File name:

Mango Clicker.zip

Full analysis: https://app.any.run/tasks/8e527864-6cba-4f3d-8dcc-deabd6f45981
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: May 20, 2023, 10:22:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
gcleaner
stealer
rat
redline
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

FBDE49D059FDEF64949BD3963E475571

SHA1:

3B7EF38F8472FDB92F9B6BF70FB6E3599F4DDE2C

SHA256:

E4458564157889359396DBA6B60D37BDDCA978FBCF661A0D2846EEB7998E2703

SSDEEP:

24576:47FUDowAyrTVE3U5F/2HcKic6QL3E2vVsjECUAQT45deRV9Ri:4BuZrEUVKIy029s4C1eH9U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Mango Clicker.exe (PID: 276)
      • Mango Clicker.exe (PID: 3536)
      • Kz9G.exe (PID: 4020)
      • conhost.exe (PID: 744)
      • node.exe (PID: 1912)
      • auPz2Z7UG6.exe (PID: 2920)
      • MB4XK4yIW.exe (PID: 744)
      • clip64x.exe (PID: 1228)
      • 600m51no.exe (PID: 4076)
      • 78dyrdmrh7.exe (PID: 332)
      • Cleaner.exe (PID: 656)
      • WebCompanionInstaller.exe (PID: 2060)
      • clip64x.exe (PID: 9148)

    • Connects to the CnC server

      • s0.exe (PID: 1364)
      • RegSvcs.exe (PID: 1416)

    • GCLEANER was detected

      • s0.exe (PID: 1364)

    • Steals credentials from Web Browsers

      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)

    • Steals credentials

      • auPz2Z7UG6.exe (PID: 2920)

    • Starts CMD.EXE for self-deleting

      • s0.exe (PID: 1364)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 1416)
      • auPz2Z7UG6.exe (PID: 2920)

    • Loads dropped or rewritten executable

      • WebCompanionInstaller.exe (PID: 2060)

    • REDLINE was detected

      • RegSvcs.exe (PID: 1416)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Mango Clicker.exe (PID: 276)
      • Mango Clicker.exe (PID: 3536)
      • Mango Clicker.tmp (PID: 3876)
      • setup.exe (PID: 2068)
      • setup.tmp (PID: 1680)
      • Kz9G.exe (PID: 4020)
      • s0.exe (PID: 1364)
      • cmd.exe (PID: 656)
      • conhost.exe (PID: 744)
      • auPz2Z7UG6.exe (PID: 2920)
      • MB4XK4yIW.exe (PID: 744)
      • s1.exe (PID: 3808)
      • WebCompanionInstaller.exe (PID: 2060)

    • Reads the Windows owner or organization settings

      • Mango Clicker.tmp (PID: 3876)
      • setup.tmp (PID: 1680)

    • Reads the Internet Settings

      • Mango Clicker.tmp (PID: 3876)
      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)
      • auPz2Z7UG6.exe (PID: 2920)
      • MB4XK4yIW.exe (PID: 744)
      • RegSvcs.exe (PID: 1416)
      • WebCompanionInstaller.exe (PID: 2060)
      • Cleaner.exe (PID: 656)
      • WMIC.exe (PID: 7504)

    • Searches for installed software

      • setup.tmp (PID: 1680)
      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)
      • WebCompanionInstaller.exe (PID: 2060)

    • Connects to the server without a host name

      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)

    • Executing commands from a ".bat" file

      • Kz9G.exe (PID: 4020)
      • MB4XK4yIW.exe (PID: 744)

    • Starts CMD.EXE for commands execution

      • Kz9G.exe (PID: 4020)
      • MB4XK4yIW.exe (PID: 744)
      • cmd.exe (PID: 3784)
      • node.exe (PID: 1912)
      • s0.exe (PID: 1364)

    • The process creates files with name similar to system file names

      • cmd.exe (PID: 656)
      • clip64x.exe (PID: 9148)

    • Starts itself from another location

      • conhost.exe (PID: 744)

    • Reads security settings of Internet Explorer

      • auPz2Z7UG6.exe (PID: 2920)
      • WebCompanionInstaller.exe (PID: 2060)

    • Reads settings of System Certificates

      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)
      • WebCompanionInstaller.exe (PID: 2060)

    • Checks Windows Trust Settings

      • auPz2Z7UG6.exe (PID: 2920)
      • WebCompanionInstaller.exe (PID: 2060)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • auPz2Z7UG6.exe (PID: 2920)

    • Connects to unusual port

      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)

    • Reads browser cookies

      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)

    • Application launched itself

      • cmd.exe (PID: 3784)
      • clip64x.exe (PID: 1228)

