analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dark Bot.exe

Full analysis: https://app.any.run/tasks/d6aaf644-50ea-4d8d-b7e1-bdde56104de9
Verdict: Malicious activity
Analysis date: March 22, 2019, 11:08:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4B490DE2B9738D99329D210799B0FA8F

SHA1:

3BF5541C127457F81950574D80FE7CF12D146F4F

SHA256:

BCE163EB292303DF9353BCE052FC7242BF573F24ED9751444D3A35EC3A2985E0

SSDEEP:

49152:M/ZcOUcLRPgex104XINqmFUAhHjuxDjYFibnsLx:MjUcLR3XHmF1jIvC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the user directory

      • Dark Bot.exe (PID: 2372)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

SpecialBuild: -
ProductVersion: 12.8
ProductName: Alther Dark Bot 10.1 - Full Version - by Giray DE
PrivateBuild: -
OriginalFileName: Alther Dark Bot 10.1.exe
LegalTrademarks: Alther Dark Bot 10.1 - Full Version - by Giray DE
LegalCopyright: Copyright 2011-2019
InternalName: Alther Dark Bot 10.1
FileVersion: 12.8
FileDescription: Alther Dark Bot 10.1 - Full Version
CompanyName: Alther Dark Bot - by Giray DE
Comments: Alther Dark Bot 10.1- Full Version Developed and Created by Giray DE
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: Debug
FileFlagsMask: 0x003f
ProductVersionNumber: 12.8.0.0
FileVersionNumber: 12.8.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xc3508
UninitializedDataSize: -
InitializedDataSize: 544768
CodeSize: 1142784
LinkerVersion: 7
PEType: PE32
TimeStamp: 2009:06:21 20:26:03+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Jun-2009 18:26:03
Detected languages:
  • English - United States
Comments: Alther Dark Bot 10.1- Full Version Developed and Created by Giray DE
CompanyName: Alther Dark Bot - by Giray DE
FileDescription: Alther Dark Bot 10.1 - Full Version
FileVersion: 12.8
InternalName: Alther Dark Bot 10.1
LegalCopyright: Copyright 2011-2019
LegalTrademarks: Alther Dark Bot 10.1 - Full Version - by Giray DE
OriginalFilename: Alther Dark Bot 10.1.exe
PrivateBuild: -
ProductName: Alther Dark Bot 10.1 - Full Version - by Giray DE
ProductVersion: 12.8
SpecialBuild: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 21-Jun-2009 18:26:03
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00116A52
0x00117000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.67927
.rdata
0x00118000
0x0004DE36
0x0004E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.89897
.data
0x00166000
0x00010624
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.61208
.rsrc
0x00177000
0x0002FCD4
0x00030000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.49114

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.42039
1268
Latin 1 / Western European
English - United States
RT_VERSION
2
4.13758
4264
Latin 1 / Western European
English - United States
RT_ICON
3
3.85855
9640
Latin 1 / Western European
English - United States
RT_ICON
4
3.78663
16936
Latin 1 / Western European
English - United States
RT_ICON
5
3.63763
67624
Latin 1 / Western European
English - United States
RT_ICON
6
2.4028
744
Latin 1 / Western European
English - United States
RT_ICON
7
2.68898
296
Latin 1 / Western European
English - United States
RT_ICON
8
3.79395
1384
Latin 1 / Western European
English - United States
RT_ICON
9
2.18351
92
Latin 1 / Western European
English - United States
RT_STRING
10
4.04174
1384
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll (delay-loaded)
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
WINMM.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
30
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dark bot.exe

Process information

PID
CMD
Path
Indicators
Parent process
2372"C:\Users\admin\AppData\Local\Temp\Dark Bot.exe" C:\Users\admin\AppData\Local\Temp\Dark Bot.exe
explorer.exe
User:
admin
Company:
Alther Dark Bot - by Giray DE
Integrity Level:
MEDIUM
Description:
Alther Dark Bot 10.1 - Full Version
Version:
12.8
Total events
80
Read events
60
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
1
Unknown types
62

