File name:

TNod-1.6.1-final-setup.rar

Full analysis: https://app.any.run/tasks/18409588-dc74-4cd0-9a2d-481b94f26d9f
Verdict: Malicious activity
Analysis date: April 18, 2019, 03:58:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

EB5728CBF60B32F5B049E15DF7F46289

SHA1:

68CB6C97BD388FA9A7429B5A0D082FFA0AA8F880

SHA256:

B945A110B3FEB2F4C1BE57A198165EE3725993B487D431BA550682BE170290EE

SSDEEP:

49152:gQBE4JsRag7/WMAxrDzImHms++/sPScoRgilD:3J/g7zG3UmgPSzRgg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TNod-1.6.1-final-setup.exe (PID: 2480)
      • TNod-1.6.1-final-setup.exe (PID: 828)
      • TNODUP.exe (PID: 584)

    • Loads dropped or rewritten executable

      • TNod-1.6.1-final-setup.exe (PID: 828)

    • Changes the autorun value in the registry

      • TNod-1.6.1-final-setup.exe (PID: 828)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1752)
      • TNod-1.6.1-final-setup.exe (PID: 828)

    • Creates files in the program directory

      • TNod-1.6.1-final-setup.exe (PID: 828)

    • Creates a software uninstall entry

      • TNod-1.6.1-final-setup.exe (PID: 828)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 2315043
UncompressedSize: 2334958
OperatingSystem: Win32
ModifyDate: 2016:11:19 17:58:18
PackingMethod: Normal
ArchivedFileName: TNod-1.6.1-final-setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe tnod-1.6.1-final-setup.exe no specs tnod-1.6.1-final-setup.exe tnodup.exe

Process information

PID
CMD
Path
Indicators
Parent process
584"C:\Program Files\TNod\TNODUP.exe"C:\Program Files\TNod\TNODUP.exe
TNod-1.6.1-final-setup.exe
User:
admin
Company:
Tukero[X]Team
Integrity Level:
HIGH
Description:
TNod User & Password Finder
Exit code:
0
Version:
1, 6, 1, 0
Modules
Images
c:\program files\tnod\tnodup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
828"C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe
WinRAR.exe
User:
admin
Company:
Tukero[X]Team
Integrity Level:
HIGH
Description:
Installer. NSIS
Exit code:
0
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1752.47532\tnod-1.6.1-final-setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1752"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TNod-1.6.1-final-setup.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2480"C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe—WinRAR.exe
User:
admin
Company:
Tukero[X]Team
Integrity Level:
MEDIUM
Description:
Installer. NSIS
Exit code:
3221226540
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1752.47532\tnod-1.6.1-final-setup.exe
c:\systemroot\system32\ntdll.dll
Total events
922
Read events
825
Write events
97
Delete events
0

Modification events

(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1752) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TNod-1.6.1-final-setup.rar
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
9
Suspicious files
0
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nskAD25.tmp —
MD5:—
SHA256:—
1752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exeexecutable
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nszAD35.tmp\modern-wizard.bmpimage
MD5:A4CAFA206193CA77110D2BBB750D602C
SHA256:43C16E75A065787EC73318FD1BBEDA30377662533F4B42461A8AFF174C436AA9
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nszAD35.tmp\UserInfo.dllexecutable
MD5:7579ADE7AE1747A31960A228CE02E666
SHA256:564C80DEC62D76C53497C40094DB360FF8A36E0DC1BDA8383D0F9583138997F5
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\LEEME.txttext
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Users\Public\Desktop\Actualizar licencia de NOD32.lnklnk
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\uninst-tnod.exeexecutable
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\TNODUP.exeexecutable
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\CREDITS.txttext
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nszAD35.tmp\LangDLL.dllexecutable
MD5:9384F4007C492D4FA040924F31C00166
SHA256:60A964095AF1BE79F6A99B22212FEFE2D16F5A0AFD7E707D14394E4143E3F4F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
584
TNODUP.exe
GET
200
91.228.165.81:80
http://iploc.eset.com/ip_locate_iso2
SK
xml
246 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
584
TNODUP.exe
91.228.165.81:80
iploc.eset.com
ESET, spol. s r.o.
SK
unknown

DNS requests

Domain
IP
Reputation
iploc.eset.com
  • 91.228.165.81
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TNod-1.6.1-final-setup.rar