analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Extender.rar

Full analysis: https://app.any.run/tasks/d9bc2812-8928-4e1f-93e3-4f711970d9a7
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: March 21, 2019, 21:49:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
imminent
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

03913093707A2CACAECBE61702CC2875

SHA1:

782282E0C998BEFB09A1A3B1A553D6C48C1F0C99

SHA256:

E1A1127CD0E7C5EBC256947F5E9134E8B2CF8E9C3408ADA5082361A02C5B4FBD

SSDEEP:

196608:9T0YKwVhUCjW5JnD8H0VwvmQI5b4iXCs4W02p0x/cllQRhsKqc:t0yhUEW5JnDskwvzI58iXCspd0xEQfz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Loader.exe (PID: 3544)
      • WinRAR.exe (PID: 3572)
      • winrar.exe (PID: 3260)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2144)

    • Changes the autorun value in the registry

      • winrar.exe (PID: 3260)

    • Detected Imminent RAT

      • winrar.exe (PID: 3260)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 3872)
      • winrar.exe (PID: 3260)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3872)
      • WinRAR.exe (PID: 3572)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3716)
      • javaw.exe (PID: 3872)
      • WinRAR.exe (PID: 3572)
      • winrar.exe (PID: 3260)

    • Executes JAVA applets

      • Loader.exe (PID: 3544)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3408)
      • cmd.exe (PID: 3216)
      • cmd.exe (PID: 3564)
      • cmd.exe (PID: 2692)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3216)
      • cmd.exe (PID: 3564)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 2692)

    • Starts itself from another location

      • WinRAR.exe (PID: 3572)

    • Connects to unusual port

      • winrar.exe (PID: 3260)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 44664
UncompressedSize: 93184
OperatingSystem: Win32
ModifyDate: 2017:05:13 05:09:10
PackingMethod: Normal
ArchivedFileName: jrelibx32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
24
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe loader.exe no specs javaw.exe cmd.exe no specs chcp.com no specs wmic.exe no specs more.com no specs cmd.exe no specs chcp.com no specs reg.exe no specs cmd.exe no specs chcp.com no specs wmic.exe no specs more.com no specs cmd.exe no specs chcp.com no specs reg.exe no specs explorer.exe no specs explorer.exe no specs winrar.exe #IMMINENT winrar.exe cmd.exe no specs ping.exe no specs wmiapsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3716"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Extender.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3544"C:\Users\admin\AppData\Local\Temp\Rar$EXa3716.1642\Loader.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3716.1642\Loader.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3872"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\admin\AppData\Local\Temp\Rar$EXa3716.1642\Loader.exe" org.develnext.jphp.ext.javafx.FXLauncherC:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
Loader.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
3408C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp 866>nul & C:\Windows\System32\wbem\wmic path win32_computersystemproduct get /Format:List | C:\Windows\System32\more"C:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3904C:\Windows\System32\chcp 866 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2260C:\Windows\System32\wbem\wmic path win32_computersystemproduct get /Format:List C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2376C:\Windows\System32\moreC:\Windows\System32\more.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3216C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp 65001>nul & reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName""C:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3724C:\Windows\System32\chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1520reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 127
Read events
1 063
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
4
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
3572WinRAR.exeC:\Users\admin\AppData\Local\Temp\winrar\winrar.exeexecutable
MD5:8ED5725D7D7ABF2447B01E7D7B985CBD
SHA256:B173AC394D3E0FD05043BB46B2E8E1D2F35715890722013CCD30C0D1FC1F6D2E
3716WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3716.1642\jrelibx32.dllexecutable
MD5:2FD246B32403B426B7E07952A3A7D6F4
SHA256:9E04377DD1E0AEEAE83A896C7A53974E5F46FBBED4442241182AEA29131E98C3
3872javaw.exeC:\Users\admin\D103199D-3C3F-AB45-A928-AB014D429B1F.txttext
MD5:3DB6CF943127752DEC38786D10B5412E
SHA256:46A00EDCC4843106D4AC47E2EBD5EFC17F46FA528260A8A7AB15E50860F1619F
3260winrar.exeC:\Users\admin\AppData\Roaming\OneDrive\OneDrive.exeexecutable
MD5:8ED5725D7D7ABF2447B01E7D7B985CBD
SHA256:B173AC394D3E0FD05043BB46B2E8E1D2F35715890722013CCD30C0D1FC1F6D2E
3716WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3716.1642\Loader.exeexecutable
MD5:8856D5C704F3F267158FA8174D958D8B
SHA256:2B6CD6023CA20050452EE0FBB57680251DBAD997C76ADA9CBC0086BD361794BD
3716WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3716.1642\settings.initext
MD5:3C5C78B86D05FDD6488E0C9BDA7887B6
SHA256:27105FABEDAEC045987C411E8340C51A08FE9A1B99DF638AB710CC4A0E148121
3872javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:382BFA9ECDB4DA68857A92AE4128D2A5
SHA256:73F4CC8564CBAB4952E42B19C8FFB00BBCD4289806066A78152030EFB8F671AE
3872javaw.exeC:\Users\admin\AppData\Roaming\WinRAR\WinRAR.exeexecutable
MD5:8ED5725D7D7ABF2447B01E7D7B985CBD
SHA256:B173AC394D3E0FD05043BB46B2E8E1D2F35715890722013CCD30C0D1FC1F6D2E
3260winrar.exeC:\Users\admin\AppData\Roaming\Imminent\Monitoring\system.datbinary
MD5:5602BB619EC99A44CE3CD1FCB452EE85
SHA256:27EC0EDB9A1C9BE4A96D1D51A7CDB8B47D3056B93CBB25C6CB6633FD99618049
3872javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
12
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3872
javaw.exe
GET
200
37.140.192.35:80
http://extenderhacks.ru/info.txt
RU
text
184 b
suspicious
3872
javaw.exe
POST
200
37.140.192.35:80
http://extenderhacks.ru/Free/upload.php
RU
—
—
suspicious
3872
javaw.exe
GET
200
37.140.192.35:80
http://extenderhacks.ru/image.jpg
RU
image
785 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3260
winrar.exe
176.109.255.1:1605
karn.ddns.net
Lugansky Merezhy Ltd
UA
unknown
3872
javaw.exe
37.140.192.35:80
extenderhacks.ru
Domain names registrar REG.RU, Ltd
RU
suspicious

DNS requests

Domain
IP
Reputation
extenderhacks.ru
  • 37.140.192.35
suspicious
karn.ddns.net
  • 176.109.255.1
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Extender.rar