analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

svr.exe

Full analysis: https://app.any.run/tasks/f0563449-c447-453b-9599-da0f4bc129cb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: August 20, 2020, 08:25:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
artra
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

868157228B5BF0FAEAC5E31AA682E8A5

SHA1:

999D9033206D82A3B9FB4800B1DC4CC32B0DCEFD

SHA256:

D0B89F34DF70AC60517A54D4D75E3DF4C7EA9A84A1A4EC1EEA788D981C7D5BCF

SSDEEP:

192:vqa4lVLCl2s+83t34oPqXLVvvuJv5n0vB0lm1VWc+jT/E/2z6NUDh27nTzc4182f:vrl4eeVXcRn0R0cuT/iugIiIglhpzD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • rgdl.exe (PID: 2724)
    • Changes the autorun value in the registry

      • rgdl.exe (PID: 2724)
    • Connects to CnC server

      • svr.exe (PID: 280)
    • ARTRA was detected

      • svr.exe (PID: 280)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • svr.exe (PID: 280)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x2769
UninitializedDataSize: -
InitializedDataSize: 8192
CodeSize: 7680
LinkerVersion: 9
PEType: PE32
TimeStamp: 2020:06:30 11:14:49+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 30-Jun-2020 09:14:49
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 30-Jun-2020 09:14:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00001DEE
0x00001E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.20848
.rdata
0x00003000
0x00000F16
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.10982
.data
0x00004000
0x0000233C
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.09958
.rsrc
0x00007000
0x000002B0
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.19021
.reloc
0x00008000
0x000004F0
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.96585

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.0207
598
Latin 1 / Western European
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
MSVCP90.dll
MSVCR90.dll
SHELL32.dll
WS2_32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start #ARTRA svr.exe rgdl.exe

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Users\admin\AppData\Local\Temp\svr.exe" C:\Users\admin\AppData\Local\Temp\svr.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
2724"C:\Users\admin\AppData\Local\Temp\rgdl.exe" C:\Users\admin\AppData\Local\Temp\rgdl.exe
svr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
343
Read events
338
Write events
5
Delete events
0

Modification events

(PID) Process:(280) svr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(280) svr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2724) rgdl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:audiodq
Value:
C:\intel\logs\audiodq.exe
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
280svr.exeC:\Users\admin\AppData\Local\Temp\rgdl
MD5:
SHA256:
280svr.exeC:\Users\admin\AppData\Local\Temp\rgdl.exeexecutable
MD5:99DD93A189FD734FB00246A7A37014D3
SHA256:B2D7336F382A22D5FB6899FC2BD87C7CD401451ECD6AF8CCB9EA7DBBE62FC1B7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
24
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
280
svr.exe
GET
162.0.229.203:80
http://162.0.229.203/RguhsT/RguhsT/rgdl
CA
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=efgh
CA
text
28 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=abcd
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
280
svr.exe
GET
200
162.0.229.203:80
http://162.0.229.203///RguhsT/accept.php?a=User-PC&b=USER-PC&c=Windows%207%20Professional&d=adminadmin90059c37-1320-41a4-b58d-2b75a9850d2f1565536040965860&e=
CA
text
9 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
280
svr.exe
162.0.229.203:80
AirComPlus Inc.
CA
malicious
162.0.229.203:80
AirComPlus Inc.
CA
malicious

DNS requests

Domain
IP
Reputation
203.229.0.162.in-addr.arpa
unknown

Threats

PID
Process
Class
Message
280
svr.exe
A Network Trojan was detected
ET TROJAN ArtraDownloader/TeleRAT Checkin
280
svr.exe
Misc activity
ET INFO Packed Executable Download
280
svr.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
280
svr.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
280
svr.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
280
svr.exe
A Network Trojan was detected
ET TROJAN ArtraDownloader/TeleRAT Checkin
280
svr.exe
A Network Trojan was detected
ET TROJAN ArtraDownloader/TeleRAT Checkin
280
svr.exe
A Network Trojan was detected
ET TROJAN ArtraDownloader/TeleRAT Checkin
280
svr.exe
A Network Trojan was detected
ET TROJAN ArtraDownloader/TeleRAT Checkin
280
svr.exe
A Network Trojan was detected
ET TROJAN ArtraDownloader/TeleRAT Checkin
No debug info