File name:

YouTubeSpamer (6).rar

Full analysis: https://app.any.run/tasks/076fa19a-b6cf-4f82-abd3-a0f98ee9b6fc
Verdict: Malicious activity
Analysis date: February 17, 2020, 15:10:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

FCC85A67D39CB1207F04514A208E18A5

SHA1:

7FEDE22FA52A3AEABB703937AAA1502E74F4D2D5

SHA256:

C846DC5262AC67CFEF11DB41C6105F1B6B076138BCACDF78BD6AD25617D0909C

SSDEEP:

393216:76EhpdqxloSSM5jT8lCfAsavKF+BTThKglD1Bb1szC+:WEhGxlnSojolCZ2TThKglfhm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • explorer.exe (PID: 372)
      • SearchProtocolHost.exe (PID: 3548)
      • YouTube Spamer .exe (PID: 2880)
      • FastExecuteScript.exe (PID: 2240)
      • SearchProtocolHost.exe (PID: 1556)
      • Worker.exe (PID: 2068)
      • Worker.exe (PID: 3088)
      • Worker.exe (PID: 3276)
      • Worker.exe (PID: 2128)

    • Application was dropped or rewritten from another process

      • YouTube Spamer .exe (PID: 2880)
      • FastExecuteScript.exe (PID: 2240)
      • Worker.exe (PID: 3276)
      • Worker.exe (PID: 2068)
      • Worker.exe (PID: 3088)
      • Worker.exe (PID: 2128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3828)
      • YouTube Spamer .exe (PID: 2880)

    • Creates files in the user directory

      • explorer.exe (PID: 372)

    • Application launched itself

      • Worker.exe (PID: 2068)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3828)
      • YouTube Spamer .exe (PID: 2880)

    • Reads settings of System Certificates

      • YouTube Spamer .exe (PID: 2880)

    • Reads the hosts file

      • Worker.exe (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
10
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs explorer.exe no specs youtube spamer .exe fastexecutescript.exe no specs searchprotocolhost.exe no specs worker.exe worker.exe no specs worker.exe no specs worker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1556"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2068.\Worker\Worker.exe ru --UseFlash 0 --ProxyTunneling 1 --SkipFrames 1 --unique-process-id=fCrhOolt --Profile prof/ev1XEoFN --Extensions "" rkkxevcoqo none 2240C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe
FastExecuteScript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\worker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libiconv.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libcef.dll
2128"C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --log-file="C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\debug.log" --log-severity=disable --lang=en-US --parent-process-id=2068 --unique-process-id=fCrhOolt --gpu-preferences=KAAAAAAAAACAA4BAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\debug.log" --log-severity=disable --lang=en-US --parent-process-id=2068 --unique-process-id=fCrhOolt --service-request-channel-token=13918685148648314337 --mojo-platform-channel-handle=2028 /prefetch:2C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe—Worker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\worker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libiconv.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libcef.dll
2240appslocal\e3b0c442\SID9957e8f4\engine\FastExecuteScript.exe C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\FastExecuteScript.exe—YouTube Spamer .exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\fastexecutescript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\engine.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\libxml2.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2880"C:\Users\admin\Desktop\YouTubeSpamer\YouTube Spamer .exe" C:\Users\admin\Desktop\YouTubeSpamer\YouTube Spamer .exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\youtubespamer\youtube spamer .exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\desktop\youtubespamer\qt5widgets.dll
3088"C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe" --type=renderer --no-sandbox --disable-gpu-compositing --service-pipe-token=7558175544363531900 --lang=en-US --log-file="C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\debug.log" --log-severity=disable --parent-process-id=2068 --unique-process-id=fCrhOolt --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7558175544363531900 --renderer-client-id=2 --mojo-platform-channel-handle=1248 /prefetch:1C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe—Worker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\worker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libiconv.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libcef.dll
3276"C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe" --type=gpu-process --no-sandbox --log-file="C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\debug.log" --log-severity=disable --lang=en-US --parent-process-id=2068 --unique-process-id=fCrhOolt --gpu-preferences=KAAAAAAAAACAA4BAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\debug.log" --log-severity=disable --lang=en-US --parent-process-id=2068 --unique-process-id=fCrhOolt --service-request-channel-token=13677222192036164990 --mojo-platform-channel-handle=1216 /prefetch:2C:\Users\admin\Desktop\YouTubeSpamer\appslocal\e3b0c442\SID9957e8f4\engine\Worker\Worker.exe—Worker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\worker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libiconv.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\desktop\youtubespamer\appslocal\e3b0c442\sid9957e8f4\engine\worker\libcef.dll
3548"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3828"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\YouTubeSpamer (6).rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
4 662
Read events
4 450
Write events
210
Delete events
2

