We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
16 August 2023, 00:20
Analysis environment:
Windows 7 Pro, build 7601, x86
All.ElectroRAT.zip
MD5:
7FF8D31AD43F62F1C6876B725A1EBB1F
SHA1:
E23BAF502BF5B2EB81FEA0A2E570E7ADE8998BEE
SHA256:
DDA14413450A11F336A8305CF274943D614905C3429D4F0EFEFFE6BF4B8B7BDC
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis All.ElectroRAT.zip (MD5: 7FF8D31AD43F62F1C6876B725A1EBB1F) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
No malicious indicators.
SUSPICIOUS
Reads the Internet Settings
rundll32.exe (PID: 2476)
rundll32.exe (PID: 1348)
rundll32.exe (PID: 908)
rundll32.exe (PID: 2028)
Uses RUNDLL32.EXE to load library
iexplore.exe (PID: 2472)
WinRAR.exe (PID: 3484)
INFO
Executable content was dropped or overwritten
WinRAR.exe (PID: 3484)
The process checks LSA protection
rundll32.exe (PID: 2476)
rundll32.exe (PID: 2440)
rundll32.exe (PID: 1348)
rundll32.exe (PID: 908)
rundll32.exe (PID: 2028)
Application launched itself
iexplore.exe (PID: 2472)
iexplore.exe (PID: 3828)
iexplore.exe (PID: 1040)
Manual execution by a user
WINWORD.EXE (PID: 692)
Threats
No threats detected