    • Detected use of alternative data streams (AltDS)

      • node.exe (PID: 1912)

    • Uses ICACLS.EXE to modify access control lists

      • node.exe (PID: 1912)

    • Uses ATTRIB.EXE to modify file attributes

      • node.exe (PID: 1912)

    • Adds/modifies Windows certificates

      • s1.exe (PID: 3808)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2888)

    • Uses REG/REGEDIT.EXE to modify register

      • node.exe (PID: 1912)

    • Starts SC.EXE for service management

      • WebCompanionInstaller.exe (PID: 2060)

    • The process verifies whether the antivirus software is installed

      • WebCompanionInstaller.exe (PID: 2060)

    • Process uses IPCONFIG to discover network configuration

      • node.exe (PID: 1912)

    • Uses ROUTE.EXE to obtain the routing table information

      • node.exe (PID: 1912)

    • Get information on the list of running processes

      • node.exe (PID: 1912)

    • Uses WMIC.EXE to obtain data on processes

      • node.exe (PID: 1912)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3936)

    • Manual execution by a user

      • Mango Clicker.exe (PID: 276)
      • wmpnscfg.exe (PID: 1992)

    • Create files in a temporary directory

      • Mango Clicker.exe (PID: 276)
      • Mango Clicker.exe (PID: 3536)
      • Mango Clicker.tmp (PID: 3876)
      • setup.tmp (PID: 1680)
      • setup.exe (PID: 2068)
      • Kz9G.exe (PID: 4020)
      • cmd.exe (PID: 656)
      • MB4XK4yIW.exe (PID: 744)
      • node.exe (PID: 1912)
      • s1.exe (PID: 3808)
      • s0.exe (PID: 1364)
      • WebCompanionInstaller.exe (PID: 2060)
      • iexplore.exe (PID: 4592)

    • Checks supported languages

      • Mango Clicker.exe (PID: 276)
      • Mango Clicker.tmp (PID: 548)
      • Mango Clicker.exe (PID: 3536)
      • Mango Clicker.tmp (PID: 3876)
      • setup.tmp (PID: 1680)
      • setup.exe (PID: 2068)
      • s0.exe (PID: 1364)
      • Kz9G.exe (PID: 4020)
      • conhost.exe (PID: 744)
      • node.exe (PID: 1912)
      • auPz2Z7UG6.exe (PID: 2920)
      • wmpnscfg.exe (PID: 1992)
      • MB4XK4yIW.exe (PID: 744)
      • 600m51no.exe (PID: 4076)
      • clip64x.exe (PID: 1228)
      • 78dyrdmrh7.exe (PID: 332)
      • RegSvcs.exe (PID: 1416)
      • RegSvcs.exe (PID: 2404)
      • AppLaunch.exe (PID: 99752)
      • s1.exe (PID: 3808)
      • WebCompanionInstaller.exe (PID: 2060)
      • Cleaner.exe (PID: 656)
      • clip64x.exe (PID: 9148)

    • Reads the computer name

      • Mango Clicker.tmp (PID: 548)
      • Mango Clicker.tmp (PID: 3876)
      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)
      • conhost.exe (PID: 744)
      • node.exe (PID: 1912)
      • auPz2Z7UG6.exe (PID: 2920)
      • wmpnscfg.exe (PID: 1992)
      • MB4XK4yIW.exe (PID: 744)
      • clip64x.exe (PID: 1228)
      • RegSvcs.exe (PID: 1416)
      • AppLaunch.exe (PID: 99752)
      • Cleaner.exe (PID: 656)
      • WebCompanionInstaller.exe (PID: 2060)

    • The process checks LSA protection

      • Mango Clicker.tmp (PID: 548)
      • Mango Clicker.tmp (PID: 3876)
      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)
      • conhost.exe (PID: 744)
      • node.exe (PID: 1912)
      • auPz2Z7UG6.exe (PID: 2920)
      • wmpnscfg.exe (PID: 1992)
      • MB4XK4yIW.exe (PID: 744)
      • RegSvcs.exe (PID: 1416)
      • icacls.exe (PID: 28620)
      • AppLaunch.exe (PID: 99752)
      • taskkill.exe (PID: 3920)
      • WebCompanionInstaller.exe (PID: 2060)
      • icacls.exe (PID: 4480)
      • WMIC.exe (PID: 7504)
      • systeminfo.exe (PID: 8016)
      • clip64x.exe (PID: 1228)
      • tasklist.exe (PID: 7292)
      • ipconfig.exe (PID: 7772)

