analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Setuper.zip

Full analysis: https://app.any.run/tasks/0ecde99d-4320-42fd-8bbc-1167584aa409
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: January 14, 2022, 22:26:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8745983CD0283B96F7F51EDCED798751

SHA1:

4FC4A985A9BC6144BE8D708D76DA4D304F7DD730

SHA256:

B4E7FC64F0DDECCDF45BB13B7DC2BE049030E7BB1A26940C22AB218F3E076471

SSDEEP:

98304:BK8UuNvprWe5V+fzymOnzkgeZ3cB9icbJ+SA2iUbtt:QrSFf5MbynkgeZMyKxv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • Setuper.exe (PID: 3472)
    • Connects to CnC server

      • Setuper.exe (PID: 3472)
    • Steals credentials from Web Browsers

      • Setuper.exe (PID: 3472)
    • REDLINE was detected

      • Setuper.exe (PID: 3472)
  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3232)
      • Setuper.exe (PID: 3472)
    • Reads the computer name

      • WinRAR.exe (PID: 3232)
      • Setuper.exe (PID: 3472)
    • Reads the cookies of Google Chrome

      • Setuper.exe (PID: 3472)
    • Searches for installed software

      • Setuper.exe (PID: 3472)
    • Reads Environment values

      • Setuper.exe (PID: 3472)
    • Reads the cookies of Mozilla Firefox

      • Setuper.exe (PID: 3472)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2022:01:12 04:23:16
ZipCRC: 0x07cdfa2e
ZipCompressedSize: 4212989
ZipUncompressedSize: 308969360
ZipFileName: Setuper.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #REDLINE setuper.exe

Process information

PID
CMD
Path
Indicators
Parent process
3232"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Setuper.zip"C:\Program Files\WinRAR\WinRAR.exeExplorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
3472"C:\Users\admin\AppData\Local\Temp\Rar$EXa3232.37128\Setuper.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3232.37128\Setuper.exe
WinRAR.exe
User:
admin
Company:
M4th
Integrity Level:
MEDIUM
Description:
WeSP Editor
Exit code:
0
Version:
0.2.7.1
Total events
2 234
Read events
2 216
Write events
18
Delete events
0

Modification events

(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3232) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Setuper.zip
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3232WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3232.37128\Setuper.exe
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3472
Setuper.exe
45.67.228.169:61696
malicious

DNS requests

No data

Threats

Found threats are available for the paid subscriptions
17 ETPRO signatures available at the full report
No debug info