File name:

[Snipcola] Asshurt.rar

Full analysis: https://app.any.run/tasks/60444abd-17d8-42c2-bd8b-b643b464f61c
Verdict: Malicious activity
Analysis date: March 14, 2020, 21:34:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A7C000EA7C4EE80888EC8C9A3C5F8BEF

SHA1:

073BAFD906161B35D39777B122D7874288EDF895

SHA256:

E852C2FEB1CDED5D8CF161BF3530E1DED83661841BACB85ABF7011ECDC8F3FB8

SSDEEP:

393216:Vth8C7sZoTrefEP+GfvKiNi1Gm9GmxDpIm4NoyNHBHF4nCIto:f6o7+iKiNixDpt4NFNHBHSnCIm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Asshurt.exe (PID: 3336)

    • Loads dropped or rewritten executable

      • Asshurt.exe (PID: 3336)

  • SUSPICIOUS

    • Changes IE settings (feature browser emulation)

      • Asshurt.exe (PID: 3336)

    • Executable content was dropped or overwritten

      • Asshurt.exe (PID: 3336)
      • WinRAR.exe (PID: 3408)

    • Creates files in the user directory

      • Asshurt.exe (PID: 3336)

    • Reads internet explorer settings

      • Asshurt.exe (PID: 3336)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 3408)

    • Reads Internet Cache Settings

      • Asshurt.exe (PID: 3336)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3408)

    • Reads settings of System Certificates

      • Asshurt.exe (PID: 3336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe asshurt.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3408.10321\FastColoredTextBox.dllC:\Windows\system32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3336"C:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Asshurt.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Asshurt.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AssHurt
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3408.6032\asshurt\asshurt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3408"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
933
Read events
900
Write events
33
Delete events
0

Modification events

(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3408) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[Snipcola] Asshurt.rar
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
15
Suspicious files
10
Text files
1 190
Unknown types
4

Dropped files

PID
Process
Filename
Type
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Monaco\globalns.txttext
MD5:BA56C14634B7AE6FB585BE396ACF5F03
SHA256:5CB987E7C87F2F04CDD45F3A474FB2380BBF846534E38F2B485EAFC562B7B482
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Monaco\globalv.txttext
MD5:5CF9F238D4E62C8BCDE351651C3A2A45
SHA256:EEB98F2C9911AE8DDD25F1B3BE3732000F16788BDA60AA962E9F8452012B1062
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\MetroFramework.Fonts.dllexecutable
MD5:65EF4B23060128743CEF937A43B82AA3
SHA256:C843869AACA5135C2D47296985F35C71CA8AF4431288D04D481C4E46CC93EE26
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\FastColoredTextBox.dllexecutable
MD5:8610F4D3CDC6CC50022FEDDCED9FDAEB
SHA256:AC926C92CCFC3789A5AE571CC4415EB1897D500A79604D8495241C19ACDF01B9
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Asshurt.exeexecutable
MD5:5F2630506F57B492AA0FEA7B8B752337
SHA256:297D0B5D8102C5B6646D48688D928031D4CCC8E4400434638406383ADB7E78BB
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Bunifu_UI_v1.5.3.dllexecutable
MD5:E0EF2817EE5A7C8CD1EB837195768BD2
SHA256:76E1D3EC95FDEF74ABAF90392DD6F4AA5E344922ABF11E572707287D467F2930
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Monaco\classfunc.txttext
MD5:BF32E93D11011EB780619B3E17FB824A
SHA256:519DA000DE235C331F10660509FAB51A1815ACE566B8AE5B511B75813922DCB1
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Gravity_Switch.exeexecutable
MD5:A6CEAF8E4B44B37A7487A9152B9514C3
SHA256:3C9DD88809C6BFD1FB9439DBB4C5859DCA2A50918695443A85D3E118705ADB47
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\Monaco\Monaco.htmlhtml
MD5:999896134BD43CEFA865F37E514BA62F
SHA256:1ECDD9529EF5487F92736894D94FF680F6C32EE821615D29C0FC814F3A310B4A
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3408.6032\Asshurt\MetroFramework.dllexecutable
MD5:34EA7F7D66563F724318E322FF08F4DB
SHA256:C2C12D31B4844E29DE31594FC9632A372A553631DE0A0A04C8AF91668E37CF49
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3336
Asshurt.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
3336
Asshurt.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D
US
der
313 b
whitelisted
3336
Asshurt.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEA6m%2Bvqf2Tko8%2BzIIJ9atpw%3D
US
der
279 b
whitelisted
3336
Asshurt.exe
GET
200
151.139.128.14:80
http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3336
Asshurt.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3336
Asshurt.exe
151.139.128.14:80
ocsp.trust-provider.com
Highwinds Network Group, Inc.
US
suspicious
3336
Asshurt.exe
162.159.130.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
3336
Asshurt.exe
104.26.7.147:443
wearedevs.net
Cloudflare Inc
US
suspicious
3336
Asshurt.exe
104.26.6.147:443
wearedevs.net
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
wearedevs.net
  • 104.26.7.147
  • 104.26.6.147
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cdn.wearedevs.net
  • 104.26.6.147
  • 104.26.7.147
whitelisted
cdn.discordapp.com
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.129.233
shared
ocsp.trust-provider.com
  • 151.139.128.14
whitelisted
ocsp.comodoca4.com
  • 151.139.128.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[Snipcola] Asshurt.rar