analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Netflix Checker v1 by Sh4lltear.exe

Full analysis: https://app.any.run/tasks/ff94e965-dabe-4b39-a713-e228adba1ac7
Verdict: Malicious activity
Threats:

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

Analysis date: July 13, 2020, 02:23:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
orcus
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9DF9AE6FBE6AB5BF973808F564AA0D75

SHA1:

C2CFA1547FE16AC813E1061154413595F4D11F57

SHA256:

C79D324DAC4031A08F8BE97468230B729A8E3D546643E17E59F05176B9AE7325

SSDEEP:

196608:NO+07jpU722lVLWjirYXA2DkYDdXLaylvbi3gmu:Nou72oVHYq+LHbWFu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • nf2.exe (PID: 2944)
      • NC.exe (PID: 3960)
      • winlog.exe (PID: 1784)
    • Loads dropped or rewritten executable

      • NC.exe (PID: 3960)
    • ORCUS was detected

      • winlog.exe (PID: 1784)
      • nf2.exe (PID: 2944)
    • Changes the autorun value in the registry

      • winlog.exe (PID: 1784)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Netflix Checker v1 by Sh4lltear.exe (PID: 3868)
      • nf2.exe (PID: 2944)
    • Starts itself from another location

      • nf2.exe (PID: 2944)
    • Creates files in the program directory

      • nf2.exe (PID: 2944)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:04:27 22:03:27+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 190976
InitializedDataSize: 250880
UninitializedDataSize: -
EntryPoint: 0x1d759
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Apr-2019 20:03:27
Detected languages:
  • English - United States
  • Process Default Language
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 27-Apr-2019 20:03:27
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002E854
0x0002EA00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.69231
.rdata
0x00030000
0x00009A9C
0x00009C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13286
.data
0x0003A000
0x000213D0
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.25381
.gfids
0x0005C000
0x000000E8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.11154
.rsrc
0x0005D000
0x000308CC
0x00030A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.72849
.reloc
0x0008E000
0x00001FCC
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.64554

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.26192
1875
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.63597
67624
Latin 1 / Western European
Process Default Language
RT_ICON
3
4.98412
38056
Latin 1 / Western European
Process Default Language
RT_ICON
4
4.97447
21640
Latin 1 / Western European
Process Default Language
RT_ICON
5
4.912
16936
Latin 1 / Western European
Process Default Language
RT_ICON
6
5.21393
9640
Latin 1 / Western European
Process Default Language
RT_ICON
7
3.1586
482
Latin 1 / Western European
English - United States
RT_STRING
8
3.11685
460
Latin 1 / Western European
English - United States
RT_STRING
9
3.15447
494
Latin 1 / Western European
English - United States
RT_STRING
10
2.99727
326
Latin 1 / Western European
English - United States
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start netflix checker v1 by sh4lltear.exe no specs netflix checker v1 by sh4lltear.exe #ORCUS nf2.exe nc.exe no specs #ORCUS winlog.exe

Process information

PID
CMD
Path
Indicators
Parent process
2584"C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe" C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3868"C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe" C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2944"C:\Users\admin\AppData\Local\Temp\nf2.exe" C:\Users\admin\AppData\Local\Temp\nf2.exe
Netflix Checker v1 by Sh4lltear.exe
User:
admin
Company:
Bloodfallen
Integrity Level:
HIGH
Description:
Netflix Checker v1 | Sh4lltear
Exit code:
0
Version:
1.0.0.0
3960"C:\Users\admin\AppData\Local\Temp\NC.exe" C:\Users\admin\AppData\Local\Temp\NC.exeNetflix Checker v1 by Sh4lltear.exe
User:
admin
Company:
Bloodfallen
Integrity Level:
HIGH
Description:
Netflix Checker v1 | Sh4lltear
Version:
1.0.0.0
1784"C:\Program Files\Microsoft\winlog.exe" C:\Program Files\Microsoft\winlog.exe
nf2.exe
User:
admin
Company:
Bloodfallen
Integrity Level:
HIGH
Description:
Netflix Checker v1 | Sh4lltear
Version:
1.0.0.0
Total events
408
Read events
399
Write events
9
Delete events
0

Modification events

(PID) Process:(3868) Netflix Checker v1 by Sh4lltear.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3868) Netflix Checker v1 by Sh4lltear.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2944) nf2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2944) nf2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1784) winlog.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:WinLOGON
Value:
"C:\Program Files\Microsoft\winlog.exe"
Executable files
8
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2944nf2.exeC:\Program Files\Microsoft\winlog.exeexecutable
MD5:DF7E5FFD3A0D99F86230B477473FEB97
SHA256:BF1518F8D72919E209A45E465809653C5DAF9315531896F3CAD93C6D623F2410
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\nf2.exeexecutable
MD5:DF7E5FFD3A0D99F86230B477473FEB97
SHA256:BF1518F8D72919E209A45E465809653C5DAF9315531896F3CAD93C6D623F2410
2944nf2.exeC:\Program Files\Microsoft\winlog.exe.configxml
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98
SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\Leaf.xNet.dllexecutable
MD5:AABE4F7E8F947171AB334B5CC0A76F7C
SHA256:70670C404F998B71FE5ABFB3AA58FCB5302D3940E805AC8927F79B625AFAB4A8
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\xNet.dllexecutable
MD5:AC1DCEDDBC66A1AB7915AC9931F0CFEC
SHA256:CC949931EF9533ADCED83F3D58862E9732E5DB7AD17B5FD4CB9D209A99EDB592
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\NC.exeexecutable
MD5:3C48B36295EB8EBB9E468BC273EBCE75
SHA256:AD32D183B6173B7D11E87F80E41708299976C216F1312230A79903308EF58AB6
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear32.dllexecutable
MD5:7D723A8EB4D7E494EA488C13510B97B6
SHA256:B695AC865A5DF23E45FF991BF26B71E4F879C89A1A6FDE0BA92F31904BEACA5C
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\Guna.UI.dllexecutable
MD5:6D6A1F28978D42AD2F0A8F278EAAC966
SHA256:FB23FA4FCA8F28BEBE7B7E39593A211CD3C3405DE5F948EC520E859B1BCAF91E
3868Netflix Checker v1 by Sh4lltear.exeC:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear64.dllexecutable
MD5:08DFAD3A22E42E17A3BF8F4EE43A67F5
SHA256:B3710DE17D2C2F84DEF83C8F3093DF0DBE1664F34AB4A3ADB72F1085E71C773C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info