analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Urausy.7z

Full analysis: https://app.any.run/tasks/f8113951-99e9-4e9c-a4b1-f7fc844c1da1
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: May 21, 2022, 04:32:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.3
MD5:

47E7B52882DCD1E9D8AF80643CD0E95F

SHA1:

3DB69AFBF76F5B2AB8E1418B832AFD2FBB3E3FC0

SHA256:

A711A1F419A8F8708D8CF878E5D7EA138EAA6F06BBD22936914931731D56E44A

SSDEEP:

6144:oMeviuyY1v5ehwxZWTCx9hiS+d1ZFzSnvwPDKD9ZtpNOI:4aev5ehkZICx9cd1ZFzSv5rtzF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2532)
      • Explorer.EXE (PID: 1080)
      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
    • Application was dropped or rewritten from another process

      • 1.exe (PID: 2876)
      • 2.exe (PID: 3104)
      • 5.exe (PID: 3512)
      • 3.exe (PID: 2780)
      • 4.exe (PID: 2804)
      • 1.exe (PID: 3536)
      • 2.exe (PID: 3208)
      • 5.exe (PID: 996)
      • 3.exe (PID: 1608)
      • 5.exe (PID: 3964)
      • 4.exe (PID: 3956)
      • 5.exe (PID: 1000)
    • Runs injected code in another process

      • explorer.exe (PID: 2112)
      • explorer.exe (PID: 908)
      • explorer.exe (PID: 2636)
      • explorer.exe (PID: 3112)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 3108)
    • Uses SVCHOST.EXE for hidden code execution

      • Explorer.EXE (PID: 1080)
    • Application was injected by another process

      • Explorer.EXE (PID: 1080)
    • Changes the login/logoff helper path in the registry

      • svchost.exe (PID: 3032)
      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
    • Connects to CnC server

      • svchost.exe (PID: 3628)
  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2532)
      • Explorer.EXE (PID: 1080)
      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
    • Reads the computer name

      • WinRAR.exe (PID: 2532)
    • Checks supported languages

      • WinRAR.exe (PID: 2532)
      • 2.exe (PID: 3104)
      • 1.exe (PID: 2876)
      • 4.exe (PID: 2804)
      • 3.exe (PID: 2780)
      • 1.exe (PID: 3536)
      • 2.exe (PID: 3208)
      • 5.exe (PID: 3512)
      • 4.exe (PID: 3956)
      • 3.exe (PID: 1608)
      • 5.exe (PID: 996)
      • 5.exe (PID: 3964)
      • 5.exe (PID: 1000)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2532)
      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3248)
    • Application launched itself

      • 1.exe (PID: 2876)
      • 2.exe (PID: 3104)
      • 3.exe (PID: 2780)
      • 4.exe (PID: 2804)
      • 5.exe (PID: 3512)
      • 5.exe (PID: 996)
    • Creates files in the user directory

      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
      • svchost.exe (PID: 3032)
  • INFO

    • Manual execution by user

      • 1.exe (PID: 2876)
      • 2.exe (PID: 3104)
      • 4.exe (PID: 2804)
      • 3.exe (PID: 2780)
      • 5.exe (PID: 3512)
      • 5.exe (PID: 996)
      • svchost.exe (PID: 3032)
      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
    • Checks supported languages

      • explorer.exe (PID: 908)
      • svchost.exe (PID: 3032)
      • svchost.exe (PID: 2364)
      • explorer.exe (PID: 2112)
      • explorer.exe (PID: 2636)
      • explorer.exe (PID: 3112)
      • explorer.exe (PID: 2824)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
      • explorer.exe (PID: 3108)
    • Reads the computer name

      • svchost.exe (PID: 2364)
      • svchost.exe (PID: 3032)
      • svchost.exe (PID: 1312)
      • svchost.exe (PID: 3356)
      • svchost.exe (PID: 3628)
      • svchost.exe (PID: 3248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (gen) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
26
Malicious processes
16
Suspicious processes
7

