File name:

PayPal_Checker__Combo_by_3mon.rar

Full analysis: https://app.any.run/tasks/b6047e80-506f-4121-afc3-2478105ffcf1
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: May 21, 2020, 19:33:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E9217C48E4420D27792B70487E236C64

SHA1:

91BD129F75D038095FCABD5DF33B419E80FE21CF

SHA256:

C128E45F51EA62DB67193E67C3D03B693E56D4DDE09E9081189D13C2B98B6AC1

SSDEEP:

98304:Rsvo4pqpqkF2ALJDsvo4pqpqkFMeUFOc3UT3OSz2z90ntrhev/Yl:Rsv9c5FvLJDsv9c5FSFODTltrhe3a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • PayPal Checker + Combo by 3mon.exe (PID: 3112)
      • PayPal Checker + Combo by 3mon.exe (PID: 1812)

    • NANOCORE was detected

      • PAYPAL.EXE (PID: 2356)

    • Application was dropped or rewritten from another process

      • PAYPAL[CRACK].EXE (PID: 2828)
      • PAYPAL.EXE (PID: 2356)
      • Microsoft Windows Protocol Services Host.exe (PID: 3264)
      • Microsoft Windows Protocol Monitor.exe (PID: 2288)

    • Changes the autorun value in the registry

      • PAYPAL.EXE (PID: 2356)

  • SUSPICIOUS

    • Writes to a desktop.ini file (may be used to cloak folders)

      • WinRAR.exe (PID: 2132)

    • Creates files in the Windows directory

      • PayPal Checker + Combo by 3mon.exe (PID: 1812)

    • Creates files in the program directory

      • PAYPAL.EXE (PID: 2356)
      • PayPal Checker + Combo by 3mon.exe (PID: 1812)

    • Creates files in the user directory

      • PAYPAL.EXE (PID: 2356)
      • PayPal Checker + Combo by 3mon.exe (PID: 3112)

    • Executable content was dropped or overwritten

      • PAYPAL.EXE (PID: 2356)
      • PayPal Checker + Combo by 3mon.exe (PID: 1812)
      • lib32.exe (PID: 448)

    • Uses RUNDLL32.EXE to load library

      • SOUNDMAN.EXE (PID: 3864)

  • INFO

    • Manual execution by user

      • PayPal Checker + Combo by 3mon.exe (PID: 3112)
      • SOUNDMAN.EXE (PID: 3864)
      • regedit.exe (PID: 2128)
      • regedit.exe (PID: 2688)
      • rundll32.exe (PID: 2552)
      • WINWORD.EXE (PID: 2912)
      • PayPal Checker + Combo by 3mon.exe (PID: 1812)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2912)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2912)

    • Dropped object may contain Bitcoin addresses

      • PayPal Checker + Combo by 3mon.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
15
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs paypal checker + combo by 3mon.exe paypal checker + combo by 3mon.exe microsoft windows protocol services host.exe no specs lib32.exe microsoft windows protocol monitor.exe no specs #NANOCORE paypal.exe paypal[crack].exe no specs soundman.exe no specs rundll32.exe no specs regedit.exe no specs regedit.exe rundll32.exe no specs notepad.exe no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
448"C:\Users\admin\Desktop\PayPal Checker + Combo by 3mon\interface\lib32.exe" {Arguments If Needed}C:\Users\admin\Desktop\PayPal Checker + Combo by 3mon\interface\lib32.exe
PayPal Checker + Combo by 3mon.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\windows\system32\wininet.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\oleaut32.dll
c:\users\admin\desktop\paypal checker + combo by 3mon\paypal checker + combo by 3mon.exe
c:\windows\system32\version.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rsaenh.dll
1812"C:\Users\admin\Desktop\PayPal Checker + Combo by 3mon\PayPal Checker + Combo by 3mon.exe" C:\Users\admin\Desktop\PayPal Checker + Combo by 3mon\PayPal Checker + Combo by 3mon.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
interface
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\paypal checker + combo by 3mon\paypal checker + combo by 3mon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2128"C:\Windows\regedit.exe" C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2132"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PayPal_Checker__Combo_by_3mon.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2288"C:\Windows\Program Files (x86)\Microsoft Host Interface\interface\Microsoft Windows Protocol Monitor.exe" C:\Windows\Program Files (x86)\Microsoft Host Interface\interface\Microsoft Windows Protocol Monitor.exe—Microsoft Windows Protocol Services Host.exe
User:
admin
Integrity Level:
HIGH
Description:
Microsoft Windows Protocol Monitor
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\program files (x86)\microsoft host interface\interface\microsoft windows protocol monitor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2356"C:\Users\admin\AppData\Local\Temp\PAYPAL.EXE" C:\Users\admin\AppData\Local\Temp\PAYPAL.EXE
lib32.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\paypal.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2552"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\drivers\etc\hostsC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2688"C:\Windows\regedit.exe" C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
2828"C:\Users\admin\AppData\Local\Temp\PAYPAL[CRACK].EXE" C:\Users\admin\AppData\Local\Temp\PAYPAL[CRACK].EXE—lib32.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\paypal[crack].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
2912"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\restaurantpurchase.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
Total events
2 098
Read events
1 702
Write events
245
Delete events
151

Modification events

(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2132) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\PayPal_Checker__Combo_by_3mon.rar
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
5
Suspicious files
1
Text files
2
Unknown types
6

Dropped files

PID
Process
Filename
Type
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\Combos with good hits.txt —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\Combos with good hits.txt —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\lib32.exe —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\libeay32.dll —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\Microsoft Windows Protocol Monitor.exe —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\Microsoft Windows Protocol Services Host.exe —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\msvcr71.dll —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\Proxy List.txt —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\interface\ssleay32.dll —
MD5:—
SHA256:—
2132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2132.49238\PayPal Checker + Combo by 3mon\libeay32.dll —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
36
DNS requests
38
Threats
38

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
PAYPAL.EXE
8.8.4.4:53
—
Google Inc.
US
whitelisted
—
—
8.8.8.8:53
—
Google Inc.
US
malicious
—
—
8.8.4.4:53
—
Google Inc.
US
whitelisted
2356
PAYPAL.EXE
8.8.8.8:53
—
Google Inc.
US
malicious

DNS requests

Domain
IP
Reputation
Oranjun-60963.portmap.io
  • —
unknown

Threats

PID
Process
Class
Message
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
1056
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2356
PAYPAL.EXE
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
Process
Message
lib32.exe
C:\Users\admin\AppData\Local\Temp\PAYPAL.EXE
lib32.exe
C:\Users\admin\AppData\Local\Temp\PAYPAL[CRACK].EXE
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PayPal_Checker__Combo_by_3mon.rar