analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Disney+ Checker By G-KLIT.rar

Full analysis: https://app.any.run/tasks/5876b25a-e2f2-4414-a923-efa81ce9ad9e
Verdict: Malicious activity
Analysis date: November 16, 2019, 12:50:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

83DFC5FEA42F82C0C1A51A7BE8E6FB35

SHA1:

8D4D21A94F6EF2F7FF9BC105875F86ECB548CCC2

SHA256:

CEB47DC2962F1FEE9AA971BCDEF2F5AF5F6B570372371279E8CB5830F24E6BA8

SSDEEP:

196608:Th7DNutBY1p3hYSk0nN7FkGOEH1SZ+3iGnq/sefsB/:T5hutgHkGUTwRte2/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Disney+ Checker By G-KLIT.exe (PID: 3112)
      • Disney+ Checker By G-KLIT.exe (PID: 928)
      • Disney+ Checker By G-KLIT.exe (PID: 1584)

  • SUSPICIOUS

    • Application launched itself

      • Disney+ Checker By G-KLIT.exe (PID: 4064)
      • Disney+ Checker By G-KLIT.exe (PID: 3112)

    • Executable content was dropped or overwritten

      • Disney+ Checker By G-KLIT.exe (PID: 4064)

    • Reads Internet Cache Settings

      • Disney+ Checker By G-KLIT.exe (PID: 3112)

    • Loads Python modules

      • Disney+ Checker By G-KLIT.exe (PID: 3112)
      • Disney+ Checker By G-KLIT.exe (PID: 1584)
      • Disney+ Checker By G-KLIT.exe (PID: 928)

    • Starts CMD.EXE for commands execution

      • Disney+ Checker By G-KLIT.exe (PID: 3112)

  • INFO

    • Manual execution by user

      • Disney+ Checker By G-KLIT.exe (PID: 4064)

    • Dropped object may contain Bitcoin addresses

      • Disney+ Checker By G-KLIT.exe (PID: 4064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs disney+ checker by g-klit.exe disney+ checker by g-klit.exe no specs cmd.exe no specs disney+ checker by g-klit.exe no specs disney+ checker by g-klit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2872"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Disney+ Checker By G-KLIT.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
4064"C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe" C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
3112"C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe" C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe—Disney+ Checker By G-KLIT.exe
User:
admin
Integrity Level:
MEDIUM
3864C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exe—Disney+ Checker By G-KLIT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1584"C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3112" "pipe_handle=1156"C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe—Disney+ Checker By G-KLIT.exe
User:
admin
Integrity Level:
MEDIUM
928"C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe" "--multiprocessing-fork" "parent_pid=3112" "pipe_handle=1708"C:\Users\admin\Desktop\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe—Disney+ Checker By G-KLIT.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 407
Read events
1 324
Write events
0
Delete events
0

Modification events

No data
Executable files
19
Suspicious files
1
Text files
912
Unknown types
2

Dropped files

PID
Process
Filename
Type
2872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2872.14405\Disney+ Checker By G-KLIT\Disney+ Checker By G-KLIT.exe —
MD5:—
SHA256:—
2872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2872.14405\Disney+ Checker By G-KLIT\level23hacktools.url —
MD5:—
SHA256:—
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\Disney+.exe.manifestxml
MD5:9F601303F9A5069E0DF4338C2DF700A0
SHA256:8D292A2477AB35B59A519F8B7DFD1BB8DACEC5806193B0A7F5A704D106DCB315
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\_hashlib.pydexecutable
MD5:E84E1BA269371E439C2D52024ACA6535
SHA256:2FCB297733E6080480AC24CF073FF5E239FB02A1CE9694313C5047F9C58D781B
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\_queue.pydexecutable
MD5:8807DC228BB761439DC6525A2966E27E
SHA256:B7ED6DFB6882E8EC4267D9F80CD5B1DC0A43519382FCB72AB5E74C47875C209D
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\VCRUNTIME140.dllexecutable
MD5:AE96651CFBD18991D186A029CBECB30C
SHA256:1B372F064EACB455A0351863706E6326CA31B08E779A70DE5DE986B5BE8069A1
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\tcl86t.dllexecutable
MD5:30195AA599DD12AC2567DE0815ADE5E6
SHA256:E79443E9413BA9A4442CA7DB8EE91A920E61AC2FB55BE10A6AB9A9C81F646DBB
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\_socket.pydexecutable
MD5:A4BD8E0C0597A22C3F0601FE798668AA
SHA256:96B0A3CFC16E215F0EF5D1E206F0137B4255005052720E91A58BC98CDE8C898E
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\_multiprocessing.pydexecutable
MD5:42A5EC2E2EC56DCA18E7221C1858A7DE
SHA256:C22D475ADA5E8D7EA37124892B4A3D8315E6E66594A2237DCB0BBDF160B053DE
4064Disney+ Checker By G-KLIT.exeC:\Users\admin\AppData\Local\Temp\_MEI40642\_tkinter.pydexecutable
MD5:E46970E8EB0061DF01347A3723140E77
SHA256:71C4545CEE713F26CF2F910A08340DD519C4713B8416479F74B0B9E2683C85D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Disney+ Checker By G-KLIT.rar