    • Application was dropped or rewritten from another process

      • Mango Clicker.tmp (PID: 3876)
      • Mango Clicker.tmp (PID: 548)
      • setup.exe (PID: 2068)
      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)
      • s1.exe (PID: 3808)

    • Creates files in the program directory

      • Mango Clicker.tmp (PID: 3876)
      • conhost.exe (PID: 744)
      • auPz2Z7UG6.exe (PID: 2920)
      • node.exe (PID: 1912)
      • AppLaunch.exe (PID: 99752)
      • WebCompanionInstaller.exe (PID: 2060)

    • Checks proxy server information

      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)
      • auPz2Z7UG6.exe (PID: 2920)

    • Reads the machine GUID from the registry

      • setup.tmp (PID: 1680)
      • s0.exe (PID: 1364)
      • conhost.exe (PID: 744)
      • node.exe (PID: 1912)
      • auPz2Z7UG6.exe (PID: 2920)
      • wmpnscfg.exe (PID: 1992)
      • RegSvcs.exe (PID: 1416)
      • AppLaunch.exe (PID: 99752)
      • WebCompanionInstaller.exe (PID: 2060)
      • clip64x.exe (PID: 1228)

    • Creates files or folders in the user directory

      • s0.exe (PID: 1364)
      • auPz2Z7UG6.exe (PID: 2920)
      • clip64x.exe (PID: 9148)

    • The executable file from the user directory is run by the CMD process

      • conhost.exe (PID: 744)
      • 600m51no.exe (PID: 4076)
      • 78dyrdmrh7.exe (PID: 332)
      • clip64x.exe (PID: 1228)
      • Cleaner.exe (PID: 656)

    • Reads CPU info

      • conhost.exe (PID: 744)
      • auPz2Z7UG6.exe (PID: 2920)
      • node.exe (PID: 1912)

    • Reads product name

      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)

    • Reads Environment values

      • auPz2Z7UG6.exe (PID: 2920)
      • RegSvcs.exe (PID: 1416)
      • WebCompanionInstaller.exe (PID: 2060)

    • Application launched itself

      • iexplore.exe (PID: 4592)

    • [YARA] HTTP manipulation strings were found

      • WebCompanionInstaller.exe (PID: 2060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Mango Clicker.exe
ZipUncompressedSize: 1673165
ZipCompressedSize: 1673165
ZipCRC: 0xfa1042f9
ZipModifyDate: 2023:05:20 10:22:26
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
54
Malicious processes
20
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe mango clicker.exe mango clicker.tmp no specs mango clicker.exe mango clicker.tmp setup.exe setup.tmp #GCLEANER s0.exe kz9g.exe cmd.exe conhost.exe node.exe aupz2z7ug6.exe wmpnscfg.exe no specs mb4xk4yiw.exe cmd.exe no specs cmd.exe no specs 78dyrdmrh7.exe 600m51no.exe clip64x.exe no specs #REDLINE regsvcs.exe regsvcs.exe no specs cmd.exe no specs cacls.exe no specs icacls.exe no specs attrib.exe no specs attrib.exe no specs applaunch.exe no specs cmd.exe no specs cleaner.exe no specs cmd.exe no specs taskkill.exe no specs s1.exe webcompanioninstaller.exe iexplore.exe no specs iexplore.exe cacls.exe no specs icacls.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs tasklist.exe no specs wmic.exe no specs ipconfig.exe no specs route.exe no specs netstat.exe no specs systeminfo.exe no specs clip64x.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Users\admin\Desktop\Mango Clicker.exe" C:\Users\admin\Desktop\Mango Clicker.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Mango Clicker.exe Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\mango clicker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
332"78dyrdmrh7.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\78dyrdmrh7.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\78dyrdmrh7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
548"C:\Users\admin\AppData\Local\Temp\is-QIFJT.tmp\Mango Clicker.tmp" /SL5="$100194,833547,832512,C:\Users\admin\Desktop\Mango Clicker.exe" C:\Users\admin\AppData\Local\Temp\is-QIFJT.tmp\Mango Clicker.tmp—Mango Clicker.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-qifjt.tmp\mango clicker.tmp
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
656cmd.exe /d /c bbbhcqjpdq.bat 75265670C:\Windows\System32\cmd.exe
Kz9G.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
656"C:\Users\admin\AppData\Local\Temp\byTaS1OuBY86Y4DLaW3ylzN\Cleaner.exe" C:\Users\admin\AppData\Local\Temp\byTaS1OuBY86Y4DLaW3ylzN\Cleaner.exe—cmd.exe
User:
admin
Company:
lrepacks.com
Integrity Level:
HIGH
Description:
Easy GIF Animator Setup
Exit code:
2148734720
Version:
7.3.0.61.0
Modules
Images
c:\users\admin\appdata\local\temp\bytas1ouby86y4dlaw3ylzn\cleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
744conhost.exe ljxyvrnagm.dat 75265670C:\Users\admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
cmd.exe
User:
admin
Company:
Joyent, Inc
Integrity Level:
HIGH
Description:
Evented I/O for V8 JavaScript
Exit code:
0
Version:
0.10.43
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
744"C:\Users\admin\AppData\Roaming\cDHBv1sdfso\MB4XK4yIW.exe"C:\Users\admin\AppData\Roaming\cDHBv1sdfso\MB4XK4yIW.exe
s0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\roaming\cdhbv1sdfso\mb4xk4yiw.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1228"clip64x.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\clip64x.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
FinalProject
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\clip64x.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1364"C:\Users\admin\AppData\Local\Temp\is-QCMMQ.tmp\s0.exe" /eueleven SUB=2477C:\Users\admin\AppData\Local\Temp\is-QCMMQ.tmp\s0.exe
setup.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-qcmmq.tmp\s0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1416"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
600m51no.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
30 908
Read events
30 679
Write events
225
Delete events
4

