analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Vypyr_VPN_Checker.rar

Full analysis: https://app.any.run/tasks/89974f82-5a23-4f5e-ba45-ab3d266b0f3f
Verdict: Malicious activity
Analysis date: December 06, 2018, 16:15:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

60B6BA8F14F5C48BC99C2DE03BB2A4B2

SHA1:

A0FE3F1EE229A6D14E24F665300F795109B04941

SHA256:

B5AB802C0D53BE297F3CC2656DB320EBD2B23CB9CABC9F593C753C18151E6815

SSDEEP:

196608:0i5FlMBqXK5m2o5YYdYTA9ac3vFKivQXyrNfasJ3+9IQ8mnsbSOeU8IF3O:0CMBq65m2o5BkAxFKVKfLJuUNO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • VyprVPN.exe (PID: 2420)
      • SearchProtocolHost.exe (PID: 1040)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3136)

  • INFO

    • Application was crashed

      • VyprVPN_RAISEN.exe (PID: 2520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: Vypyr VPN Checker\System.Xml.Linq.dll
PackingMethod: Normal
ModifyDate: 2017:10:03 20:21:18
OperatingSystem: Win32
UncompressedSize: 45736
CompressedSize: 20724
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs vyprvpn_raisen.exe vyprvpn.exe

Process information

PID
CMD
Path
Indicators
Parent process
3136"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Vypyr_VPN_Checker.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1040"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2520"C:\Users\admin\Desktop\Vypyr VPN Checker\VyprVPN_RAISEN.exe" C:\Users\admin\Desktop\Vypyr VPN Checker\VyprVPN_RAISEN.exe
explorer.exe
User:
admin
Company:
cracking.org
Integrity Level:
HIGH
Description:
VyprVPN Checker by KingSD
Exit code:
3762504530
Version:
2.0.0.0
2420"C:\Users\admin\Desktop\Vypyr VPN Checker\VyprVPN.exe" C:\Users\admin\Desktop\Vypyr VPN Checker\VyprVPN.exe
explorer.exe
User:
admin
Company:
cracking.org
Integrity Level:
HIGH
Description:
VyprVPN Checker by KingSD
Version:
2.0.0.0
Total events
782
Read events
770
Write events
12
Delete events
0

Modification events

(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3136) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Vypyr_VPN_Checker.rar
(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2420) VyprVPN.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2420) VyprVPN.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\Telerik.WinControls.UI.dll —
MD5:—
SHA256:—
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\TelerikCommon.dll —
MD5:—
SHA256:—
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\VyprVPN.exe —
MD5:—
SHA256:—
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\VyprVPN_RAISEN.exe —
MD5:—
SHA256:—
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\xNet.dll —
MD5:—
SHA256:—
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\System.Xml.Linq.dllexecutable
MD5:70E379EC7C6A456071353F6EF96BEFA2
SHA256:0120EF25C33951269FBCA05C52953C786A28F1F5524BDAAAC9448CBBC6849603
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\Telerik.WinControls.Themes.Breeze.dllexecutable
MD5:9192B783EB53124C95C6F69F61E9BFFD
SHA256:425BF84D9EF4EB3B39213617F564B392FEE1AFD9CEB2E428C6A5913074C5AC4E
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\Telerik.WinControls.dllexecutable
MD5:7450191CF8E50BD08381A4E8AEC5CB6A
SHA256:419F3642B5FAD23D098B5D405030C3F162748D5DEA76DAEB4998B436D55E37C0
3136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3136.49183\Vypyr VPN Checker\Telerik.WinControls.Themes.TelerikMetroBlue.dllexecutable
MD5:965D55D2DB26183A0B165149E357E42C
SHA256:68A6A9040D2A12EC5E9EFA0D2F8FA8C2BF4F27BBD0E1824A3A1CEEC017C6DE93
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Vypyr_VPN_Checker.rar