File name:

NovaLite v3.7 Cracked.rar

Full analysis: https://app.any.run/tasks/faf98b0d-3831-45e5-b3ff-b90cb8c8fe3c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 19, 2024, 11:32:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

3915294FBB14B68F7B91B7DA4CDA6109

SHA1:

481A05F9B28FAC2D8DDF00A7AD188E5221E7CF89

SHA256:

D2B29D6EA42C34C05F960C5C03C53C4813C075B9A3F6239F4622159CF186CB8F

SSDEEP:

98304:dbwogh+PcV12wwq0my4aay/B3PqZSoCxQZATjKc4ERbBYutfSN2U5xHXhgopIdhm:7PnWMTlv6QfWEg/FPCwF9tTtx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Server.exe (PID: 2376)
      • NovaLite 3.7 LO.exe (PID: 1560)
      • ohio.exe (PID: 2480)

    • Changes the autorun value in the registry

      • ohio.exe (PID: 2480)

    • Uses NirSoft utilities to collect credentials

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Actions looks like stealing of personal data

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Steals credentials from Web Browsers

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Steals credentials

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

  • SUSPICIOUS

    • Application launched itself

      • NovaLite 3.7 LO.exe (PID: 1560)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • NovaLite 3.7 LO.exe (PID: 1560)
      • ohio.exe (PID: 2480)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • NovaLite 3.7 LO.exe (PID: 1560)
      • ohio.exe (PID: 2480)

    • Starts itself from another location

      • Server.exe (PID: 2376)

    • Executable content was dropped or overwritten

      • NovaLite 3.7 LO.exe (PID: 1560)
      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)

    • Start notepad (likely ransomware note)

      • ohio.exe (PID: 2480)

    • Reads the Internet Settings

      • ohio.exe (PID: 2480)

    • Loads DLL from Mozilla Firefox

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

  • INFO

    • Manual execution by a user

      • notepad.exe (PID: 3428)
      • NovaPatcher.exe (PID: 2148)
      • NovaPatcher.exe (PID: 2256)
      • Server.exe (PID: 2376)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3672)

    • Drops a (possible) Coronavirus decoy

      • WinRAR.exe (PID: 3672)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3672)

    • Checks supported languages

      • NovaLite 3.7 LO.exe (PID: 1560)
      • NovaPatcher.exe (PID: 2148)
      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)
      • ~A00359.exe (PID: 1072)
      • ~A00359.exe (PID: 908)

    • Reads the computer name

      • Server.exe (PID: 2376)
      • ohio.exe (PID: 2480)
      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Reads CPU info

      • ohio.exe (PID: 2480)

    • Create files in a temporary directory

      • ohio.exe (PID: 2480)
      • NovaLite 3.7 LO.exe (PID: 1560)
      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)

    • Checks proxy server information

      • ohio.exe (PID: 2480)

    • Creates files or folders in the user directory

      • ohio.exe (PID: 2480)
      • Server.exe (PID: 2376)

    • NirSoft software is detected

      • ~A00359.exe (PID: 1072)
      • ~A00359.exe (PID: 908)

    • Reads the machine GUID from the registry

      • ~A00359.exe (PID: 908)
      • ~A00359.exe (PID: 1072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 3197
UncompressedSize: 7005
OperatingSystem: Win32
ModifyDate: 2006:07:28 07:32:44
PackingMethod: Normal
ArchivedFileName: NovaLite 3.7 Cracked By The Old Warrior\Eula.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
17
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe notepad.exe no specs novapatcher.exe no specs novapatcher.exe novalite 3.7 lo.exe novalite 3.7 lo.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs server.exe ohio.exe notepad.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs ~a00359.exe ~a00359.exe

