UserOOBE.exe ,.C:\Users\admin\AppData\Local\UserOOBE\UserOOBE.exe—BLTools-v2.2.exe
User:
admin
Integrity Level:
MEDIUM
Description:
UserOOBE
Version:
10.0.19045.548 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\useroobe\useroobe.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1624C:\Users\admin\AppData\Local\\winsrvhost\\winsrvhost.exe BLEnJfF6YWFyyAnQK1FONPEf4JGlmJT7T1PmIl6YE3X3dneEn9vrE8uYjwkEQfbAC:\Users\admin\AppData\Local\winsrvhost\winsrvhost.exe
BLTools-v2.2.exe
User:
admin
Company:
Microsoft®
Integrity Level:
MEDIUM
Description:
winsrvhost
Version:
10.0.19045.549
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\winsrvhost\winsrvhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\webio.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
860C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
3 064
Read events
3 026
Write events
38
Delete events
0

Modification events

(PID) Process:(2644) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2644) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
24
Suspicious files
0
Text files
2
Unknown types
6

Dropped files

PID
Process
Filename
Type
3892BLTools-v2.2.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsrvhost.lnklnk
MD5:452F400FDBF575A68BF0D2248758991B
SHA256:D9852268D9351AFD0228D0AEC703EEA9B45E462F68D6C83C41794B366BFA55E3
860svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:9816C155C1ACD4CB5D0FFEC1EF2CCC8D
SHA256:8BB217AB817BFD47E9CA497DE0C96F707A447FFD5F91D73D0CD2979374A14E86
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\BouncyCastle.Crypto.dllexecutable
MD5:3CF6BF0E0A27F3665EDD6362D137E4CC
SHA256:1985B85BB44BE6C6EAF35E02EF11E23A890E809B8EC2E53210A4AD5A85B26C70
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\Ookii.Dialogs.Wpf.dllexecutable
MD5:932EBB3F9E7113071C6A17818342B7CC
SHA256:285AA8225732DDBCF211B1158BD6CFF8BF3ACBEEAB69617F4BE85862B7105AB5
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\AlphaFS.dllexecutable
MD5:F2F6F6798D306D6D7DF4267434B5C5F9
SHA256:837F2CEAB6BBD9BC4BF076F1CB90B3158191888C3055DD2B78A1E23F1C3AAFDD
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\BLTools-v2.2.exeexecutable
MD5:514A63898E838DBF1C896B3F4E59F7E5
SHA256:648FDDE18B853BF449F7C371FDAC1BFBF9A2E32A096D48EC095C067BF4F0040F
3892BLTools-v2.2.exeC:\Users\admin\AppData\Local\winsrvhost\winsrvhost.exeexecutable
MD5:797F15C89FC3DC9D052061202C9D65CF
SHA256:6A2DF4801D1B40E34B9B1BE91B0AAA6E49DA66FD5ED09254D83AF2EC86C8D81C
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\mip_core.dllexecutable
MD5:797F15C89FC3DC9D052061202C9D65CF
SHA256:6A2DF4801D1B40E34B9B1BE91B0AAA6E49DA66FD5ED09254D83AF2EC86C8D81C
2644WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2644.22063\Extreme.Net.dllexecutable
MD5:F79F0E3A0361CAC000E2D3553753CD68
SHA256:8A6518AB7419FBEC3AC9875BAA3AFB410AD1398C7AA622A09CD9084EC6CADFCD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1624
winsrvhost.exe
GET
302
162.216.242.206:80
http://stlaip742915.ddnsgeek.com/
unknown
html
163 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1624
winsrvhost.exe
162.216.242.206:80
stlaip742915.ddnsgeek.com
DYNU
US
malicious
—
—
185.247.224.98:443
sllaap12925.ddnsgeek.com
Flokinet Ltd
SC
suspicious

DNS requests

Domain
IP
Reputation
stlaip742915.ddnsgeek.com
  • 162.216.242.206
malicious
sllaap12925.ddnsgeek.com
  • 185.247.224.98
suspicious

Threats

PID
Process
Class
Message
1624
winsrvhost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (Mozilla) - Possible Spyware Related
1624
winsrvhost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BLTools-v2.2-Cracked-by-Injuan.zip