analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Mua hàng.zip |
| Full analysis: | https://app.any.run/tasks/afdcf59d-d615-470f-9419-bcca06985bb4 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | October 14, 2019, 02:23:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 4C1FC80A900E4A0150E3886ED8E8A9F8 |
| SHA1: | 792C9A388F45D99FD74901286503E83235D89AB8 |
| SHA256: | C1F697B673237A5DF40649194FC04FA92C296789CF6953EA3566A6D8C5F13FB3 |
| SSDEEP: | 6144:+XK6O5AqIdGfI5CDZXC6JqKHV7Y6p49gDbdPBXt+vt7eGtnslqhPzqJ3MQWKyu6P:vtkdGfI5ClvJrC9gHEvt7eGtnslgeM7l |
MALICIOUS
Application was dropped or rewritten from another process
- Mua hàng.exe (PID: 1772)
- Mua hàng.exe (PID: 1884)
REMCOS was detected
- Mua hàng.exe (PID: 1772)
SUSPICIOUS
Application launched itself
- Mua hàng.exe (PID: 1884)
Creates files in the user directory
- Mua hàng.exe (PID: 1772)
Writes files like Keylogger logs
- Mua hàng.exe (PID: 1772)
INFO
Manual execution by user
- Mua hàng.exe (PID: 1884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2011:03:04 14:06:17 |
| ZipCRC: | 0xe5fe6d4b |
| ZipCompressedSize: | 373173 |
| ZipUncompressedSize: | 606208 |
| ZipFileName: | Mua h?ng.exe |
Total processes
37
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2384 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Mua hàng.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 1884 | "C:\Users\admin\Desktop\Mua hàng.exe" | C:\Users\admin\Desktop\Mua hàng.exe | — | explorer.exe |
User: admin Company: Topcapanaerobe Integrity Level: MEDIUM Exit code: 0 Version: 1.02.0003 | ||||
| 1772 | "C:\Users\admin\Desktop\Mua hàng.exe" | C:\Users\admin\Desktop\Mua hàng.exe | Mua hàng.exe | |
User: admin Company: Topcapanaerobe Integrity Level: MEDIUM Version: 1.02.0003 | ||||
Total events
444
Read events
423
Write events
21
Delete events
0
Modification events
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Mua hàng.zip | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
| (PID) Process: | (2384) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
| Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp | |||
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2384 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2384.32127\Mua hàng.exe | — | |
MD5:— | SHA256:— | |||
| 1772 | Mua hàng.exe | C:\Users\admin\AppData\Roaming\will\logs.dat | text | |
MD5:8C6675712B16206A9137DA86D1A11275 | SHA256:DD31B283D70C943288DC2D6824295C8A39A2D0BB181EAFE67BA89C03DA88AD4C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1772 | Mua hàng.exe | 79.134.225.22:24469 | asheesh.ddns.net | Andreas Fink trading as Fink Telecom Services | CH | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
asheesh.ddns.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1772 | Mua hàng.exe | A Network Trojan was detected | MALWARE [PTsecurity] Backdoor.Win32/Remcos RAT connection |