File name: | AbkoRAT_By_Kjh.exe |
Full analysis: | https://app.any.run/tasks/c2e703d6-7f4e-419b-8067-83a13cb45343 |
Verdict: | Malicious activity |
Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
Analysis date: | July 20, 2024, 18:06:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | BE74505360F04AD9E16A34D13344627F |
SHA1: | D622ED0892FFD279A26D241445FEE3593C0ACE08 |
SHA256: | B9F374C7E415C1143AAB8E6D2AC26C682EDC7E5442BE1DB1A9B604DD58A29038 |
SSDEEP: | 98304:Tw9SdZ6lXHtZ47p517PCzqD2Xwz/TiZ0CwLti018XlW4hG0LVWG4YjNcoKBa2aIq:a+09qO4raFU |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
AssemblyVersion: | 1.0.0.0 |
---|---|
ProductVersion: | 1.0.0.0 |
ProductName: | AbkoRAT |
OriginalFileName: | AbkoRAT.exe |
LegalCopyright: | Copyright © 2020 Kjh |
InternalName: | AbkoRAT.exe |
FileVersion: | 1.0.0.0 |
FileDescription: | AbkoRAT |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x69e000 |
UninitializedDataSize: | - |
InitializedDataSize: | 28672 |
CodeSize: | 2444288 |
LinkerVersion: | 6 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
TimeStamp: | 2017:04:28 02:20:47+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3268 | "C:\Users\admin\Desktop\AbkoRAT_By_Kjh.exe" | C:\Users\admin\Desktop\AbkoRAT_By_Kjh.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: AbkoRAT Version: 1.0.0.0 Modules
| |||||||||||||||
2900 | "C:\Users\admin\Desktop\server.exe" | C:\Users\admin\Desktop\server.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
1980 | "C:\Users\admin\AppData\Local\Temp\server.exe" | C:\Users\admin\AppData\Local\Temp\server.exe | server.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
1620 | "C:\Users\admin\AppData\Local\Temp\server.exe" | C:\Users\admin\AppData\Local\Temp\server.exe | server.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 1.0.0.0 Modules
| |||||||||||||||
1384 | "netstat" -no | C:\Windows\System32\NETSTAT.EXE | — | server.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Netstat Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3016 | C:\Users\admin\AppData\Local\Temp\tmpC74A.tmp /stext C:\Users\admin\AppData\Local\Temp\tmpC74A.tmp.txt | C:\Users\admin\AppData\Local\Temp\tmpC74A.tmp | server.exe | ||||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: WebBrowserPassView Exit code: 0 Version: 1.45 Modules
|
(PID) Process: | (2900) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2900) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2900) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2900) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1980) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | {3g26zleo6-8163-7334-flw9-v1o10a0y336h} |
Value: "C:\Users\admin\AppData\Local\Temp\server.exe" /** | |||
(PID) Process: | (1980) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1980) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1980) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1980) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1620) server.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | {3g26zleo6-8163-7334-flw9-v1o10a0y336h} |
Value: "C:\Users\admin\AppData\Local\Temp\server.exe" /** |
PID | Process | Filename | Type | |
---|---|---|---|---|
3016 | tmpC74A.tmp | C:\Users\admin\AppData\Local\Temp\bhvC798.tmp | — | |
MD5:— | SHA256:— | |||
3268 | AbkoRAT_By_Kjh.exe | C:\Users\admin\AppData\Local\Temp\_ght\Config.dat | text | |
MD5:CA490E2DBA1310E35C57F03234E91212 | SHA256:FB96ECC5165DF80F6C5AA4D5EE850FB91D19302D9CC1848289D3765C7B0FABA1 | |||
3268 | AbkoRAT_By_Kjh.exe | C:\Users\admin\Desktop\Files\USER-PC_admin_Microsoft Windows 7 Professional\PC-Informations.txt | text | |
MD5:83F9B9DD26E46C2666B65AAF30C66CED | SHA256:B7CBCCA48C9CF4FCEAB7AFE2B014C5AFD647E91E0155790C13BD4EB6E1652C9D | |||
3268 | AbkoRAT_By_Kjh.exe | C:\Users\admin\AppData\Local\Temp\_ght\stub.ght | executable | |
MD5:C28079388C1DD0661FE749AA3F7985F9 | SHA256:ABD99180097530234A1BE4E9433D2A6C34F841C67FAEEAEBAC4B3F118449EE43 | |||
3268 | AbkoRAT_By_Kjh.exe | C:\Users\admin\Desktop\Files\USER-PC_admin_Microsoft Windows 7 Professional\Passwords.txt | text | |
MD5:0AE331B1212EC662C8AC88F677F4A346 | SHA256:5504A6262A67008154F8918E707C5614798019C74C89773DD8D828C10384DF22 | |||
1620 | server.exe | C:\Users\admin\AppData\Local\Temp\tmpC74A.tmp | executable | |
MD5:6D95F03EAF83B31686F263260202EE36 | SHA256:29F2A54C829C37FC904A2B682C50B57D6D35E9AF5DC7F43D72B68C8C51255103 | |||
3268 | AbkoRAT_By_Kjh.exe | C:\Users\admin\Desktop\server.exe | executable | |
MD5:0BF502B2EDC1737EBDD7E7396289F8E4 | SHA256:C3982DDAE61372A11B21B1A44A3E8F158BD5F1B1497E03CE1D1A0942FBE3A020 | |||
2900 | server.exe | C:\Users\admin\AppData\Local\Temp\server.exe | executable | |
MD5:0BF502B2EDC1737EBDD7E7396289F8E4 | SHA256:C3982DDAE61372A11B21B1A44A3E8F158BD5F1B1497E03CE1D1A0942FBE3A020 | |||
3016 | tmpC74A.tmp | C:\Users\admin\AppData\Local\Temp\tmpC74A.tmp.txt | text | |
MD5:0D2C1D9BE2E728E03E9C0B7D856E9394 | SHA256:D1802A1C8131800473A0B9BA78D8E797790EF03F9B593784CB12123F827B76E6 | |||
3268 | AbkoRAT_By_Kjh.exe | C:\Users\admin\AppData\Local\Temp\_ght\GeoIP.dat | binary | |
MD5:1F897B5825CF91799831862620911AFF | SHA256:5F85518CF71E7B53544E0BD0C1874D1F89A0D6DE7A6AD50683517575AAA56301 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1060 | svchost.exe | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f69642324cc87bd | unknown | — | — | unknown |
1372 | svchost.exe | GET | 304 | 23.50.131.216:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1372 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 239.255.255.250:3702 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
1372 | svchost.exe | 23.50.131.216:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
1060 | svchost.exe | 199.232.214.172:80 | ctldl.windowsupdate.com | FASTLY | US | unknown |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
dns.msftncsi.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
Process | Message |
---|---|
AbkoRAT_By_Kjh.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|