| File name: | Octalyn.rar |
| Full analysis: | https://app.any.run/tasks/f86b5190-d8b2-424e-815b-2c69b3db0c60 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | April 28, 2025, 14:04:52 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 781FA303D7DF158A8F70F5A941D78911 |
| SHA1: | 8B4EF61C0A13497C46646D848770554EEA420623 |
| SHA256: | AC751A61CCEFF15349DE19ED1FC4DC7E5B11828BF1143DBB225A12EA8E049FC4 |
| SSDEEP: | 98304:NB70chEZk1R6l/bkt/neGtrk0k04gLQxir7wG0074Jn8kEjQOc7WFAYaokmAMiHQ:mjGMQ |
MALICIOUS
OCTALYN has been detected (YARA)
- Octalyn.exe (PID: 7936)
- Build.exe (PID: 1276)
- Build.exe (PID: 6632)
OCTALYN has been detected
- Build.exe (PID: 1276)
- powershell.exe (PID: 2908)
Actions looks like stealing of personal data
- Build.exe (PID: 1276)
- Build.exe (PID: 6632)
Run PowerShell with an invisible window
- powershell.exe (PID: 2908)
- powershell.exe (PID: 6228)
SUSPICIOUS
Executable content was dropped or overwritten
- Octalyn.exe (PID: 7936)
Loads DLL from Mozilla Firefox
- Build.exe (PID: 1276)
Starts POWERSHELL.EXE for commands execution
- Build.exe (PID: 1276)
- Build.exe (PID: 6632)
Gets file extension (POWERSHELL)
- powershell.exe (PID: 2908)
Multiple wallet extension IDs have been found
- Build.exe (PID: 6632)
- Build.exe (PID: 1276)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6036)
The sample compiled with english language support
- WinRAR.exe (PID: 6036)
Checks supported languages
- Octalyn.exe (PID: 7936)
- Build.exe (PID: 1276)
- Build.exe (PID: 6632)
Reads the computer name
- Octalyn.exe (PID: 7936)
- Build.exe (PID: 1276)
Manual execution by a user
- Octalyn.exe (PID: 7936)
- Build.exe (PID: 1276)
- Build.exe (PID: 6632)
Compiled with Borland Delphi (YARA)
- Octalyn.exe (PID: 7936)
- slui.exe (PID: 8020)
- Build.exe (PID: 6632)
- Build.exe (PID: 1276)
Reads the software policy settings
- slui.exe (PID: 7232)
- slui.exe (PID: 8020)
Checks proxy server information
- slui.exe (PID: 8020)
Create files in a temporary directory
- Octalyn.exe (PID: 7936)
- Build.exe (PID: 1276)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 2908)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 2908)
Gets data length (POWERSHELL)
- powershell.exe (PID: 2908)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 2314249 |
| UncompressedSize: | 7451136 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | Octalyn/Octalyn.exe |
Total processes
144
Monitored processes
11
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1276 | "C:\Users\admin\Desktop\Build.exe" | C:\Users\admin\Desktop\Build.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 2908 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\admin\AppData\Local\Temp\Octalyn' -DestinationPath 'C:\Users\admin\AppData\Local\Temp\admin_OctalynRetrieved.zip'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Build.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6036 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Octalyn.rar | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6228 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\admin\AppData\Local\Temp\Octalyn' -DestinationPath 'C:\Users\admin\AppData\Local\Temp\admin_OctalynRetrieved.zip'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Build.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6632 | "C:\Users\admin\Desktop\Build.exe" | C:\Users\admin\Desktop\Build.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 6824 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7200 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7232 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7268 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7936 | "C:\Users\admin\Desktop\Octalyn.exe" | C:\Users\admin\Desktop\Octalyn.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
12 437
Read events
12 429
Write events
8
Delete events
0
Modification events
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Octalyn.rar | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6036) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
6
Suspicious files
49
Text files
8
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1276 | Build.exe | C:\Users\admin\AppData\Local\Temp\Octalyn\discord.txt | — | |
MD5:— | SHA256:— | |||
| 1276 | Build.exe | C:\Users\admin\AppData\Local\Temp\rGv4k6J.db | — | |
MD5:— | SHA256:— | |||
| 1276 | Build.exe | C:\Users\admin\AppData\Local\Temp\Octalyn\bookmarks.txt | — | |
MD5:— | SHA256:— | |||
| 1276 | Build.exe | C:\Users\admin\AppData\Local\Temp\Octalyn\passwords.txt | — | |
MD5:— | SHA256:— | |||
| 1276 | Build.exe | C:\Users\admin\AppData\Local\Temp\sbKm96V.db | — | |
MD5:— | SHA256:— | |||
| 1276 | Build.exe | C:\Users\admin\AppData\Local\Temp\Octalyn\autofill.txt | — | |
MD5:— | SHA256:— | |||
| 7936 | Octalyn.exe | C:\Users\admin\AppData\Local\Temp\OctalynStub_temp.exe | executable | |
MD5:A1697B68640809AD73802F15AAAB7188 | SHA256:641E1AD00A8094A73D535ECE579D5291AFA47374FF59B9A6486798A3EB3B6124 | |||
| 6036 | WinRAR.exe | C:\Users\admin\Desktop\Octalyn.exe | executable | |
MD5:0A705E20864B451A3F3B845FA01C0AAD | SHA256:D61806D1A950940B21014131532FC0B99E6B090F40DABBE5CC5DC30018F29AF2 | |||
| 7936 | Octalyn.exe | C:\Users\admin\Desktop\Build.exe | executable | |
MD5:A1697B68640809AD73802F15AAAB7188 | SHA256:641E1AD00A8094A73D535ECE579D5291AFA47374FF59B9A6486798A3EB3B6124 | |||
| 7936 | Octalyn.exe | C:\Users\admin\Desktop\RCX746D.tmp | executable | |
MD5:E340D64BCAC79EF33DB7E516A1BBC395 | SHA256:EFDD6344B0C7992EC0F139F7F22007391B60C7FB337F66D4A5EB3D15F8C8FF28 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
30
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 23.196.96.159:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7764 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7800 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
7764 | SIHClient.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 2.16.164.9:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 23.196.96.159:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |