analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Fluxus.zip

Full analysis: https://app.any.run/tasks/9a7451f9-db59-4991-a952-8d50b36baa72
Verdict: Malicious activity
Analysis date: May 21, 2022, 10:36:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

D4858578C1C9BA11EB3826DB0565FA28

SHA1:

3FBFF4B587CA9E7DFE501BCFDDF81C5280D7A069

SHA256:

C4509F2215ADA6B565F31396DB54CF58A28373D850357C81638A3CF414A3EB12

SSDEEP:

49152:/wRqkuGNovkR2Bc0m4h56cfWazoJ6ARRQarQbK2wP+Vl:ayGNFkB/NfD8QAXbrQbK2Dn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 568)

    • Application was dropped or rewritten from another process

      • Fluxus V7.exe (PID: 1984)
      • Fluxus V7.exe (PID: 1800)
      • Fluxus V7.exe (PID: 2984)
      • Fluxus V7.exe (PID: 1228)
      • Fluxus V7.exe (PID: 3364)
      • Fluxus V7.exe (PID: 3872)

    • Changes settings of System certificates

      • Fluxus V7.exe (PID: 1228)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 568)
      • Fluxus V7.exe (PID: 1984)
      • Fluxus V7.exe (PID: 1228)
      • Fluxus V7.exe (PID: 3872)

    • Checks supported languages

      • WinRAR.exe (PID: 568)
      • Fluxus V7.exe (PID: 1984)
      • Fluxus V7.exe (PID: 1228)
      • MSASCui.exe (PID: 1036)
      • Fluxus V7.exe (PID: 3872)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 568)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 568)

    • Reads Environment values

      • Fluxus V7.exe (PID: 1984)
      • Fluxus V7.exe (PID: 1228)
      • Fluxus V7.exe (PID: 3872)

    • Creates a directory in Program Files

      • Fluxus V7.exe (PID: 1228)

    • Adds / modifies Windows certificates

      • Fluxus V7.exe (PID: 1228)

  • INFO

    • Manual execution by user

      • MSASCui.exe (PID: 1036)
      • Fluxus V7.exe (PID: 1228)
      • Fluxus V7.exe (PID: 2984)
      • Fluxus V7.exe (PID: 3364)
      • Fluxus V7.exe (PID: 3872)

    • Reads the computer name

      • WISPTIS.EXE (PID: 3656)
      • WISPTIS.EXE (PID: 2792)

    • Reads settings of System Certificates

      • Fluxus V7.exe (PID: 1228)

    • Checks Windows Trust Settings

      • Fluxus V7.exe (PID: 1228)

    • Checks supported languages

      • WISPTIS.EXE (PID: 3656)
      • WISPTIS.EXE (PID: 2792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Fluxus/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:04:10 18:36:08
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
12
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe fluxus v7.exe no specs fluxus v7.exe msascui.exe no specs fluxus v7.exe no specs fluxus v7.exe wisptis.exe no specs wisptis.exe no specs fluxus v7.exe no specs fluxus v7.exe wisptis.exe no specs wisptis.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fluxus.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1800"C:\Users\admin\AppData\Local\Temp\Rar$EXa568.3678\Fluxus\Fluxus V7.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa568.3678\Fluxus\Fluxus V7.exe—WinRAR.exe
User:
admin
Company:
Fluxteam
Integrity Level:
MEDIUM
Description:
Fluxus
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rar$exa568.3678\fluxus\fluxus v7.exe
1984"C:\Users\admin\AppData\Local\Temp\Rar$EXa568.3678\Fluxus\Fluxus V7.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa568.3678\Fluxus\Fluxus V7.exe
WinRAR.exe
User:
admin
Company:
Fluxteam
Integrity Level:
HIGH
Description:
Fluxus
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa568.3678\fluxus\fluxus v7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1036"C:\Program Files\windows defender\MSASCui.exe" -quickscanC:\Program Files\windows defender\MSASCui.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Defender User Interface
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows defender\msascui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\program files\windows defender\mpclient.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2984"C:\Users\admin\Desktop\New folder\Fluxus V7.exe" C:\Users\admin\Desktop\New folder\Fluxus V7.exe—Explorer.EXE
User:
admin
Company:
Fluxteam
Integrity Level:
MEDIUM
Description:
Fluxus
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\new folder\fluxus v7.exe
1228"C:\Users\admin\Desktop\New folder\Fluxus V7.exe" C:\Users\admin\Desktop\New folder\Fluxus V7.exe
Explorer.EXE
User:
admin
Company:
Fluxteam
Integrity Level:
HIGH
Description:
Fluxus
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\fluxus v7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2720"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Fluxus V7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
3656"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Fluxus V7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
24
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3364"C:\Users\admin\Desktop\New folder\Fluxus V7.exe" C:\Users\admin\Desktop\New folder\Fluxus V7.exe—Explorer.EXE
User:
admin
Company:
Fluxteam
Integrity Level:
MEDIUM
Description:
Fluxus
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\new folder\fluxus v7.exe
3872"C:\Users\admin\Desktop\New folder\Fluxus V7.exe" C:\Users\admin\Desktop\New folder\Fluxus V7.exe
Explorer.EXE
User:
admin
Company:
Fluxteam
Integrity Level:
HIGH
Description:
Fluxus
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\new folder\fluxus v7.exe
Total events
9 100
Read events
8 989
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
6
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
1228Fluxus V7.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:D371C9688BD41AB45C86183AF86658C0
SHA256:B2F8C08A0B3A6F459392E9F67EACEB781C80F551EE3CB953AC8A6F6987962284
568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa568.3678\Fluxus\Fluxus V7.exeexecutable
MD5:BA0DCC1BA9DC8859C158ED18832E4D88
SHA256:05AAB9A378FF04E4216402DF67BD64FB3C5ED553156EBE3F7187D9CC8032248E
1228Fluxus V7.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:B9F21D8DB36E88831E5352BB82C438B3
SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa568.9165\Fluxus\Fluxus V7.exeexecutable
MD5:BA0DCC1BA9DC8859C158ED18832E4D88
SHA256:05AAB9A378FF04E4216402DF67BD64FB3C5ED553156EBE3F7187D9CC8032248E
1228Fluxus V7.exeC:\Users\admin\AppData\Local\Temp\v4ocnlzx.uok.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
1228Fluxus V7.exeC:\Users\admin\AppData\Local\Temp\TarDD6D.tmpcat
MD5:E721613517543768F0DE47A6EEEE3475
SHA256:3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
1228Fluxus V7.exeC:\Users\admin\AppData\Local\Temp\CabDD6C.tmpcompressed
MD5:B9F21D8DB36E88831E5352BB82C438B3
SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
1228Fluxus V7.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:3D615F6C15D6D6D96D4157E6A8546215
SHA256:2BC1D8A0098050602BE5DB8DFA69BFB91BE065EC3262A05E8CEB58B457C93273
1228Fluxus V7.exeC:\Users\admin\AppData\Local\Temp\yrlubk0c.v0z.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1228
Fluxus V7.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7aaa2651bc82e402
GB
compressed
60.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1228
Fluxus V7.exe
145.239.192.146:443
fluxteam.xyz
OVH SAS
FR
suspicious
1228
Fluxus V7.exe
95.140.236.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
GB
malicious

DNS requests

Domain
IP
Reputation
fluxteam.xyz
  • 145.239.192.146
suspicious
ctldl.windowsupdate.com
  • 95.140.236.128
  • 178.79.242.0
whitelisted

Threats

PID
Process
Class
Message
1228
Fluxus V7.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Fluxus.zip