File name:

NovaLite v3.7 Cracked.rar

Full analysis: https://app.any.run/tasks/faf98b0d-3831-45e5-b3ff-b90cb8c8fe3c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 19, 2024, 11:32:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

3915294FBB14B68F7B91B7DA4CDA6109

SHA1:

481A05F9B28FAC2D8DDF00A7AD188E5221E7CF89

SHA256:

D2B29D6EA42C34C05F960C5C03C53C4813C075B9A3F6239F4622159CF186CB8F

SSDEEP:

98304:dbwogh+PcV12wwq0my4aay/B3PqZSoCxQZATjKc4ERbBYutfSN2U5xHXhgopIdhm:7PnWMTlv6QfWEg/FPCwF9tTtx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • NovaLite 3.7 LO.exe (PID: 1560)
      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)

    • Changes the autorun value in the registry

      • ohio.exe (PID: 2480)

    • Steals credentials

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Actions looks like stealing of personal data

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Uses NirSoft utilities to collect credentials

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Steals credentials from Web Browsers

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NovaLite 3.7 LO.exe (PID: 1560)
      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)

    • Starts itself from another location

      • Server.exe (PID: 2376)

    • Application launched itself

      • NovaLite 3.7 LO.exe (PID: 1560)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • NovaLite 3.7 LO.exe (PID: 1560)
      • ohio.exe (PID: 2480)

    • Start notepad (likely ransomware note)

      • ohio.exe (PID: 2480)

    • Reads the Internet Settings

      • ohio.exe (PID: 2480)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • ohio.exe (PID: 2480)
      • NovaLite 3.7 LO.exe (PID: 1560)

    • Loads DLL from Mozilla Firefox

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3672)

    • Drops a (possible) Coronavirus decoy

      • WinRAR.exe (PID: 3672)

    • Manual execution by a user

      • Server.exe (PID: 2376)
      • notepad.exe (PID: 3428)
      • NovaPatcher.exe (PID: 2148)
      • NovaPatcher.exe (PID: 2256)

    • Checks supported languages

      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)
      • NovaLite 3.7 LO.exe (PID: 1560)
      • ~A00359.exe (PID: 1072)
      • ~A00359.exe (PID: 908)
      • NovaPatcher.exe (PID: 2148)

    • Reads the computer name

      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)
      • ~A00359.exe (PID: 1072)
      • ~A00359.exe (PID: 908)

    • Creates files or folders in the user directory

      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)

    • Checks proxy server information

      • ohio.exe (PID: 2480)

    • Create files in a temporary directory

      • NovaLite 3.7 LO.exe (PID: 1560)
      • ohio.exe (PID: 2480)
      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • NirSoft software is detected

      • ~A00359.exe (PID: 1072)
      • ~A00359.exe (PID: 908)

    • Reads CPU info

      • ohio.exe (PID: 2480)

    • Reads the machine GUID from the registry

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 3197
UncompressedSize: 7005
OperatingSystem: Win32
ModifyDate: 2006:07:28 07:32:44
PackingMethod: Normal
ArchivedFileName: NovaLite 3.7 Cracked By The Old Warrior\Eula.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
17
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe notepad.exe no specs novapatcher.exe no specs novapatcher.exe novalite 3.7 lo.exe novalite 3.7 lo.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs server.exe ohio.exe notepad.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs ~a00359.exe ~a00359.exe

