File name:

TNod-1.6.1-final-setup.rar

Full analysis: https://app.any.run/tasks/18409588-dc74-4cd0-9a2d-481b94f26d9f
Verdict: Malicious activity
Analysis date: April 18, 2019, 03:58:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

EB5728CBF60B32F5B049E15DF7F46289

SHA1:

68CB6C97BD388FA9A7429B5A0D082FFA0AA8F880

SHA256:

B945A110B3FEB2F4C1BE57A198165EE3725993B487D431BA550682BE170290EE

SSDEEP:

49152:gQBE4JsRag7/WMAxrDzImHms++/sPScoRgilD:3J/g7zG3UmgPSzRgg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • TNod-1.6.1-final-setup.exe (PID: 828)

    • Application was dropped or rewritten from another process

      • TNod-1.6.1-final-setup.exe (PID: 828)
      • TNod-1.6.1-final-setup.exe (PID: 2480)
      • TNODUP.exe (PID: 584)

    • Changes the autorun value in the registry

      • TNod-1.6.1-final-setup.exe (PID: 828)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1752)
      • TNod-1.6.1-final-setup.exe (PID: 828)

    • Creates files in the program directory

      • TNod-1.6.1-final-setup.exe (PID: 828)

    • Creates a software uninstall entry

      • TNod-1.6.1-final-setup.exe (PID: 828)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 2315043
UncompressedSize: 2334958
OperatingSystem: Win32
ModifyDate: 2016:11:19 17:58:18
PackingMethod: Normal
ArchivedFileName: TNod-1.6.1-final-setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start winrar.exe tnod-1.6.1-final-setup.exe no specs tnod-1.6.1-final-setup.exe tnodup.exe

Process information

PID
CMD
Path
Indicators
Parent process
584"C:\Program Files\TNod\TNODUP.exe"C:\Program Files\TNod\TNODUP.exe
TNod-1.6.1-final-setup.exe
User:
admin
Company:
Tukero[X]Team
Integrity Level:
HIGH
Description:
TNod User & Password Finder
Exit code:
0
Version:
1, 6, 1, 0
Modules
Images
c:\program files\tnod\tnodup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
828"C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe
WinRAR.exe
User:
admin
Company:
Tukero[X]Team
Integrity Level:
HIGH
Description:
Installer. NSIS
Exit code:
0
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1752.47532\tnod-1.6.1-final-setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1752"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TNod-1.6.1-final-setup.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2480"C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exe—WinRAR.exe
User:
admin
Company:
Tukero[X]Team
Integrity Level:
MEDIUM
Description:
Installer. NSIS
Exit code:
3221226540
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1752.47532\tnod-1.6.1-final-setup.exe
c:\systemroot\system32\ntdll.dll
Total events
922
Read events
825
Write events
97
Delete events
0

Modification events

(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1752) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TNod-1.6.1-final-setup.rar
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
9
Suspicious files
0
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nskAD25.tmp —
MD5:—
SHA256:—
1752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1752.47532\TNod-1.6.1-final-setup.exeexecutable
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\uninst-tnod.exeexecutable
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\CREDITS.txttext
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\TNODUP.exeexecutable
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\LEEME.txttext
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Users\Public\Desktop\Actualizar licencia de NOD32.lnklnk
MD5:—
SHA256:—
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nszAD35.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
828TNod-1.6.1-final-setup.exeC:\Users\admin\AppData\Local\Temp\nszAD35.tmp\UserInfo.dllexecutable
MD5:7579ADE7AE1747A31960A228CE02E666
SHA256:564C80DEC62D76C53497C40094DB360FF8A36E0DC1BDA8383D0F9583138997F5
828TNod-1.6.1-final-setup.exeC:\Program Files\TNod\tnodicons.iclexecutable
MD5:49D13D0454EA8FBC278A026686011803
SHA256:F2643CE646F2C5A69ADFA271C2C88033FCBBE2DE037AD01DDB5BCA076A380084
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
584
TNODUP.exe
GET
200
91.228.165.81:80
http://iploc.eset.com/ip_locate_iso2
SK
xml
246 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
584
TNODUP.exe
91.228.165.81:80
iploc.eset.com
ESET, spol. s r.o.
SK
unknown

DNS requests

Domain
IP
Reputation
iploc.eset.com
  • 91.228.165.81
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TNod-1.6.1-final-setup.rar