analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

rebels spotify checker.rar

Full analysis: https://app.any.run/tasks/528703f2-c300-4f57-ad69-af2c6c96ff69
Verdict: Malicious activity
Analysis date: December 18, 2018, 18:25:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A77F17D1CC7FA395CBADC9BD904000C9

SHA1:

1E013D9E48DD0D213B17F32F99F9610E9FBF2067

SHA256:

B4BF6A21C2A9F0BD8273E5FA808822B493DBFAFCB27B7F9138B860F0A7E9DA9C

SSDEEP:

98304:cUk5Z80G7zfbLyC8d7xBkKLQvNcXlbLuZ1MpgEs0ZzsfhifxjZk7ze2A/7h+2+TQ:cUkqbLyCUyKLQ2XlbLNPsszqipi/buvR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Spotify Checker.exe (PID: 3340)
      • Spotify Checker (Saves All Accounts).exe (PID: 3264)
      • Spotify Checker (Saves All Accounts).exe (PID: 2388)
      • Spotify Checker.exe (PID: 2192)

    • Loads dropped or rewritten executable

      • Spotify Checker (Saves All Accounts).exe (PID: 3264)
      • Spotify Checker.exe (PID: 2192)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Spotify Checker (Saves All Accounts).exe (PID: 2388)
      • Spotify Checker.exe (PID: 3340)

    • Loads Python modules

      • Spotify Checker (Saves All Accounts).exe (PID: 3264)
      • Spotify Checker.exe (PID: 2192)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Spotify Checker (Saves All Accounts).exe (PID: 2388)
      • Spotify Checker.exe (PID: 3340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs spotify checker (saves all accounts).exe spotify checker (saves all accounts).exe no specs spotify checker.exe spotify checker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3072"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\rebels spotify checker.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2388"C:\Users\admin\Desktop\Spotify Checker (Saves All Accounts).exe" C:\Users\admin\Desktop\Spotify Checker (Saves All Accounts).exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3264"C:\Users\admin\Desktop\Spotify Checker (Saves All Accounts).exe" C:\Users\admin\Desktop\Spotify Checker (Saves All Accounts).exe—Spotify Checker (Saves All Accounts).exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3340"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2192"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe—Spotify Checker.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Total events
435
Read events
416
Write events
19
Delete events
0

Modification events

(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3072) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\rebels spotify checker.rar
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3072) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
26
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3072.7983\Spotify Checker (Saves All Accounts).exe —
MD5:—
SHA256:—
3072WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3072.7983\Spotify Checker.exe —
MD5:—
SHA256:—
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\base_library.zipcompressed
MD5:19501F3FCC2CF74F110BFA2F1069E51D
SHA256:151F913B4D00C911AC512B2F970AF298A8416F0DA6F8332A8A08B888BAAC2A2C
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\_bz2.pydexecutable
MD5:71E21C31F062E87128896B8479AA42E7
SHA256:7AC6B18230C416ED697DD5A7B4B256517582601FF7FB3A2054D6E76CC3E9BA6B
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\pywintypes36.dllexecutable
MD5:FF3730F401B5E31012237EFFF446AF13
SHA256:AF06FF85B06D41EC007EBFD3A46D44AD03EBD1FFCF09CB715B966544B9A3B55D
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\unicodedata.pydexecutable
MD5:78027CE0AB903B63DAF977714463F476
SHA256:1DA14014649B632FB660C59D3A08DCE35367AF7AB41201142B0FA21B4B40702B
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\pyexpat.pydexecutable
MD5:2D6F708AA62626B34CAD8E83C4B6AE87
SHA256:FFC8EDB6144E3748831FC77D70F5C9876A2DF2856CC007B6F2512A35F2538642
3340Spotify Checker.exeC:\Users\admin\AppData\Local\Temp\_MEI33402\SpotifyChecker.exe.manifestxml
MD5:4E9089FB990DE259DF02BD18DCBE9856
SHA256:01BA6075660F0976C4FCE47D1E2605198A1C4B8D6ABE52E5FC5CC8967CEB9ACE
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\_hashlib.pydexecutable
MD5:60C61C3644981A26DE376FA0B827CB07
SHA256:F86358BA06A4DD02DCAC7E457724F10F0BA4F4618C8AE22660FA42ECD28AE284
2388Spotify Checker (Saves All Accounts).exeC:\Users\admin\AppData\Local\Temp\_MEI23882\_ssl.pydexecutable
MD5:0F43F328684423CC7B877D2B26B6AF86
SHA256:71E5C04D7B6FB5C93A3800B617213B38B1FA765350F767E80E4EEFDBEBD48AFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
rebels spotify checker.rar