Behavior graph

Click at the process to see the details
start inject winrar.exe 1.exe no specs 2.exe no specs 3.exe no specs 4.exe no specs 5.exe no specs 1.exe no specs 2.exe no specs 5.exe no specs 3.exe no specs 4.exe no specs 5.exe no specs explorer.exe no specs explorer.exe no specs svchost.exe svchost.exe explorer.exe no specs 5.exe no specs svchost.exe explorer.exe no specs explorer.exe no specs svchost.exe svchost.exe explorer.exe no specs explorer.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2532"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Urausy.7z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2876"C:\Users\admin\Desktop\1.exe" C:\Users\admin\Desktop\1.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
3104"C:\Users\admin\Desktop\2.exe" C:\Users\admin\Desktop\2.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Users\admin\Desktop\3.exe" C:\Users\admin\Desktop\3.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\3.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2804"C:\Users\admin\Desktop\4.exe" C:\Users\admin\Desktop\4.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
3512"C:\Users\admin\Desktop\5.exe" C:\Users\admin\Desktop\5.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
3536"C:\Users\admin\Desktop\1.exe"C:\Users\admin\Desktop\1.exe1.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3208"C:\Users\admin\Desktop\2.exe"C:\Users\admin\Desktop\2.exe2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\users\admin\desktop\2.exe
996"C:\Users\admin\Desktop\5.exe" C:\Users\admin\Desktop\5.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
1608"C:\Users\admin\Desktop\3.exe"C:\Users\admin\Desktop\3.exe3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
9 300
Read events
9 050
Write events
246
Delete events
4

