File name:

Freebitco.inHack2018.v3.zip

Full analysis: https://app.any.run/tasks/c4711aed-86b7-48a6-a2d5-30f2e63c71cd
Verdict: No threats detected
Analysis date: October 25, 2019, 04:03:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E4FAF0E3EA5FC99C9DEDED094BCA4508

SHA1:

5B78ABE09D39577848DA114A70E0CB66A65DC3E5

SHA256:

A7A889F4F9E0FCD4823E8C3A58D3C13448BEBE33FFD3F4A439999514785AC6BB

SSDEEP:

6144:UnTy3+5eYx1eEqj852os139ni+VM9TG0acMqbAk6NAGGOzxm6a:736KEqjkfs139ni+10acMNknGGOzxm6a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Freebitco.in Hack 2018.exe (PID: 2760)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2480)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2018:10:22 17:31:04
ZipCRC: 0xfdb9e8d5
ZipCompressedSize: 188525
ZipUncompressedSize: 307712
ZipFileName: Freebitco.in Hack 2018.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe freebitco.in hack 2018.exe

Process information

PID
CMD
Path
Indicators
Parent process
2480"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Freebitco.inHack2018.v3.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2760"C:\Users\admin\AppData\Local\Temp\Rar$EXa2480.26316\Freebitco.in Hack 2018.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2480.26316\Freebitco.in Hack 2018.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Freebitco.in Hack 2018
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2480.26316\freebitco.in hack 2018.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
472
Read events
448
Write events
24
Delete events
0

Modification events

(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2480) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Freebitco.inHack2018.v3.zip
(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2480) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2760) Freebitco.in Hack 2018.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Freebitco_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2760) Freebitco.in Hack 2018.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Freebitco_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2480.26316\Freebitco.in Hack 2018.exeexecutable
MD5:AB19E928C8D688770E94F58B92DA4164
SHA256:4A8090E108B4A3D3F8981C105031C8075628C2065FDB798DE161FEA52484E149
2480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2480.26316\scar5tf2_vcV_icon.icoimage
MD5:7A4323F15D14EBD8C292BA857E60E170
SHA256:BA71899FC2CA4735A063AF4DA3DA3EEF1A931F5F2E2BE18BE75E7D7E58C1B48A
2480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2480.26316\Freebitco.in Hack 2018.exe.configxml
MD5:C4C1C9F8C1A771D7AC1012C8B2AA2579
SHA256:73DDB6CDF45BE4E473A84A3C4838EDF0CC7C9433211935A1A8A70AFE88A57833
2480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2480.26316\System.Net.Http.dllexecutable
MD5:86905201FA4EFFCB1796D38A07CF0EB0
SHA256:AEAB880E80F9BA7FDD5CF89ACE4F6C628222937D6B1E1B5CCC2517330D64D3C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
122
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.0 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
48.1 Kb
malicious
2760
Freebitco.in Hack 2018.exe
GET
200
172.217.168.228:80
http://www.google.com/
US
html
49.0 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2760
Freebitco.in Hack 2018.exe
172.217.168.228:80
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.168.228
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Freebitco.inHack2018.v3.zip