Modification events

(PID) Process:(3936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
116
Suspicious files
40
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
3936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3936.15872\Mango Clicker.exeexecutable
MD5:783CB4FA55B4CD542EDB30ED614DD388
SHA256:F4BD41DBA5625E1AD0A861391CA4D811A35E341C14D6B2E8F43DC37CAADC1764
3536Mango Clicker.exeC:\Users\admin\AppData\Local\Temp\is-J989O.tmp\Mango Clicker.tmpexecutable
MD5:4E26055A6C0C70DEBA9C47658ED5B4D0
SHA256:180CD3CA851B9AB60C992E62E91CB71CEB4B331CE9F512D971E512B6E628D47D
276Mango Clicker.exeC:\Users\admin\AppData\Local\Temp\is-QIFJT.tmp\Mango Clicker.tmpexecutable
MD5:4E26055A6C0C70DEBA9C47658ED5B4D0
SHA256:180CD3CA851B9AB60C992E62E91CB71CEB4B331CE9F512D971E512B6E628D47D
3876Mango Clicker.tmpC:\Users\admin\AppData\Local\Temp\is-LAO24.tmp\setup.dllbinary
MD5:393722A4F6BB3B9BFEC2FAEADF7C99D7
SHA256:E4FCFCBB574C3079B99F07BF05E5B65B23E4185DC938E7D49536E7420E3FAD34
3876Mango Clicker.tmpC:\Users\admin\AppData\Local\Temp\is-LAO24.tmp\state.logtext
MD5:444BCB3A3FCF8389296C49467F27E1D6
SHA256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
3876Mango Clicker.tmpC:\Users\admin\AppData\Local\Temp\is-LAO24.tmp\setuptext
MD5:E3872DAB0ED3EBD9A662120CDFE43AFE
SHA256:7FDEE77AD9220A2C4BF4465FAAE34AFDF1C684D8991926A580A3E7EDA46DABA9
3876Mango Clicker.tmpC:\Users\admin\AppData\Local\Temp\is-LAO24.tmp\is-3311K.tmpexecutable
MD5:B58ECEB68BEE975E9212E31B342B6165
SHA256:4F214FBC5CB4A6860CF18D261D784A0C905B6DF0941D5185E1B95DF329EF2B89
4020Kz9G.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\elmxnpg.dat.3 —
MD5:—
SHA256:—
3876Mango Clicker.tmpC:\Users\admin\AppData\Local\Temp\is-LAO24.tmp\setup.exeexecutable
MD5:B58ECEB68BEE975E9212E31B342B6165
SHA256:4F214FBC5CB4A6860CF18D261D784A0C905B6DF0941D5185E1B95DF329EF2B89
3876Mango Clicker.tmpC:\Users\admin\AppData\Local\Temp\is-LAO24.tmp\is-8B3R0.tmptext
MD5:E3872DAB0ED3EBD9A662120CDFE43AFE
SHA256:7FDEE77AD9220A2C4BF4465FAAE34AFDF1C684D8991926A580A3E7EDA46DABA9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
36
DNS requests
19
Threats
775