Dropped files

PID
Process
Filename
Type
2372Dark Bot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.solsol
MD5:7FE442A7AB194FD1BBE916BE54806CDA
SHA256:B3CE63445CAA90ABC31B52FE1CFEF8818EDDAC53B7478C5030CA5F99E08A282F
2372Dark Bot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#game.aqworlds.com\settings.sxx —
MD5:—
SHA256:—
2372Dark Bot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8DF5U6SM\game.aqworlds.com\game\gamefiles\Game_20190305.swf\FBTSA.sxx —
MD5:—
SHA256:—
2372Dark Bot.exeC:\Users\admin\AppData\Local\Temp\{2EF13A0C-63F8-488C-9377-AC635F28BE46}\_extra\ADB v10.1.swfswf
MD5:F5052860918B35148F3F0F2A62197453
SHA256:6058BF49C4D3DC135C829534BAB363A189F8AD5BBDC32F052ABC53FD7788FE4F
2372Dark Bot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxxsol
MD5:7FE442A7AB194FD1BBE916BE54806CDA
SHA256:B3CE63445CAA90ABC31B52FE1CFEF8818EDDAC53B7478C5030CA5F99E08A282F
2372Dark Bot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\8DF5U6SM\game.aqworlds.com\AQWUserPref.sxx —
MD5:—
SHA256:—
2372Dark Bot.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\Game_20190305[1].swfswf
MD5:B1708B212C94AFE235EE5F440AFEC583
SHA256:58E937DF36528ACCEE096EF735C32A8BED443BC928546A676077E387F444BD8B
2372Dark Bot.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\gameversion[1].htmtext
MD5:1410FB595F881052F472BB600DFDEF11
SHA256:2CB0C19D614B9CB4336B5D19FE3D4CD96B2025A6D11D3044BEA5BB8E2CC8F89F
2372Dark Bot.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\Generic2[1].swfswf
MD5:1B22C82A3F638D652742289BB9C28DC0
SHA256:45BCCAA7C3E7AB4A1D1A541420071FE6D021324FFA275F8F0D6E1BD08F02B4D6
2372Dark Bot.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#game.aqworlds.com\settings.solsol
MD5:0B4BB6B6EF2B39E0D75758DB69972A57
SHA256:169C5B32D7F2E7EC155BB03E13CB3A5D18CB3F210436957E25C9E3C4DD7CCB43
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2372
Dark Bot.exe
GET
200
151.139.128.10:80
http://aqworldscdn.aq.com/game/gameversion.asp
US
text
177 b
malicious
2372
Dark Bot.exe
GET
200
75.126.77.25:80
http://game.aqworlds.com/game/gamefiles/title/Generic2.swf
US
swf
166 Kb
suspicious
2372
Dark Bot.exe
GET
200
75.126.77.25:80
http://game.aqworlds.com/game/gamefiles/Game_20190305.swf
US
swf
1.67 Mb
suspicious
2372
Dark Bot.exe
GET
200
151.139.128.10:80
http://aqworldscdn.aq.com/crossdomain.xml
US
xml
564 b
malicious
2372
Dark Bot.exe
POST
413
151.139.128.10:80
http://aqworldscdn.aq.com/game/cf-userlogin.asp?ran=0.4652725604666735
US
xml
564 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2372
Dark Bot.exe
151.139.128.10:80
aqworldscdn.aq.com
Highwinds Network Group, Inc.
US
malicious
2372
Dark Bot.exe
75.126.77.25:80
game.aqworlds.com
SoftLayer Technologies Inc.
US
unknown

DNS requests

Domain
IP
Reputation
aqworldscdn.aq.com
  • 151.139.128.10
malicious
game.aqworlds.com
  • 75.126.77.25
  • 75.126.77.28
  • 75.126.77.27
suspicious

Threats

PID
Process
Class
Message
2372
Dark Bot.exe
Potential Corporate Privacy Violation
ET POLICY Outdated Flash Version M1
2372
Dark Bot.exe
Potential Corporate Privacy Violation
ET POLICY Http Client Body contains pass= in cleartext
2372
Dark Bot.exe
Potential Corporate Privacy Violation
ET POLICY Http Client Body contains pwd= in cleartext
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dark Bot.exe