analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

11.rar

Full analysis: https://app.any.run/tasks/0b608afa-087b-4d06-8f26-f04d9b15a83f
Verdict: Malicious activity
Threats:

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 06:53:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
orcus
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

90B0A9665A94DEB4DB8472C47C4EC04E

SHA1:

2889B576CF77F047E354B17EADF8275A65A00B1D

SHA256:

D5CB418A144C30072EF0318E2B55E03F90671C25C6D1BF1A1AB865EB25D6DE09

SSDEEP:

24576:VBo58TWgodj9KrxsMWa5/Yk9RhyQreJZozkGuYSLitUhXCLPxOguq5sZErjHUznm:vpkLKrxd7RUeyowGuvim+OguSrkznkL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Orcus was detected

      • Workpls.exe (PID: 2984)
      • chrome.exe (PID: 2996)
      • chrome.exe (PID: 2536)

    • Application was dropped or rewritten from another process

      • chrome.exe (PID: 2996)
      • Workpls.exe (PID: 2984)
      • chrome.exe (PID: 2536)
      • Spotify.exe (PID: 3584)

    • Changes the autorun value in the registry

      • chrome.exe (PID: 2996)

    • Loads the Task Scheduler COM API

      • chrome.exe (PID: 2996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Spotify.exe (PID: 3656)
      • Workpls.exe (PID: 2984)

    • Creates files in the user directory

      • Spotify.exe (PID: 3656)
      • Workpls.exe (PID: 2984)

    • Starts itself from another location

      • Workpls.exe (PID: 2984)

    • Executed via Task Scheduler

      • chrome.exe (PID: 2536)

  • INFO

    • Manual execution by user

      • Spotify.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs spotify.exe #ORCUS workpls.exe spotify.exe no specs #ORCUS chrome.exe #ORCUS chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3012"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\11.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3656"C:\Users\admin\Desktop\Spotify Checker\Spotify.exe" C:\Users\admin\Desktop\Spotify Checker\Spotify.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Spotify
Exit code:
0
Version:
1.0.0.0
2984"C:\Users\admin\AppData\Roaming\Workpls.exe" C:\Users\admin\AppData\Roaming\Workpls.exe
Spotify.exe
User:
admin
Company:
Warnerarchive Bruteforce
Integrity Level:
HIGH
Description:
Warnerarchive brute by m1st
Exit code:
0
Version:
1.0.0.0
3584"C:\Users\admin\AppData\Roaming\Spotify.exe" C:\Users\admin\AppData\Roaming\Spotify.exe—Spotify.exe
User:
admin
Company:
Warnerarchive Bruteforce
Integrity Level:
HIGH
Description:
Warnerarchive brute by m1st
Version:
1.0.0.0
2996"C:\Users\admin\AppData\Roaming\Google Chrome\chrome.exe" C:\Users\admin\AppData\Roaming\Google Chrome\chrome.exe
Workpls.exe
User:
admin
Company:
Warnerarchive Bruteforce
Integrity Level:
HIGH
Description:
Warnerarchive brute by m1st
Version:
1.0.0.0
2536"C:\Users\admin\AppData\Roaming\Google Chrome\chrome.exe" C:\Users\admin\AppData\Roaming\Google Chrome\chrome.exe
taskeng.exe
User:
admin
Company:
Warnerarchive Bruteforce
Integrity Level:
HIGH
Description:
Warnerarchive brute by m1st
Exit code:
0
Version:
1.0.0.0
Total events
1 170
Read events
1 153
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3012.22991\Spotify Checker\Spotify.exe —
MD5:—
SHA256:—
2984Workpls.exeC:\Users\admin\AppData\Roaming\Google Chrome\chrome.exeexecutable
MD5:C0F88172B5ED9BF11D5A32060B39D6A2
SHA256:18781A96E243B09AE70AC7AA57DB9CC7CF0FAFE38B54967A1614EB7B00A5F8C8
3656Spotify.exeC:\Users\admin\AppData\Roaming\Spotify.exeexecutable
MD5:0C1F43BD9162C8B774D69A8582718D21
SHA256:C532533100D63D221440C9A29929C8850F4C154FABBA701EFD1C9B5BA526F1AC
3656Spotify.exeC:\Users\admin\AppData\Roaming\Workpls.exeexecutable
MD5:C0F88172B5ED9BF11D5A32060B39D6A2
SHA256:18781A96E243B09AE70AC7AA57DB9CC7CF0FAFE38B54967A1614EB7B00A5F8C8
2984Workpls.exeC:\Users\admin\AppData\Roaming\Google Chrome\chrome.exe.configxml
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98
SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
19
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2996
chrome.exe
184.105.126.96:1337
—
Hurricane Electric, Inc.
US
malicious
2996
chrome.exe
10.64.41.123:1337
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
11.rar