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1680
setup.tmp
HEAD
200
45.12.253.74:80
http://45.12.253.74/pineapple.php?pub=eueleven
BG
—
—
malicious
1364
s0.exe
GET
200
45.12.253.75:80
http://45.12.253.75/dll.php
BG
—
—
malicious
1364
s0.exe
GET
200
45.12.253.72:80
http://45.12.253.72/default/stuk.php
BG
text
21 b
malicious
3876
Mango Clicker.tmp
GET
200
188.114.97.3:80
http://pricemarket.online/req.php?p=3811&t=46373734&title=TWFuZ28gQ2xpY2tlci5leGU=&sub=2477
US
text
106 b
malicious
3876
Mango Clicker.tmp
GET
200
188.114.97.3:80
http://pricemarket.online/reqs.php
US
text
2 b
malicious
2920
auPz2Z7UG6.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
binary
1.66 Kb
whitelisted
1680
setup.tmp
GET
200
45.12.253.74:80
http://45.12.253.74/pineapple.php?pub=eueleven
BG
executable
397 Kb
malicious
1364
s0.exe
GET
200
45.12.253.72:80
http://45.12.253.72/default/puk.php
BG
binary
93.0 Kb
malicious
3876
Mango Clicker.tmp
GET
200
188.114.96.3:80
http://bridgecurrent.site/pe/buildIN.php?sub=2477&source=3811&s1=46373734&title=TWFuZ28gQ2xpY2tlci5leGU%3D
US
executable
1.68 Mb
malicious
1364
s0.exe
GET
200
45.12.253.75:80
http://45.12.253.75/dll.php
BG
executable
2.36 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1416
RegSvcs.exe
135.181.7.171:81
—
Hetzner Online GmbH
FI
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3412
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3876
Mango Clicker.tmp
188.114.97.3:80
pricemarket.online
CLOUDFLARENET
NL
malicious
3876
Mango Clicker.tmp
188.114.96.3:80
pricemarket.online
CLOUDFLARENET
NL
malicious
1680
setup.tmp
45.12.253.74:80
—
VNET a.s.
BG
malicious
1364
s0.exe
45.12.253.56:80
—
VNET a.s.
BG
malicious
1364
s0.exe
45.12.253.72:80
—
VNET a.s.
BG
malicious

DNS requests

Domain
IP
Reputation
pricemarket.online
  • 188.114.97.3
  • 188.114.96.3
malicious
bridgecurrent.site
  • 188.114.96.3
  • 188.114.97.3
malicious
be81e3a6329916845781948380003611db11e14b53635001cce9e0221232f.reu.apho35.shop
  • 176.126.85.16
unknown
t.me
  • 149.154.167.99
whitelisted
ctldl.windowsupdate.com
  • 67.26.81.254
  • 8.248.133.254
  • 8.248.139.254
  • 67.26.75.254
  • 8.248.149.254
whitelisted
ocsp.godaddy.com
  • 192.124.249.23
  • 192.124.249.24
  • 192.124.249.41
  • 192.124.249.22
  • 192.124.249.36
whitelisted
6ba117e349641684578199808.bag.sack54.net
  • 185.82.126.147
unknown
6ba117e349641684578199808.bag.sack55.net
  • —
unknown
lodar2ben.top
  • —
malicious
api.ip.sb
  • 104.26.12.31
  • 104.26.13.31
  • 172.67.75.172
whitelisted

Threats

PID
Process
Class
Message
3876
Mango Clicker.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3876
Mango Clicker.tmp
Misc activity
ET INFO EXE - Served Attached HTTP
1680
setup.tmp
Misc activity
ET INFO Packed Executable Download
1680
setup.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1680
setup.tmp
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1680
setup.tmp
Misc activity
ET INFO EXE - Served Attached HTTP
1680
setup.tmp
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
1680
setup.tmp
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
1680
setup.tmp
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
1680
setup.tmp
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
7 ETPRO signatures available at the full report
Process
Message
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
5/20/2023 11:23:36 AM :-> Starting installer 8.9.0.371 with: .\WebCompanionInstaller.exe --partner=IT210801 --version=8.9.0.371 --silent --partner=IT210801, Run as admin: True
WebCompanionInstaller.exe
Preparing for installing Web Companion
WebCompanionInstaller.exe
5/20/2023 11:23:37 AM :-> Generating Machine and Install Id ...
WebCompanionInstaller.exe
5/20/2023 11:23:37 AM :-> Machine Id and Install Id has been generated
WebCompanionInstaller.exe
5/20/2023 11:23:37 AM :-> Checking prerequisites ...
WebCompanionInstaller.exe
5/20/2023 11:23:37 AM :-> Antivirus not detected
WebCompanionInstaller.exe
5/20/2023 11:23:38 AM :-> vm_check False
WebCompanionInstaller.exe
5/20/2023 11:23:38 AM :-> reg_check :False
WebCompanionInstaller.exe
5/20/2023 11:23:38 AM :-> Installed .Net framework is V40
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mango Clicker.zip