File name:

Joker Combo Leecher [v1.0].rar (2).zip

Full analysis: https://app.any.run/tasks/18c5ecfa-9162-430c-8d7a-f69d1d3c23ab
Verdict: Malicious activity
Analysis date: July 25, 2020, 00:26:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

AA63D7409BAA6276F932AA1F6EC5ACD6

SHA1:

C0050091DD887B939909AC3657385263E5C85179

SHA256:

E0C8CC1D8AA8E16DDB4E12D0DEF5DB3BB119AE75D11A031A09E97B2721CD921B

SSDEEP:

12288:goxOunBioVl3U3sJJvBoIJZJxDg5l6ajvBUXR/3sly44tObFVz:gocunBiGxBoIJRDguaDBaR/cfb7z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Joker Combo Leecher [v1.0].exe (PID: 3400)
      • Joker Combo Leecher [v1.0].exe (PID: 2220)

    • Loads dropped or rewritten executable

      • Joker Combo Leecher [v1.0].exe (PID: 3400)
      • SearchProtocolHost.exe (PID: 3568)
      • Joker Combo Leecher [v1.0].exe (PID: 2220)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 1452)

    • Reads Environment values

      • Joker Combo Leecher [v1.0].exe (PID: 3400)
      • Joker Combo Leecher [v1.0].exe (PID: 2220)

    • Executable content was dropped or overwritten

      • Joker Combo Leecher [v1.0].exe (PID: 3400)

  • INFO

    • Manual execution by user

      • Joker Combo Leecher [v1.0].exe (PID: 3400)
      • Joker Combo Leecher [v1.0].exe (PID: 2220)

    • Reads settings of System Certificates

      • Joker Combo Leecher [v1.0].exe (PID: 3400)
      • Joker Combo Leecher [v1.0].exe (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: None
ZipModifyDate: 2020:07:25 01:51:27
ZipCRC: 0x286803ec
ZipCompressedSize: 582896
ZipUncompressedSize: 582896
ZipFileName: Joker Combo Leecher [v1.0].rar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs searchprotocolhost.exe no specs joker combo leecher [v1.0].exe joker combo leecher [v1.0].exe

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Joker Combo Leecher [v1.0].rar (2).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2220"C:\Users\admin\Desktop\Joker Combo Leecher [v1.0].exe" C:\Users\admin\Desktop\Joker Combo Leecher [v1.0].exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Joker Combo Leecher [v1.0]
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\joker combo leecher [v1.0].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2460"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb1452.15037\Joker Combo Leecher [v1.0].rar"C:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
3400"C:\Users\admin\Desktop\Joker Combo Leecher [v1.0].exe" C:\Users\admin\Desktop\Joker Combo Leecher [v1.0].exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Joker Combo Leecher [v1.0]
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\joker combo leecher [v1.0].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3568"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
3 230
Read events
3 037
Write events
182
Delete events
11

Modification events

(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1452) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Joker Combo Leecher [v1.0].rar (2).zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2460) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
1
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2460.16775\Joker Combo Leecher [v1.0]\Joker Combo Leecher [v1.0].exe —
MD5:—
SHA256:—
2460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2460.16775\Joker Combo Leecher [v1.0]\Leaf.Net.dll —
MD5:—
SHA256:—
2460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2460.16775\Joker Combo Leecher [v1.0]\SkinSoft.VisualStyler.dll —
MD5:—
SHA256:—
2460WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2460.16775\Joker Combo Leecher [v1.0]\xNet.dll —
MD5:—
SHA256:—
2220Joker Combo Leecher [v1.0].exeC:\Users\admin\Desktop\cxvbxcb.txttext
MD5:—
SHA256:—
2220Joker Combo Leecher [v1.0].exeC:\Users\admin\Desktop\comobs.txttext
MD5:—
SHA256:—
3400Joker Combo Leecher [v1.0].exeC:\Users\admin\AppData\Local\SkinSoft\VisualStyler\2.4.59444.6\x86\ssapihook.dllexecutable
MD5:9E7F44B8F1512476AA896E977C58830B
SHA256:8E6195B50BB0D22E4D346263F708F166DB726C84884FE78A6BB477CAED19E708
1452WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb1452.15037\Joker Combo Leecher [v1.0].rarcompressed
MD5:F50825930617108B154CD51F29428FA0
SHA256:3EED2D996AAE245F628BD593E11C58BBE00DF2EBDCB6B48CCFB77AAD8966A616
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
72
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
Joker Combo Leecher [v1.0].exe
GET
301
104.31.75.75:80
http://blazealts.com/fortnite/
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
Joker Combo Leecher [v1.0].exe
172.217.23.99:443
www.google.ad
Google Inc.
US
whitelisted
3400
Joker Combo Leecher [v1.0].exe
216.58.208.35:443
www.google.ac
Google Inc.
US
whitelisted
3400
Joker Combo Leecher [v1.0].exe
104.28.3.131:443
crackia.com
Cloudflare Inc
US
unknown
3400
Joker Combo Leecher [v1.0].exe
172.67.201.148:443
crackians.com
—
US
unknown
3400
Joker Combo Leecher [v1.0].exe
45.138.72.29:443
hqcombo.com
—
—
unknown
3400
Joker Combo Leecher [v1.0].exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2220
Joker Combo Leecher [v1.0].exe
172.217.23.99:443
www.google.ad
Google Inc.
US
whitelisted
2220
Joker Combo Leecher [v1.0].exe
216.58.208.35:443
www.google.ac
Google Inc.
US
whitelisted
2220
Joker Combo Leecher [v1.0].exe
172.67.201.148:443
crackians.com
—
US
unknown
2220
Joker Combo Leecher [v1.0].exe
45.138.72.29:443
hqcombo.com
—
—
unknown

DNS requests

Domain
IP
Reputation
www.google.ad
  • 172.217.23.99
whitelisted
www.google.ac
  • 216.58.208.35
whitelisted
altenens.org
  • —
unknown
hqcombo.com
  • 45.138.72.29
unknown
crackia.com
  • 104.28.3.131
  • 104.28.2.131
  • 172.67.193.192
malicious
crackians.com
  • 172.67.201.148
  • 104.18.63.99
  • 104.18.62.99
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google.com
  • 172.217.16.164
malicious
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
malicious
business.bing.com
  • 13.107.6.158
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Joker Combo Leecher [v1.0].rar (2).zip