analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SearchKey.rar

Full analysis: https://app.any.run/tasks/4cdd3966-a385-41f0-aa7e-5278c4806624
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 25, 2021, 00:05:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
amadey
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B7AEAE0BBF761B45711EA3A0D71E2B7B

SHA1:

716A88F53AED18E2F476CAC1E4367D7D54C37A72

SHA256:

E66F04CDA8667F223CFDC809CF5C253A199A97150DB344CE1F6B827D4E1C624D

SSDEEP:

24576:ymKIa5wgJt2aIIRN7NT5RlsMP1RBPk6u+6C2cOFOuA9pXHkWDOR76SQ3C:ahJtBIiT5sM/r68KODnXHPOB6SSC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SearchKey.exe (PID: 276)
      • vms.exe (PID: 3960)
      • rnyuf.exe (PID: 1168)

    • Connects to CnC server

      • SearchKey.exe (PID: 276)
      • rnyuf.exe (PID: 1168)

    • REDLINE was detected

      • SearchKey.exe (PID: 276)

    • Actions looks like stealing of personal data

      • SearchKey.exe (PID: 276)

    • Steals credentials from Web Browsers

      • SearchKey.exe (PID: 276)

    • Drops executable file immediately after starts

      • vms.exe (PID: 3960)

    • Changes the Startup folder

      • reg.exe (PID: 2696)

    • Uses Task Scheduler to run other applications

      • rnyuf.exe (PID: 1168)

    • AMADEY was detected

      • rnyuf.exe (PID: 1168)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3692)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3036)
      • SearchKey.exe (PID: 276)
      • vms.exe (PID: 3960)
      • rnyuf.exe (PID: 1168)
      • cmd.exe (PID: 3468)

    • Reads the computer name

      • SearchKey.exe (PID: 276)
      • WinRAR.exe (PID: 3036)
      • vms.exe (PID: 3960)
      • rnyuf.exe (PID: 1168)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3036)
      • vms.exe (PID: 3960)
      • SearchKey.exe (PID: 276)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 3036)

    • Reads the cookies of Google Chrome

      • SearchKey.exe (PID: 276)

    • Reads Environment values

      • SearchKey.exe (PID: 276)

    • Starts itself from another location

      • vms.exe (PID: 3960)

    • Reads the cookies of Mozilla Firefox

      • SearchKey.exe (PID: 276)

    • Starts CMD.EXE for commands execution

      • rnyuf.exe (PID: 1168)

    • Drops a file with a compile date too recent

      • SearchKey.exe (PID: 276)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3468)

    • Searches for installed software

      • SearchKey.exe (PID: 276)

  • INFO

    • Reads settings of System Certificates

      • SearchKey.exe (PID: 276)

    • Checks supported languages

      • reg.exe (PID: 2696)
      • schtasks.exe (PID: 3692)

    • Reads the computer name

      • schtasks.exe (PID: 3692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe #REDLINE searchkey.exe vms.exe #AMADEY rnyuf.exe cmd.exe no specs schtasks.exe no specs reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
3036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SearchKey.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
276"C:\Users\admin\AppData\Local\Temp\Rar$EXb3036.038\SearchKey\SearchKey.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3036.038\SearchKey\SearchKey.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3960"C:\Users\admin\AppData\Local\Temp\vms.exe" C:\Users\admin\AppData\Local\Temp\vms.exe
SearchKey.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1168"C:\Users\admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe" C:\Users\admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe
vms.exe
User:
admin
Integrity Level:
MEDIUM
3468"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\admin\AppData\Local\Temp\5c436eadc6\C:\Windows\System32\cmd.exe—rnyuf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3692"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\admin\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /FC:\Windows\System32\schtasks.exe—rnyuf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2696REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\admin\AppData\Local\Temp\5c436eadc6\C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
7 098
Read events
6 994
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3960vms.exeC:\Users\admin\AppData\Local\Temp\15211302019708150072 —
MD5:—
SHA256:—
1168rnyuf.exeC:\Users\admin\AppData\Local\Temp\152113020197image
MD5:A25852D1A012459327BBCCBECE311B29
SHA256:8A8DECBA5B724B0EA4D230D734BF3B88838380977B6BD88D67BC2E95AD811E9B
276SearchKey.exeC:\Users\admin\AppData\Local\Temp\vms.exeexecutable
MD5:42BA46496EF72FC3BD4E5DA798A57889
SHA256:9F9140922DD951C9F2B19550B37F9B2A9E9F0E91EAE944D450985477D5215097
3960vms.exeC:\Users\admin\AppData\Local\Temp\5c436eadc6\rnyuf.exeexecutable
MD5:42BA46496EF72FC3BD4E5DA798A57889
SHA256:9F9140922DD951C9F2B19550B37F9B2A9E9F0E91EAE944D450985477D5215097
276SearchKey.exeC:\Users\admin\AppData\Local\Temp\WMlADAP.exeexecutable
MD5:28825DB687A3ED4212BFE23622596C11
SHA256:B9CFB2ADA212CFAAE78C274F3BD9CB82409E6B230D503024319E81E5E79FE251
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3036.038\SearchKey\SearchKey.exeexecutable
MD5:B8731F924034BDD7098547944BD6ECC4
SHA256:D9D58D04E684BDE2237B785D78EB9B7B8F1581DDDCB796D31C523B63A0F5CB94
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1168
rnyuf.exe
POST
200
178.208.83.45:80
http://depressionk1d.ug/k8FppT/index.php?scr=1
RU
—
—
malicious
1168
rnyuf.exe
POST
200
178.208.83.45:80
http://depressionk1d.ug/k8FppT/index.php
RU
text
6 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
276
SearchKey.exe
162.159.134.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
1168
rnyuf.exe
178.208.83.45:80
depressionk1d.ug
Webzilla B.V.
RU
malicious
276
SearchKey.exe
185.244.217.139:59111
—
—
—
malicious

DNS requests

Domain
IP
Reputation
cdn.discordapp.com
  • 162.159.134.233
  • 162.159.135.233
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.133.233
shared
depressionk1d.ug
  • 178.208.83.45
malicious

Threats

PID
Process
Class
Message
1168
rnyuf.exe
A Network Trojan was detected
ET TROJAN Amadey CnC Check-In
1168
rnyuf.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SearchKey.rar