File name:

LOIC-1.0.8-binary.zip

Full analysis: https://app.any.run/tasks/a426b625-8754-418f-9479-dc144720bd63
Verdict: Malicious activity
Analysis date: December 02, 2023, 15:33:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C615DA1584CF050CF81A08D40309D735

SHA1:

FF00F68B03F7BBC785284ABD95A54D5B98F7DB9B

SHA256:

B6D6E0D1DCE867836A684A0AF278E46ED4A50BE49A784AB7BFCB3ED59841C9D0

SSDEEP:

3072:n1sQ9BKWms487f1j/XjSGrJmjJ7cAs1QRls:nuQ9Tmd41jfD0lgXQRG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • LOIC.exe (PID: 3872)

    • Reads Microsoft Outlook installation path

      • LOIC.exe (PID: 3872)

    • Checks Windows Trust Settings

      • LOIC.exe (PID: 3872)

    • Reads security settings of Internet Explorer

      • LOIC.exe (PID: 3872)

    • Reads settings of System Certificates

      • LOIC.exe (PID: 3872)

    • Reads Internet Explorer settings

      • LOIC.exe (PID: 3872)

    • Connects to unusual port

      • LOIC.exe (PID: 3872)

  • INFO

    • Reads the computer name

      • LOIC.exe (PID: 3872)
      • wmpnscfg.exe (PID: 1360)

    • Checks supported languages

      • LOIC.exe (PID: 3872)
      • wmpnscfg.exe (PID: 1360)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2144)

    • Reads the machine GUID from the registry

      • LOIC.exe (PID: 3872)

    • Checks proxy server information

      • LOIC.exe (PID: 3872)

    • Creates files or folders in the user directory

      • LOIC.exe (PID: 3872)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2014:12:12 21:09:00
ZipCRC: 0x3aef8268
ZipCompressedSize: 103047
ZipUncompressedSize: 136192
ZipFileName: LOIC.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs loic.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1360"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2144"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\LOIC-1.0.8-binary.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3872"C:\Users\admin\AppData\Local\Temp\Rar$EXa2144.20390\LOIC.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2144.20390\LOIC.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Low Orbit Ion Cannon
Exit code:
0
Version:
1.0.8.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2144.20390\loic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
6 370
Read events
6 310
Write events
60
Delete events
0

Modification events

(PID) Process:(2144) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2144) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
1
Suspicious files
16
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C65DE78ABB859CDF145E773693C5C3A1
SHA256:6AA2CDEB718FCD593B02CC5B5A67A336CD57BAD71DFA6184864CC127A7922B09
3872LOIC.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\ai.0[1].jstext
MD5:1DD63DE72CF1F702324245441844BE13
SHA256:5201C813C37A4168CC5C20C701D4391FD0A55625F97EB9F263A74FB52B52FD0E
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_B59D7D4433266DE253365EA22B317141binary
MD5:A3F8E62A9399121D7FE0C38DB8C00C5D
SHA256:EB454829C6FB3C07E2C1292A561058AF7C98B6ADF304A7763293430AFB29A616
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:5F4130C766294375E7D2B34BB99770F5
SHA256:AA06B6419E25311AB730DC05513AF28DD8112CA7F209415EFED269B201F4E1E1
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:76D0445DD935A6A9A5198A7D800A30E5
SHA256:9293BC708118624C62983CCB7C3A70DF3F72E42B61FD2E34E87B3E5AE95B0EA2
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:F24C0B580B6A72F8E70CCA79515686DB
SHA256:ED187EEF98104F97E7B1391F21E52552F359FBB630D6FB83C38868DAA880ADDF
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:FD8F9807BD355CD565B287B9F332F2A9
SHA256:EAF24EBB5CD1859D7D590AA73F0D3D24ABB8A64E30F9DCF19E88C39DA12116B6
3872LOIC.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\loicweb[1].htmhtml
MD5:73772A56FA102A6889F0F1749691F2AC
SHA256:DB4D28D45DF153EC62ABDF2233D1AB5BFD73F4DC1B364625C2839E68FEB23C24
3872LOIC.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\900DHKTG.htmhtml
MD5:1F653862E2CFCF2E480F2307BED3099E
SHA256:B739866DF8F6FB0EC6E8A7769A6D67502B4407C5EBEB4A3D765825EB3C4EC8B5
3872LOIC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
26
DNS requests
7
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3872
LOIC.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e91561ec8996c2c7
unknown
compressed
4.66 Kb
unknown
3872
LOIC.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3872
LOIC.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAjBbMJ9cbDkwwNGsRu7SXg%3D
unknown
binary
471 b
unknown
3872
LOIC.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
3872
LOIC.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3872
LOIC.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3872
LOIC.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3872
LOIC.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQChuVoVf7HVAxLxWCb2kXo7
unknown
binary
472 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3872
LOIC.exe
95.214.180.44:69
—
Aaron Smith
HK
unknown
3872
LOIC.exe
67.199.248.16:443
j.mp
GOOGLE-CLOUD-PLATFORM
US
shared
3872
LOIC.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
3872
LOIC.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3872
LOIC.exe
52.179.188.206:443
loicweb.azurewebsites.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3872
LOIC.exe
216.58.206.40:443
www.googletagmanager.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
j.mp
  • 67.199.248.16
  • 67.199.248.17
shared
ctldl.windowsupdate.com
  • 87.248.204.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
loicweb.azurewebsites.net
  • 52.179.188.206
whitelisted
www.googletagmanager.com
  • 216.58.206.40
whitelisted
az416426.vo.msecnd.net
  • 152.199.19.161
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LOIC-1.0.8-binary.zip