File name:

LOIC-1.0.8-binary.zip

Full analysis: https://app.any.run/tasks/8216fe40-b479-4d46-be9f-20525089cc87
Verdict: Malicious activity
Analysis date: February 24, 2024, 19:28:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

C615DA1584CF050CF81A08D40309D735

SHA1:

FF00F68B03F7BBC785284ABD95A54D5B98F7DB9B

SHA256:

B6D6E0D1DCE867836A684A0AF278E46ED4A50BE49A784AB7BFCB3ED59841C9D0

SSDEEP:

3072:n1sQ9BKWms487f1j/XjSGrJmjJ7cAs1QRls:nuQ9Tmd41jfD0lgXQRG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4052)

  • SUSPICIOUS

    • Reads the Internet Settings

      • LOIC.exe (PID: 2840)

    • Reads security settings of Internet Explorer

      • LOIC.exe (PID: 2840)

    • Reads Microsoft Outlook installation path

      • LOIC.exe (PID: 2840)

    • Checks Windows Trust Settings

      • LOIC.exe (PID: 2840)

    • Reads settings of System Certificates

      • LOIC.exe (PID: 2840)

    • Reads Internet Explorer settings

      • LOIC.exe (PID: 2840)

  • INFO

    • Checks supported languages

      • LOIC.exe (PID: 2840)

    • Manual execution by a user

      • LOIC.exe (PID: 2840)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)

    • Reads the computer name

      • LOIC.exe (PID: 2840)

    • Reads the machine GUID from the registry

      • LOIC.exe (PID: 2840)

    • Checks proxy server information

      • LOIC.exe (PID: 2840)

    • Reads the software policy settings

      • LOIC.exe (PID: 2840)

    • Creates files or folders in the user directory

      • LOIC.exe (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2014:12:12 21:09:00
ZipCRC: 0x3aef8268
ZipCompressedSize: 103047
ZipUncompressedSize: 136192
ZipFileName: LOIC.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe loic.exe

Process information

PID
CMD
Path
Indicators
Parent process
2840"C:\Users\admin\Desktop\LOIC.exe" C:\Users\admin\Desktop\LOIC.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Low Orbit Ion Cannon
Exit code:
0
Version:
1.0.8.0
Modules
Images
c:\users\admin\desktop\loic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4052"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\LOIC-1.0.8-binary.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
9 211
Read events
9 136
Write events
66
Delete events
9

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\LOIC-1.0.8-binary.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
1
Suspicious files
12
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4052.38621\LOIC.exeexecutable
MD5:E6FA3028CD03318496852718143D256F
SHA256:F60A52512773B52DEF9BA9CE8AAD61144D2CF351F6BC04D1C5A13ABEF8F3B89B
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_279EB7E7074697CADB0A3844954F1B7Dbinary
MD5:42CF1B6815E1B6B7F9EFE751403A746A
SHA256:2849FEBD0AE58B082A0136DA842AF971D3C6E9E3E49D4E792D10F06A29867E14
2840LOIC.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\LOIC[1].gifimage
MD5:389AF7889E62038B8405E883A407F52C
SHA256:64D2AB59CF13621CA806EEEDA91333E5CDF865722209574D6F41C396BD9F8A34
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_B59D7D4433266DE253365EA22B317141der
MD5:BA189CE946977D4C67254CFF7490B017
SHA256:EAEF96ADA14DCDE4B09958C38CE98B16A16786A23108EBD2C7742CC9EC2CF4A4
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:AB1AD56436B9AB634F5B5489B2D54E93
SHA256:AF9675AFA8C657FDF461552F0B828D2732E225CDFD13405EBF870AE5871E7588
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_279EB7E7074697CADB0A3844954F1B7Dder
MD5:9FC7CAA4EE9366E6EB92A9010DD7B8BA
SHA256:0264C625E06F7B0223A2DBE643208C65DA4D5B5DB686F9E04A73B2F238819482
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:6307EB4D85E797106E9226637D12DDFB
SHA256:BBFB2758CAE186A6B7E9A274BBBCF1332FBC1CC6A30E121477918BC8E0ADB31F
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:29234F108F40836DE6B705E3195CAA35
SHA256:5BCF1ECB4F6B29FA52EE4AD3768CA68D8002DC8322DE0086453CF56B3CD33A41
2840LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_B59D7D4433266DE253365EA22B317141binary
MD5:0CBF52D24AED2A857DA73919A1678360
SHA256:E87801146B5235869F4824E566878A986DA931326F57A8DAF1BDC3D50BACCDC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3 520
TCP/UDP connections
3 658
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
2840
LOIC.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAjBbMJ9cbDkwwNGsRu7SXg%3D
unknown
binary
471 b
unknown
2840
LOIC.exe
GET
—
195.208.1.115:80
http://195.208.1.115:80/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2840
LOIC.exe
195.208.1.115:80
—
Jsc ru-center
RU
unknown
2840
LOIC.exe
67.199.248.17:443
j.mp
GOOGLE-CLOUD-PLATFORM
US
shared
2840
LOIC.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2840
LOIC.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2840
LOIC.exe
52.179.188.206:443
loicweb.azurewebsites.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2840
LOIC.exe
142.250.184.232:443
www.googletagmanager.com
GOOGLE
US
unknown
2840
LOIC.exe
152.199.19.161:443
az416426.vo.msecnd.net
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
j.mp
  • 67.199.248.17
  • 67.199.248.16
shared
ctldl.windowsupdate.com
  • 93.184.221.240
  • 184.24.77.184
  • 184.24.77.202
  • 184.24.77.192
  • 184.24.77.193
  • 184.24.77.182
  • 184.24.77.194
  • 184.24.77.197
  • 184.24.77.186
  • 184.24.77.205
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
loicweb.azurewebsites.net
  • 52.179.188.206
whitelisted
www.googletagmanager.com
  • 142.250.184.232
whitelisted
az416426.vo.msecnd.net
  • 152.199.19.161
whitelisted
ocsp.pki.goog
  • 142.250.186.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LOIC-1.0.8-binary.zip