Modification events

(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3828) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\YouTubeSpamer (6).rar
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3828) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
Executable files
184
Suspicious files
43
Text files
814
Unknown types
232

Dropped files

PID
Process
Filename
Type
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\bearer\qgenericbearer.dllexecutable
MD5:DBA35D31C2B6797C8A4D38AE27D68E6E
SHA256:086D6BA24F34A269856C4E0159A860657590D05AABB2530247E685543B34C52F
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\imageformats\qgif.dllexecutable
MD5:C108D79D7C85786F33F85041445F519F
SHA256:D5459A707922DD2BF50114CC6718965173EE5B0F67DEB05E933556150CFDD9D1
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\bearer\qnativewifibearer.dllexecutable
MD5:A8BCA50F7966F578B127D1E24FC2430F
SHA256:C209D080A62F5E67DDC01A3AE6B4F9B103FAF4104C93B7DBB5FFA8D548BF0CD5
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\iconengines\qsvgicon.dllexecutable
MD5:90BB882A4B5E3427F328259530AA1B3B
SHA256:B2B420AA1805D8B5DC15CCB74DD664D10BD6BA422743F5043A557A701C8A1778
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\imageformats\qicns.dllexecutable
MD5:52C6978203CA20BEEAD6E8872E80D39F
SHA256:E665F3519309BAE42E0E62F459ECC511701DDDDF94599EBFD213D0A71775C462
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\imageformats\qtga.dllexecutable
MD5:D0604A5F13B32A08D5FA5BD887F869A6
SHA256:2B6444D2A8146A066109CA19618CEEE98444127A5B422C14635AB837887E55BF
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\D3Dcompiler_47.dllexecutable
MD5:E6945CCEEFC0A122833576A5FC5F88F4
SHA256:FB8D0049F5DD5858C3B1DA4836FB4B77D97B72D67AD951EDB48F1A3E087EC2B1
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\imageformats\qdds.dllexecutable
MD5:3FDB8D8407CCCFAA0290036CC0107906
SHA256:3A71A119EEABCE867B57636070ADEB057443A6EC262BE1360F344CB3905545DB
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\data\project.xmlxml
MD5:EC83791BEA128F390C57B15823213641
SHA256:9957E8F4587E83BDCC6B84715E9CFECBA036FEA0055A4AB19105C2DA4992BF22
3828WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3828.28937\YouTubeSpamer\imageformats\qico.dllexecutable
MD5:EDDF7FB99F2FCAEA6FE4FD34B8FD5D39
SHA256:9D942215A80A25E10EE1A2BB3D7C76003642D3A2D704C38C822E6A2CA82227BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2880
YouTube Spamer .exe
146.185.145.186:443
bablosoft.com
Digital Ocean, Inc.
NL
suspicious
2068
Worker.exe
172.217.18.13:443
accounts.google.com
Google Inc.
US
whitelisted
2068
Worker.exe
216.58.207.67:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2068
Worker.exe
172.217.23.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2068
Worker.exe
172.217.22.37:443
mail.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
bablosoft.com
  • 146.185.145.186
whitelisted
accounts.google.com
  • 172.217.18.13
shared
ssl.gstatic.com
  • 216.58.207.67
whitelisted
fonts.gstatic.com
  • 172.217.23.99
whitelisted
mail.google.com
  • 172.217.22.37
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
YouTubeSpamer (6).rar