analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

CRYPTOR 404.rar

Full analysis: https://app.any.run/tasks/310ae7a1-5d7e-42cb-bb54-c9dcb9f2c5d3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 14:29:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1EE39500B39121BA5C8D07D28D3E0C21

SHA1:

3B38AD23FDBA0BBC8FD90D9DA98E47F6D04B102A

SHA256:

D2F0B1C28437E61510E777373032BC0D1B4E582AF708DBDE2B4E1D8B668E96C9

SSDEEP:

196608:0bsQFj9HQ9wV/So6VdO+Wb/wj9p1x4AhMmxPR:04QtemV/jYCbA9PdddR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • avast.tmp (PID: 2340)
      • 123.tmp (PID: 2584)

    • Stealing of credential data

      • 123.tmp (PID: 2584)

    • Actions looks like stealing of personal data

      • 123.tmp (PID: 2584)

    • Connects to CnC server

      • 123.tmp (PID: 2584)

  • SUSPICIOUS

    • Creates files in the user directory

      • Cryptor 404.exe (PID: 2396)

    • Reads the cookies of Google Chrome

      • 123.tmp (PID: 2584)

    • Starts CMD.EXE for commands execution

      • Cryptor 404.exe (PID: 2396)

    • Executable content was dropped or overwritten

      • Cryptor 404.exe (PID: 2396)
      • WinRAR.exe (PID: 3168)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3280)
      • cmd.exe (PID: 3364)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe cryptor 404.exe cmd.exe no specs cmd.exe no specs avast.tmp 123.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3168"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CRYPTOR 404.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2396"C:\Users\admin\Desktop\CRYPTOR 404\Cryptor 404.exe" C:\Users\admin\Desktop\CRYPTOR 404\Cryptor 404.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3280C:\Windows\system32\cmd.exe /c avast.tmpC:\Windows\system32\cmd.exe—Cryptor 404.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3364C:\Windows\system32\cmd.exe /c C:\Users\admin\AppData\Roaming\123.tmpC:\Windows\system32\cmd.exe—Cryptor 404.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2340avast.tmpC:\Users\admin\Desktop\CRYPTOR 404\avast.tmp
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ByteCrypter
Version:
1.0.0.0
2584C:\Users\admin\AppData\Roaming\123.tmpC:\Users\admin\AppData\Roaming\123.tmp
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
488
Read events
457
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
3168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3168.31107\CRYPTOR 404\Cryptor 404.exe —
MD5:—
SHA256:—
3168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3168.31107\CRYPTOR 404\Mono.Cecil.dll —
MD5:—
SHA256:—
3168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3168.31107\CRYPTOR 404\pourquoi.snk —
MD5:—
SHA256:—
2396Cryptor 404.exeC:\Users\admin\AppData\Local\Temp\autDAC6.tmp —
MD5:—
SHA256:—
2584123.tmpC:\Users\admin\AppData\Local\fjh91ib64156\google_chrome_default_ccdata.txt —
MD5:—
SHA256:—
3168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3168.31107\CRYPTOR 404\Crypter.Form1.resourcesbinary
MD5:4E666D03F860212FE4BC7AFD0BEB15A0
SHA256:8777E5E1D8B611AB0910A9A9990351E1810B3BE4735CCFA8DDFD67B3312DC5F4
2584123.tmpC:\Users\admin\AppData\Local\fjh91ib64156\google_chrome_default_cookie.txttext
MD5:CD108C5841BC12AD932BD28431D5A0C7
SHA256:B2EC5A586BF3051115C3535AAEF9826B419BF02DF459AED38782F492352B260D
3168WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3168.31107\CRYPTOR 404\ByteCrypter.vbproj.GenerateResource.Cachepi2
MD5:AFC07F63CA9A757FD6D2F0510DB8E585
SHA256:8260FE0124CFB0906644CEB7FC92752937D7DBFED0383177F7D5AF6AB997FAF0
2584123.tmpC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies1sqlite
MD5:33FAA3C0AB3E0E5F8E5446ED0D52CA32
SHA256:2AE728D9D195C37B8041CC088F9A28BB666B670E1A2410EFAEE5B26047C08BBF
2396Cryptor 404.exeC:\Users\admin\AppData\Roaming\123.tmpexecutable
MD5:78BFAB07C4A34ECE2CA6BC4FE27234D0
SHA256:AAC1C2B871E825394956D476473FE0AC62962954356B12F42F761E0798FEBA5E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2340
avast.tmp
GET
200
184.168.221.104:80
http://ww1.scan4you.net/
US
html
5.42 Kb
malicious
2584
123.tmp
POST
200
185.22.155.227:80
http://u2761716vo.ha002.t.justns.ru/landing.php
RU
—
—
malicious
2340
avast.tmp
GET
302
109.201.133.69:80
http://scan4you.net/
NL
text
11 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2340
avast.tmp
109.201.133.69:80
scan4you.net
NForce Entertainment B.V.
NL
suspicious
2340
avast.tmp
184.168.221.104:80
ww1.scan4you.net
GoDaddy.com, LLC
US
malicious
2584
123.tmp
185.22.155.227:80
u2761716vo.ha002.t.justns.ru
LLC Baxet
RU
malicious

DNS requests

Domain
IP
Reputation
u2761716vo.ha002.t.justns.ru
  • 185.22.155.227
malicious
scan4you.net
  • 109.201.133.69
malicious
ww1.scan4you.net
  • 184.168.221.104
malicious

Threats

PID
Process
Class
Message
2584
123.tmp
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.PWS.Stealer.24798
1 ETPRO signatures available at the full report
Process
Message
avast.tmp
[02:30:22 pm] GET >> http://scan4you.net
avast.tmp
[02:30:23 pm] GET >> http://ww1.scan4you.net
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CRYPTOR 404.rar