analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Rolf1.rar

Full analysis: https://app.any.run/tasks/c569bcb7-df1b-4106-95f6-ad2a44d59f53
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 14, 2019, 08:10:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
opendir
ransomware
troldesh
shade
loader
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E73E589360D5D031F9960D68A7762373

SHA1:

0B123E9F78B2FCDF685158320CF44BA0F0C1A8D7

SHA256:

E4651ACBD8673E30BC9CCD77E5E6608D92C0E02F75651576415E054A905BB031

SSDEEP:

96:eh4WUzyX1R2PKE4z9MAyAXEOTKYl7JyxgWudmpyRvskDa1:7WUzZCJxhTDixWdm8ZDk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • radB8286.tmp (PID: 3804)
    • TROLDESH was detected

      • radB8286.tmp (PID: 3804)
    • Downloads executable files from the Internet

      • WScript.exe (PID: 2708)
    • Changes the autorun value in the registry

      • radB8286.tmp (PID: 3804)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2708)
    • Creates files in the user directory

      • WScript.exe (PID: 2708)
    • Creates files in the program directory

      • radB8286.tmp (PID: 3804)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3000)
    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2708)
      • radB8286.tmp (PID: 3804)
    • Connects to unusual port

      • radB8286.tmp (PID: 3804)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe cmd.exe no specs #TROLDESH radb8286.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Rolf1.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2708"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Группа компаний Рольф подробности заказа.js" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3000"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\radB8286.tmpC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3804C:\Users\admin\AppData\Local\Temp\radB8286.tmpC:\Users\admin\AppData\Local\Temp\radB8286.tmp
cmd.exe
User:
admin
Company:
Burnaware
Integrity Level:
MEDIUM
Description:
Verify Disc
Version:
8.3.0.0
Total events
475
Read events
432
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3416.8371\Группа компаний Рольф подробности заказа.js
MD5:
SHA256:
3804radB8286.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp
MD5:
SHA256:
3804radB8286.tmpC:\Users\admin\AppData\Local\Temp\6893A5~1\statetext
MD5:EB837714D40F7567E3A6AD11735B1D54
SHA256:FA8060B6CD5098CD8256363A0E04939D49C83EA35DCC1A774117A80FCD1525E5
2708WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\0172[1].jpgexecutable
MD5:66527EE46C0939B508607EFAB87B352D
SHA256:70E78C8FB63161BFBCB877FF9FB126DAFFD960CEAB3D209422161B109D53F60E
2708WScript.exeC:\Users\admin\AppData\Local\Temp\radB8286.tmpexecutable
MD5:66527EE46C0939B508607EFAB87B352D
SHA256:70E78C8FB63161BFBCB877FF9FB126DAFFD960CEAB3D209422161B109D53F60E
3804radB8286.tmpC:\ProgramData\Windows\csrss.exeexecutable
MD5:66527EE46C0939B508607EFAB87B352D
SHA256:70E78C8FB63161BFBCB877FF9FB126DAFFD960CEAB3D209422161B109D53F60E
2708WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2708
WScript.exe
GET
200
188.165.23.19:80
http://ladyawa.pl/wp-content/themes/edge/css/0172.jpg
PL
executable
1.22 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3804
radB8286.tmp
154.35.32.5:443
Rethem Hosting LLC
US
suspicious
3804
radB8286.tmp
76.73.17.194:9090
Cogent Communications
US
malicious
2708
WScript.exe
188.165.23.19:80
ladyawa.pl
OVH SAS
PL
suspicious

DNS requests

Domain
IP
Reputation
ladyawa.pl
  • 188.165.23.19
suspicious

Threats

PID
Process
Class
Message
2708
WScript.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2708
WScript.exe
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
2708
WScript.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
2708
WScript.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
2 ETPRO signatures available at the full report
No debug info