File name:

AbStealer Builder.7z

Full analysis: https://app.any.run/tasks/745b90ea-9585-4d5b-8d1d-efbd4b9a91d5
Verdict: Malicious activity
Analysis date: March 14, 2024, 13:44:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

EDD911EB6F5A540B93A1FBC3FA5972BD

SHA1:

722802EBB60ACF876D723E10423A432BC1A2D216

SHA256:

B9D5B9E6591F359BAC9F4983A4FEEB555D3D59F94BA22F6FA5874424EF6A4790

SSDEEP:

6144:P2KxSQMTRgte0IuKZb9w7kpdbGwuxEH9480OXd3iAG8QqKm7vSgvYA:P9iete5wA3Fuxsn0OZJYmWOR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3656)
      • AbBuild v.1.0.exe (PID: 2072)

  • SUSPICIOUS

    • Reads the Internet Settings

      • jjjjjj.exe (PID: 1340)
      • AbBuild v.1.0.exe (PID: 2072)

    • Checks for external IP

      • jjjjjj.exe (PID: 1340)

    • Executable content was dropped or overwritten

      • AbBuild v.1.0.exe (PID: 2072)

  • INFO

    • Reads the computer name

      • AbBuild v.1.0.exe (PID: 2304)
      • AbBuild v.1.0.exe (PID: 2072)
      • wmpnscfg.exe (PID: 1768)
      • jjjjjj.exe (PID: 1340)

    • Checks supported languages

      • AbBuild v.1.0.exe (PID: 2304)
      • AbBuild v.1.0.exe (PID: 2072)
      • wmpnscfg.exe (PID: 1768)
      • jjjjjj.exe (PID: 1340)

    • Manual execution by a user

      • AbBuild v.1.0.exe (PID: 2304)
      • rundll32.exe (PID: 1656)
      • AbBuild v.1.0.exe (PID: 2072)
      • wmpnscfg.exe (PID: 1768)
      • jjjjjj.exe (PID: 1340)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3656)

    • Reads the machine GUID from the registry

      • AbBuild v.1.0.exe (PID: 2304)
      • AbBuild v.1.0.exe (PID: 2072)
      • jjjjjj.exe (PID: 1340)

    • Reads Environment values

      • jjjjjj.exe (PID: 1340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe abbuild v.1.0.exe no specs rundll32.exe no specs abbuild v.1.0.exe wmpnscfg.exe no specs jjjjjj.exe

Process information

PID
CMD
Path
Indicators
Parent process
1340"C:\Users\admin\Desktop\jjjjjj.exe" C:\Users\admin\Desktop\jjjjjj.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsApplication710
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\jjjjjj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1656"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\Ab-Stealer-main\README.mdC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1768"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2072"C:\Users\admin\Desktop\Ab-Stealer-main\AbBuild v.1.0.exe" C:\Users\admin\Desktop\Ab-Stealer-main\AbBuild v.1.0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AbBuilder
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\ab-stealer-main\abbuild v.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2304"C:\Users\admin\Desktop\Ab-Stealer-main\AbBuild v.1.0.exe" C:\Users\admin\Desktop\Ab-Stealer-main\AbBuild v.1.0.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AbBuilder
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\ab-stealer-main\abbuild v.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3656"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AbStealer Builder.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
14 402
Read events
14 294
Write events
102
Delete events
6

Modification events

(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3656) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AbStealer Builder.7z
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3656) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
5
Suspicious files
1
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\img\bg.jpgimage
MD5:18D7DAD119F6F3E1267C2197991A4701
SHA256:B62832EE99520844A46D56B8AEF7D1EA8FC6A9D1912B70B65E8B0C84A88DCE20
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\style.csstext
MD5:611B331AF666B427BF8B70C187C207B4
SHA256:D1A2D6B4B5881187A38897BE95A5273E0465D1DC576F12DA956F1F0A56D1DE38
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\Panel.phptext
MD5:7053F732191EDF96FD4512762DDF0845
SHA256:0C7D070541161E43AB3EF8A87723865BF638965B2BD961A6D08125FE12F1ED98
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\img\Logo.pngimage
MD5:9EC35234F894111839CB6325762B022D
SHA256:A7D277AFFBC6AF9148515EE1DF84C0552971C200A2F255AA04B9B33A3663C2FC
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\info.phptext
MD5:A629991B6585F3F6BE19B90B900BBF8F
SHA256:E3A7DBFA0A61CFC36B4D59FD7092487E714AD1468F9C1044F403C5B4EEDE9946
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\logout.phptext
MD5:5BCBAA8CBA49A91786BEE395780E9A75
SHA256:4C88F4B31B7027E03FF6C3DC5A932DEDF2B65F350FD0C66F95F36295DF5C4DFD
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\POST.phptext
MD5:274AA12CC165219574AB9437C5AB4C04
SHA256:80E2A2AB43164F2EF40271C85AC5F67CD57CF08D40EABCFAF7830BFEAA7A51FB
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\img\AbBuild v.1.0\AbBuild v.1.0.exeexecutable
MD5:9E44C10307AA8194753896ECF8102167
SHA256:E1DECC2F7B00CA0AE9055A28D3E3A464D95158A2BED01BEBAE28BD6658870074
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\ps.phptext
MD5:6DAB11CF5FE8767C35DAC54367E1C5A0
SHA256:74AF340F1246845F0A4B6D6CE6C227EA205F89205AAF726868BFFC4CE57CE535
3656WinRAR.exeC:\Users\admin\Desktop\Ab-Stealer-main\Panel\login.phptext
MD5:D358B18130F2E7BBCACE5DFE7F004D20
SHA256:E0A856D3E2B2F391F1FB11DB2A4311F7D1DE021B57DDC837CEC963B201B692F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
1
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1340
jjjjjj.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
binary
315 b
unknown
1340
jjjjjj.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
binary
315 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1340
jjjjjj.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
1340
jjjjjj.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1340
jjjjjj.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1340
jjjjjj.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1340
jjjjjj.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AbStealer Builder.7z