Modification events

(PID) Process:(2532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2532) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1080) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\JvaENE\JvaENE.rkr
Value:
0000000006000000040000001F780000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF9082A5387C6ED70100000000
(PID) Process:(1080) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000480100007B0200004B6B17013F0000004A0000008E0F0D004D006900630072006F0073006F00660074002E0049006E007400650072006E00650074004500780070006C006F007200650072002E00440065006600610075006C007400000028003E004000A4E75102B8E651020000000000000000000000000000080274E45102000008026CE25102000000000000D26CFFFFFFFF705911750000000000000000A4E251027C900D75000400000000000008E35102FFFFFFFF38EA7000FFFFFFFF080A7400D80E740030EA7000D4E25102F7AF3D7680D0707614F05102081D3E76E4613E766820700008E351020000000071000000BBF2CB00E8E25102A1693E766820700008E351020000000014E551023F613E766820700008E3510200000400000000800400000026E4510298E351025DA5147726E45102D26E147779A51477D6794D7526E4510210E65102000100006400610072E3510226E451026F0061006D0069006E0067005C006D006900630072006F0073006F0066007400CCE351023400000080E35102DE70310033003300350033003800310030003000F8E551025A000000A0E351021DA71477D6610E02D4E351025A00000010E651025C00000011000000104F7000084F7000F8E55102C4E3510220E40000D7F3CB00D0E351025E903E7620E45102D4E3510203943E760000000064561802FCE35102A9933E7664561802A8E45102D8511802BD933E7600000000D8511802A8E4510204E45102000000007200000032AC5D004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000045003700430036004500410037004400320037007D005C0063006D0064002E0065007800650000000000D45D38760000000005000000D80B3902000000000000000000000000000000000000000000000000CB0501AD000000000000000000000000000000000000000000000000000000000000000030E69D01A8323876B8E59D01C0E59D0154E59D0100000000000000000000000000000000480B39020000000005000000D80B390200000000340C390268E59D01B0E59D010000000000000000E8B93902050000002000000000000000000000000400400000001A0098E59D0100000000000000000000000000000000040000009EE69D0110E69D015DA5B3779EE69D01D26EB37779A5B377114526769EE69D0188E89D0104000000C6E69D0138E69D015DA5B377C6E69D01D26EB37779A5B37739452676C6E69D01B0E89D0100010000E8FE1C0012E69D01C6E69D0168E69D015DA5310033003300350033003800310011000000104F1D00084F1D001AE79D018CE69D015DA5B37774E60000B777588D24E69D015E90D47674E69D0128E69D010394D47600000000D422E60250E69D01A993D476D422E602FCE69D01481EE602BD93D47600000000481EE602FCE69D0158E69D01000000007200000032AC5D004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000045003700430036004500410037004400320037007D005C0063006D0064002E0065007800650000000000D45D38760000000005000000D80B3902000000000000000000000000000000000000000000000000CB0501AD000000000000000000000000000000000000000000000000000000000000000030E69D01A8323876B8E59D01C0E59D0154E59D0100000000000000000000000000000000480B39020000000005000000D80B390200000000340C390268E59D01B0E59D010000000000000000E8B93902050000002000000000000000000000000400400000001A0098E59D0100000000000000000000000000000000040000009EE69D0110E69D015DA5B3779EE69D01D26EB37779A5B377114526769EE69D0188E89D0104000000C6E69D0138E69D015DA5B377C6E69D01D26EB37779A5B37739452676C6E69D01B0E89D0100010000E8FE1C0012E69D01C6E69D0168E69D015DA5310033003300350033003800310011000000104F1D00084F1D001AE79D018CE69D015DA5B37774E60000B777588D24E69D015E90D47674E69D0128E69D010394D47600000000D422E60250E69D01A993D476D422E602FCE69D01481EE602BD93D47600000000481EE602FCE69D0158E69D01
(PID) Process:(1080) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\JvaENE\JvaENE.rkr
Value:
0000000006000000050000001F780000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF9082A5387C6ED70100000000
(PID) Process:(1080) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000480100007C0200004B6B17013F0000004A0000008E0F0D004D006900630072006F0073006F00660074002E0049006E007400650072006E00650074004500780070006C006F007200650072002E00440065006600610075006C007400000028003E004000A4E75102B8E651020000000000000000000000000000080274E45102000008026CE25102000000000000D26CFFFFFFFF705911750000000000000000A4E251027C900D75000400000000000008E35102FFFFFFFF38EA7000FFFFFFFF080A7400D80E740030EA7000D4E25102F7AF3D7680D0707614F05102081D3E76E4613E766820700008E351020000000071000000BBF2CB00E8E25102A1693E766820700008E351020000000014E551023F613E766820700008E3510200000400000000800400000026E4510298E351025DA5147726E45102D26E147779A51477D6794D7526E4510210E65102000100006400610072E3510226E451026F0061006D0069006E0067005C006D006900630072006F0073006F0066007400CCE351023400000080E35102DE70310033003300350033003800310030003000F8E551025A000000A0E351021DA71477D6610E02D4E351025A00000010E651025C00000011000000104F7000084F7000F8E55102C4E3510220E40000D7F3CB00D0E351025E903E7620E45102D4E3510203943E760000000064