Process information

PID
CMD
Path
Indicators
Parent process
908C:\Users\admin\AppData\Local\Temp\~A00359.exe /scomma "C:\Users\admin\AppData\Local\Temp\~A00359.dcu"C:\Users\admin\AppData\Local\Temp\~A00359.exe
ohio.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
WebBrowserPassView
Exit code:
0
Version:
1.30
Modules
Images
c:\users\admin\appdata\local\temp\~a00359.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
920netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="C:\Users\admin\AppData\Roaming\ohio.exe"C:\Windows\System32\netsh.exe—ohio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1072C:\Users\admin\AppData\Local\Temp\~A00359.exe /scomma "C:\Users\admin\AppData\Local\Temp\~A00359.dcu"C:\Users\admin\AppData\Local\Temp\~A00359.exe
ohio.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
WebBrowserPassView
Exit code:
0
Version:
1.30
Modules
Images
c:\users\admin\appdata\local\temp\~a00359.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1560"NovaLite 3.7 LO.exe"C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaLite 3.7 LO.exe
NovaPatcher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\novalite 3.7 cracked by the old warrior\novalite 3.7 lo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1768netsh advfirewall firewall delete rule profile=any name=Win2y2C:\Windows\System32\netsh.exe—NovaLite 3.7 LO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1900netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaLite 3.7 LO.exe"C:\Windows\System32\netsh.exe—NovaLite 3.7 LO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2068netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Users\admin\AppData\Roaming\ohio.exe"C:\Windows\System32\netsh.exe—ohio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2108netsh advfirewall firewall delete rule profile=any name=Win2y2C:\Windows\System32\netsh.exe—ohio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2148"C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe" C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe
explorer.exe
User:
admin
Company:
The Old Warrior
Integrity Level:
HIGH
Description:
NovaLite's Patcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\novalite 3.7 cracked by the old warrior\novapatcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2256"C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe" C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe—explorer.exe
User:
admin
Company:
The Old Warrior
Integrity Level:
MEDIUM
Description:
NovaLite's Patcher
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\novalite 3.7 cracked by the old warrior\novapatcher.exe
c:\windows\system32\ntdll.dll
Total events
9 549
Read events
9 222
Write events
323
Delete events
4

Modification events

(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\NovaLite v3.7 Cracked.rar
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
9
Suspicious files
134
Text files
19
Unknown types
8

Dropped files

PID
Process
Filename
Type
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Eula.txttext
MD5:D22FF2CC70FA2EEC94AAA6C6F49E6EB0
SHA256:6FF22C87FB5EE105B33346DBB3F13F3049A292981E9DF1EB8591E858CCF4D782
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\GeoIP.datbinary
MD5:D62B149E6770F4DB3E3F482BFFB654A9
SHA256:1058076108334E02EAABAE38D3451267071A215E34E7580430CE79590E7156BC
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Builder.exeexecutable
MD5:9F71CDE218F803966B0E2B00052B2B7B
SHA256:3F99BDC230BCFD65C98F9E30F95F378F34896E952EB10C552B7CED6F8D1C94E7
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\NovaLite 3.7 LO.exeexecutable
MD5:31E9FD49C13E5542449F9DF528F03D0C
SHA256:C8BAB2BF167FB5132AD1F1CFD5CC9FCD7155DE9403B395D42B75ED62403DAE5C
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\builder.iniini
MD5:3A4B3B1B24A2B67D4BE8A6B0C01C5A40
SHA256:43E7C85543F17FC7F3DB059BD71E349D5D3A0CFA52F76B96D52383565FA7DDDC
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\border.gifimage
MD5:FFE5FF3AEB2700E1886528AF4214697E
SHA256:E303C2E17466214D7D7B6706525EB762ACAE4AEF6779C82CD69375FB8FCBDD7B
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Cosmo-COSMO2.sknbas
MD5:E7936A1D2C6A0F19F82BB0225CB3A660
SHA256:6F4296AD7C28D0F04DA29167207704C260561475D34EFFBDB8CB5417799C1244
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Cosmo-COSMO.sknbinary
MD5:9D85DA538FA173B6445CB58CEFFAD833
SHA256:BEB669FC34676516477D0F46DD7D9B540523385A4991924734B3C78B6C926987
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\titlebutton.gifimage
MD5:54B5C75ECB74F836E74140876FFDCA43
SHA256:87778FE342E40C21D3626A87652C73D97B084B2ACAA8C839CF5369355156D42D
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\rect.gifimage
MD5:369ECE5E1492ABA56E9292FC93BC96ED
SHA256:650336E83C2513BCA68E9D4A38F4A156FD032F15228100E02F22C35D39D6B101
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NovaLite v3.7 Cracked.rar