analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Valorant Hack 1.45.rar

Full analysis: https://app.any.run/tasks/0672ee9c-05eb-4717-9620-706b67e70869
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 04, 2022, 23:14:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
raccoon
recordbreaker
loader
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

00E82836721246AE8E5AC7C9664123A7

SHA1:

A749D04AB29CBCFACBF4E4D748CA6E6573282281

SHA256:

EEF9CAA109258960A7CACCDC37FDA621DB133656E3F0F58DE2F9CA939FB22AD9

SSDEEP:

98304:c+emgN9pQGMMEsu5EaG++BXeIKp5p53Sf5W6m6zfO08noM5KC76NYot37dK:femgfpQGMYu5EhBOHp57iRW6m6zfuomD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • RACCOON was detected

      • Injector.exe (PID: 968)
    • Connects to CnC server

      • Injector.exe (PID: 968)
    • Drops executable file immediately after starts

      • Injector.exe (PID: 968)
    • Loads dropped or rewritten executable

      • Injector.exe (PID: 968)
    • Stealing of credential data

      • Injector.exe (PID: 968)
    • Actions looks like stealing of personal data

      • Injector.exe (PID: 968)
    • Steals credentials from Web Browsers

      • Injector.exe (PID: 968)
  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3160)
      • Injector.exe (PID: 968)
    • Reads the computer name

      • WinRAR.exe (PID: 3160)
      • Injector.exe (PID: 968)
    • Executable content was dropped or overwritten

      • Injector.exe (PID: 968)
    • Drops a file with a compile date too recent

      • Injector.exe (PID: 968)
    • Reads Environment values

      • Injector.exe (PID: 968)
    • Reads the cookies of Google Chrome

      • Injector.exe (PID: 968)
    • Reads the cookies of Mozilla Firefox

      • Injector.exe (PID: 968)
    • Creates files in the user directory

      • Injector.exe (PID: 968)
    • Searches for installed software

      • Injector.exe (PID: 968)
  • INFO

    • Manual execution by user

      • Injector.exe (PID: 968)
    • Dropped object may contain Bitcoin addresses

      • Injector.exe (PID: 968)
      • WinRAR.exe (PID: 3160)
    • Checks Windows Trust Settings

      • Injector.exe (PID: 968)
    • Reads settings of System Certificates

      • Injector.exe (PID: 968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #RACCOON injector.exe

Process information

PID
CMD
Path
Indicators
Parent process
3160"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Valorant Hack 1.45.rar"C:\Program Files\WinRAR\WinRAR.exeExplorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
968"C:\Users\admin\Desktop\Valorant Hack 1.45\Injector.exe" C:\Users\admin\Desktop\Valorant Hack 1.45\Injector.exe
Explorer.EXE
User:
admin
Company:
The Enigma Protector Developers Team
Integrity Level:
HIGH
Description:
Software Protection Tool
Exit code:
0
Version:
1.2.3.4
Modules
Images
c:\users\admin\desktop\valorant hack 1.45\injector.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
6 939
Read events
6 883
Write events
56
Delete events
0

Modification events

(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3160) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Valorant Hack 1.45.rar
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3160) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
8
Suspicious files
4
Text files
60
Unknown types
7

Dropped files

PID
Process
Filename
Type
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\Injector.exe
MD5:
SHA256:
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 2401139622.dlltext
MD5:7241318C00202F71FCB595A42CA8A261
SHA256:60E04142BA89FF72219341368BC2E17986DD97A594F4D588D8D0121189420206
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex.dll
MD5:
SHA256:
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 2411265584.dlltext
MD5:DFC38F0779FED826B3BC136A641618A8
SHA256:32BA24E5B958021BA0263CD0328DE0D1785FD4A0826C644FA30E8638DB29C9E1
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 241422453.dlltext
MD5:E53E91C65830827544FFC2E4AFBDB7F1
SHA256:4727820BD3DA8E6CA18E0CFAEB289B5CCBA8619440569D71E7F7D66A61D1885D
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 2421258896.dlltext
MD5:80A4104AB1C107682E6A9EA5708FC251
SHA256:C1B75DE13FDB1CD635025B006D1267BA8E9D9CC98572F982219CC8B795045C14
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 2406413634.dlltext
MD5:F1F7F5AA9E4CAB20BCAE551D312081B0
SHA256:329956BE4BDAB1628A284D211C56382F3618983C5F07DF297813D810F2BAA2B6
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 241322453.dlltext
MD5:E53E91C65830827544FFC2E4AFBDB7F1
SHA256:4727820BD3DA8E6CA18E0CFAEB289B5CCBA8619440569D71E7F7D66A61D1885D
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 241718641.dlltext
MD5:81A91A23B0E727CED1EBA4AD79A2950A
SHA256:9799C6A20621C1E3A5043D66165FBA62E42C08501DFBD8DE9290DD4B7A22BE44
3160WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3160.44862\Valorant Hack 1.45\packages\ex 2412265584.dlltext
MD5:DFC38F0779FED826B3BC136A641618A8
SHA256:32BA24E5B958021BA0263CD0328DE0D1785FD4A0826C644FA30E8638DB29C9E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
968
Injector.exe
GET
200
81.19.141.45:80
http://81.19.141.45/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
DE
executable
612 Kb
malicious
968
Injector.exe
GET
200
81.19.141.45:80
http://81.19.141.45/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
DE
executable
668 Kb
malicious
968
Injector.exe
POST
200
81.19.141.45:80
http://81.19.141.45/03053a324d036983210b102525549f58
DE
text
8 b
malicious
968
Injector.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
968
Injector.exe
POST
200
81.19.141.45:80
http://81.19.141.45/
DE
text
8.35 Kb
malicious
968
Injector.exe
GET
200
81.19.141.45:80
http://81.19.141.45/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
DE
executable
438 Kb
malicious
968
Injector.exe
GET
200
81.19.141.45:80
http://81.19.141.45/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
DE
executable
1.95 Mb
malicious
968
Injector.exe
POST
200
81.19.141.45:80
http://81.19.141.45/03053a324d036983210b102525549f58
DE
text
8 b
malicious
968
Injector.exe
GET
200
81.19.141.45:80
http://81.19.141.45/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
DE
executable
78.2 Kb
malicious
968
Injector.exe
POST
200
81.19.141.45:80
http://81.19.141.45/03053a324d036983210b102525549f58
DE
text
8 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
968
Injector.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
968
Injector.exe
81.19.141.45:80
Global Internet Solutions LLC
DE
malicious
968
Injector.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
968
Injector.exe
162.159.130.233:443
cdn.discordapp.com
CLOUDFLARENET
shared

DNS requests

Domain
IP
Reputation
cdn.discordapp.com
  • 162.159.130.233
  • 162.159.135.233
  • 162.159.129.233
  • 162.159.134.233
  • 162.159.133.233
shared
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
968
Injector.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin
968
Injector.exe
A Network Trojan was detected
ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
968
Injector.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
968
Injector.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
No debug info