561802FCE35102A9933E7664561802A8E45102D8511802BD933E7600000000D8511802A8E4510204E45102000000007200000032AC5D004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000045003700430036004500410037004400320037007D005C0063006D0064002E0065007800650000000000D45D38760000000005000000D80B3902000000000000000000000000000000000000000000000000CB0501AD000000000000000000000000000000000000000000000000000000000000000030E69D01A8323876B8E59D01C0E59D0154E59D0100000000000000000000000000000000480B39020000000005000000D80B390200000000340C390268E59D01B0E59D010000000000000000E8B93902050000002000000000000000000000000400400000001A0098E59D0100000000000000000000000000000000040000009EE69D0110E69D015DA5B3779EE69D01D26EB37779A5B377114526769EE69D0188E89D0104000000C6E69D0138E69D015DA5B377C6E69D01D26EB37779A5B37739452676C6E69D01B0E89D0100010000E8FE1C0012E69D01C6E69D0168E69D015DA5310033003300350033003800310011000000104F1D00084F1D001AE79D018CE69D015DA5B37774E60000B777588D24E69D015E90D47674E69D0128E69D010394D47600000000D422E60250E69D01A993D476D422E602FCE69D01481EE602BD93D47600000000481EE602FCE69D0158E69D01000000007200000032AC5D004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000045003700430036004500410037004400320037007D005C0063006D0064002E0065007800650000000000D45D38760000000005000000D80B3902000000000000000000000000000000000000000000000000CB0501AD000000000000000000000000000000000000000000000000000000000000000030E69D01A8323876B8E59D01C0E59D0154E59D0100000000000000000000000000000000480B39020000000005000000D80B390200000000340C390268E59D01B0E59D010000000000000000E8B93902050000002000000000000000000000000400400000001A0098E59D0100000000000000000000000000000000040000009EE69D0110E69D015DA5B3779EE69D01D26EB37779A5B377114526769EE69D0188E89D0104000000C6E69D0138E69D015DA5B377C6E69D01D26EB37779A5B37739452676C6E69D01B0E89D0100010000E8FE1C0012E69D01C6E69D0168E69D015DA5310033003300350033003800310011000000104F1D00084F1D001AE79D018CE69D015DA5B37774E60000B777588D24E69D015E90D47674E69D0128E69D010394D47600000000D422E60250E69D01A993D476D422E602FCE69D01481EE602BD93D47600000000481EE602FCE69D0158E69D01
(PID) Process:(2532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
Executable files
20
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2532.24439\58c5971869a315f12f319232d1f84f87executable
MD5:58C5971869A315F12F319232D1F84F87
SHA256:194F47CB7593D6CE531078D1819BA5CFC21A51D4CF73321A60355AB829F07098
1080Explorer.EXEC:\Users\admin\Desktop\12E85AB1533AFA47033B3644CCCF31B8executable
MD5:12E85AB1533AFA47033B3644CCCF31B8
SHA256:6BFE792AED40E769EF2B4A5A0017C05CDC479BBD725B94990590AFA09CF7FC30
1080Explorer.EXEC:\Users\admin\Desktop\3.exeexecutable
MD5:58C5971869A315F12F319232D1F84F87
SHA256:194F47CB7593D6CE531078D1819BA5CFC21A51D4CF73321A60355AB829F07098
2532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2532.24439\5B6B13115EE6938A4B9AB8BB28F7C800executable
MD5:5B6B13115EE6938A4B9AB8BB28F7C800
SHA256:2F34C8EA0DF2EFC3D9B5AAC38D668DDA1F42B12080101D603DE9BD6334797B92
2532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2532.24439\12E85AB1533AFA47033B3644CCCF31B8executable
MD5:12E85AB1533AFA47033B3644CCCF31B8
SHA256:6BFE792AED40E769EF2B4A5A0017C05CDC479BBD725B94990590AFA09CF7FC30
2532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2532.24439\0BDB6FC84CD253E960E42AAFF8FAF97Dexecutable
MD5:0BDB6FC84CD253E960E42AAFF8FAF97D
SHA256:912525F8A88671CC019FA1F69A12DB8D0385B51C1AEBF602E47D427326653441
3628svchost.exeC:\Users\admin\AppData\Roaming\msconfig.datexecutable
MD5:AB533F4A9E8B58B08E35F112FEAE1475
SHA256:BE5EF6C9F0AAFA43BD1F1955E91B04D8A6541CD5BF52B1085F27BF8975B85AE5
2532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2532.24439\ab533f4a9e8b58b08e35f112feae1475executable
MD5:AB533F4A9E8B58B08E35F112FEAE1475
SHA256:BE5EF6C9F0AAFA43BD1F1955E91B04D8A6541CD5BF52B1085F27BF8975B85AE5
1080Explorer.EXEC:\Users\admin\Desktop\1.exeexecutable
MD5:0BDB6FC84CD253E960E42AAFF8FAF97D
SHA256:912525F8A88671CC019FA1F69A12DB8D0385B51C1AEBF602E47D427326653441
1080Explorer.EXEC:\Users\admin\Desktop\0BDB6FC84CD253E960E42AAFF8FAF97Dexecutable
MD5:0BDB6FC84CD253E960E42AAFF8FAF97D
SHA256:912525F8A88671CC019FA1F69A12DB8D0385B51C1AEBF602E47D427326653441
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3628
svchost.exe
GET
200
23.202.231.167:80
http://yatxn.ru/555657555D8E3EA423FBB9670940B8544DC9B530DD0F550A1C1B
US
html
412 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3628
svchost.exe
23.202.231.167:80
yatxn.ru
Akamai Technologies, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
yatxn.ru
  • 23.202.231.167
  • 23.217.138.108
malicious
qatvy.ru
malicious
autxw.ru
unknown
awrwi.ru
unknown

Threats

PID
Process
Class
Message
3628
svchost.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (Our_Agent)
1 ETPRO signatures available at the full report
No debug info