Find similar analyses in TI Lookup

Analysis date (UTC): 23 March 2021, 07:46Analysis environment: Windows 7 Pro, build 7601, x86

ByRR Crypter & Binder.rar

MD5:4EE2CD532CD36307AE7ACA567CD92317

SHA1:EE5F68830DC14DF7D071BEDF59AEA628C2CC1E24

SHA256:C1A7CB86235EDF4EF81198CC426FB569ADDF85C2F8E7F4A9575B0DD956100CA4

Analysis result

Threat level:Malicious activity

Tags:

trojanratasyncrat

Full analysis:Analysis ByRR Crypter & Binder.rar (MD5: 4EE2CD532CD36307AE7ACA567CD92317) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

ByRR FUD Crypter and Binder.exe (PID: 2960)
ByRR FUD Crypter and Binder.exe (PID: 3872)
wermgr.exe (PID: 2432)
fgj.exe (PID: 3892)

Drops executable file immediately after starts

ByRR FUD Crypter and Binder.exe (PID: 2960)

ASYNCRAT was detected

wermgr.exe (PID: 2432)

SUSPICIOUS

Executable content was dropped or overwritten

WinRAR.exe (PID: 2588)
ByRR FUD Crypter and Binder.exe (PID: 2960)
ByRR FUD Crypter and Binder.exe (PID: 3872)

Drops a file with too old compile date

WinRAR.exe (PID: 2588)
ByRR FUD Crypter and Binder.exe (PID: 2960)
ByRR FUD Crypter and Binder.exe (PID: 3872)

Creates files in the program directory

ByRR FUD Crypter and Binder.exe (PID: 2960)

Drops a file that was compiled in debug mode

ByRR FUD Crypter and Binder.exe (PID: 2960)

INFO

Manual execution by user

ByRR FUD Crypter and Binder.exe (PID: 2960)
fgj.exe (PID: 3892)

Threats

PID	Process	Class	Message
1052	svchost.exe	Potential Corporate Privacy Violation	ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
2432	wermgr.exe	A Network Trojan was detected	SUSPICIOUS [PTsecurity] Possible AsyncRAT/Quasar SSL certificate
2432	wermgr.exe	A Network Trojan was detected	REMOTE [PTsecurity] AsyncRAT Connection