Process information

PID
CMD
Path
Indicators
Parent process
908C:\Users\admin\AppData\Local\Temp\~A00359.exe /scomma "C:\Users\admin\AppData\Local\Temp\~A00359.dcu"C:\Users\admin\AppData\Local\Temp\~A00359.exe
ohio.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
WebBrowserPassView
Exit code:
0
Version:
1.30
Modules
Images
c:\users\admin\appdata\local\temp\~a00359.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
920netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="C:\Users\admin\AppData\Roaming\ohio.exe"C:\Windows\System32\netsh.exe—ohio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1072C:\Users\admin\AppData\Local\Temp\~A00359.exe /scomma "C:\Users\admin\AppData\Local\Temp\~A00359.dcu"C:\Users\admin\AppData\Local\Temp\~A00359.exe
ohio.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
WebBrowserPassView
Exit code:
0
Version:
1.30
Modules
Images
c:\users\admin\appdata\local\temp\~a00359.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1560"NovaLite 3.7 LO.exe"C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaLite 3.7 LO.exe
NovaPatcher.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\novalite 3.7 cracked by the old warrior\novalite 3.7 lo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1768netsh advfirewall firewall delete rule profile=any name=Win2y2C:\Windows\System32\netsh.exe—NovaLite 3.7 LO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1900netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaLite 3.7 LO.exe"C:\Windows\System32\netsh.exe—NovaLite 3.7 LO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2068netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Users\admin\AppData\Roaming\ohio.exe"C:\Windows\System32\netsh.exe—ohio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2108netsh advfirewall firewall delete rule profile=any name=Win2y2C:\Windows\System32\netsh.exe—ohio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2148"C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe" C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe
explorer.exe
User:
admin
Company:
The Old Warrior
Integrity Level:
HIGH
Description:
NovaLite's Patcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\novalite 3.7 cracked by the old warrior\novapatcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2256"C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe" C:\Users\admin\Desktop\NovaLite 3.7 Cracked By The Old Warrior\NovaPatcher.exe—explorer.exe
User:
admin
Company:
The Old Warrior
Integrity Level:
MEDIUM
Description:
NovaLite's Patcher
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\novalite 3.7 cracked by the old warrior\novapatcher.exe
c:\windows\system32\ntdll.dll
Total events
9 549
Read events
9 222
Write events
323
Delete events
4

Modification events

(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\NovaLite v3.7 Cracked.rar
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
9
Suspicious files
134
Text files
19
Unknown types
8

Dropped files

PID
Process
Filename
Type
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\GeoIP.datbinary
MD5:D62B149E6770F4DB3E3F482BFFB654A9
SHA256:1058076108334E02EAABAE38D3451267071A215E34E7580430CE79590E7156BC
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\border.gifimage
MD5:FFE5FF3AEB2700E1886528AF4214697E
SHA256:E303C2E17466214D7D7B6706525EB762ACAE4AEF6779C82CD69375FB8FCBDD7B
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\titlebutton.gifimage
MD5:54B5C75ECB74F836E74140876FFDCA43
SHA256:87778FE342E40C21D3626A87652C73D97B084B2ACAA8C839CF5369355156D42D
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\color.gifimage
MD5:435F91D70408A7BEFDE97C2B5DB01E9B
SHA256:0D4A1A48EA91F29DE37E3156E2C785EF0B3F94D259F1D7CA392721725C2A861C
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\color-change.gifimage
MD5:7C0D160CAD1204A472CBF826E5A1986F
SHA256:A2C828C90FA501ACC6D3DDD32B9DE26CFAD6E423671D0785D0ABCA739652D314
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\menuitem.gifimage
MD5:1B88B1ED316E842F8B97C558C388C0D6
SHA256:A106DB9BD9128869E0B04CB0898FCB0E6934B2890B07FCDEFC74357C2E64C977
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Read me.txttext
MD5:A7713863B3AEB95516584D2DB31C2C5D
SHA256:6ED2E334B34EF847F819D9F7B899498EF959831D15AF40F3EADEF24234C11C15
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\rect.gifimage
MD5:369ECE5E1492ABA56E9292FC93BC96ED
SHA256:650336E83C2513BCA68E9D4A38F4A156FD032F15228100E02F22C35D39D6B101
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Saxon-SAXON.sknbinary
MD5:A7BA4575C4558FF2C62574AC8D6523C4
SHA256:FD5F7333112B456F6CD0BB3E88EDD77BFFCE60FEFCCC93BD8DE64D36EDAEFC23
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3672.36989\NovaLite 3.7 Cracked By The Old Warrior\Skin-builder\Help\tutorial.htmhtml
MD5:E8AAEE66E0D954E3A14760429E16C549
SHA256:C44E3E991CA10143CFAEF8829F6CF19F546ED4D1B42075D771CA8EA0D960C26E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NovaLite v3.7 Cracked.rar