analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f1642209292.zip

Full analysis: https://app.any.run/tasks/977397cd-2f82-4b6a-ae8c-0a89fb5aae80
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 01:15:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
loader
rat
redline
stealer
vidar
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D1B2855320289D34316F45C6E3D59065

SHA1:

6A976AC887AC14AC67B9B8CCDAC7B5D7C97D1F9E

SHA256:

EFF7FD5659A327D68293C30DF9FED1D633877A722E02D2F534108939CA3A7099

SSDEEP:

3072:9Dt49qUqvyQdPv/rN+EKleG+RJ22v7TFK89qu2HfbcRJey2Inx05vbo:9Dt4gJvy+xU+RTOu2Dc3T2Ix05Do

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 1160)
      • Setup.exe (PID: 1420)
      • OracleSearch.exe (PID: 2672)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2848)
      • ToLqlgs1rpsOEiFHgRpk6mpt.exe (PID: 3504)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 296)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2444)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 3232)
      • siM5bGjFdchjpSExIcQ7Hulf.exe (PID: 3144)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • 63845806180.exe (PID: 2468)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • SqbfIqWLpO4v9JfnHirTRtlb.exe (PID: 1080)
      • 5433.tmp.exe (PID: 3172)
      • 53275277524.exe (PID: 2496)
      • neofim.exe (PID: 3168)
      • 0Yv7neEiD8yLhGgYkAuPjaxC.exe (PID: 2024)
      • Koxumaecuma.exe (PID: 3616)
      • foldershare.exe (PID: 2960)
      • 6DC8.tmp.exe (PID: 1524)
      • Laecuvafyky.exe (PID: 908)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 98CJ2d1mGyVg7FkMS2eEq2K1.exe (PID: 4336)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • FXxmbZ9n9PwHAiKKMZEiv253.exe (PID: 1364)
      • ckDmBlL8bRc8mIsi5nPa21JZ.exe (PID: 1468)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • Install.exe (PID: 2820)
      • Install.exe (PID: 3156)

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 2260)
      • svchost.exe (PID: 860)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Drops executable file immediately after starts

      • Setup.exe (PID: 1160)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)

    • Changes settings of System certificates

      • OracleSearch.exe (PID: 2672)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • Koxumaecuma.exe (PID: 3616)

    • Connects to CnC server

      • OracleSearch.exe (PID: 2672)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • RegAsm.exe (PID: 3528)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • neofim.exe (PID: 3168)

    • Disables Windows Defender

      • OracleSearch.exe (PID: 2672)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • REDLINE was detected

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • neofim.exe (PID: 3168)

    • Application was injected by another process

      • svchost.exe (PID: 860)

    • Runs injected code in another process

      • rundll32.exe (PID: 2016)

    • Steals credentials from Web Browsers

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • RegAsm.exe (PID: 3528)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Uses Task Scheduler to autorun other applications

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)

    • Uses Task Scheduler to run other applications

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • Install.exe (PID: 3156)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2176)
      • schtasks.exe (PID: 1248)

    • VIDAR was detected

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Stealing of credential data

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)

    • Loads dropped or rewritten executable

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • rundll32.exe (PID: 2016)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Changes the autorun value in the registry

      • ________djskjT76(((.exe (PID: 2312)

    • Unusual execution from Microsoft Office

      • foldershare.exe (PID: 2960)

    • Writes to a start menu file

      • 6DC8.tmp.exe (PID: 1524)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2260)
      • WinRAR.exe (PID: 2172)
      • OracleSearch.exe (PID: 2672)
      • Setup.exe (PID: 1160)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • siM5bGjFdchjpSExIcQ7Hulf.exe (PID: 3144)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RegAsm.exe (PID: 3528)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • 5433.tmp.exe (PID: 3172)
      • ________djskjT76(((.exe (PID: 2312)
      • AppLaunch.exe (PID: 3540)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Laecuvafyky.exe (PID: 908)
      • Koxumaecuma.exe (PID: 3616)
      • 53275277524.exe (PID: 2496)
      • foldershare.tmp (PID: 1400)
      • FolderShare.exe (PID: 3776)
      • AppLaunch.exe (PID: 1496)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • Install.exe (PID: 3156)
      • 63845806180.exe (PID: 2468)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • e5dde5c0-3314-4329-be40-a6574f7a9485.exe (PID: 8000)

    • Checks supported languages

      • Setup.exe (PID: 1160)
      • WinRAR.exe (PID: 2260)
      • WinRAR.exe (PID: 2172)
      • OracleSearch.exe (PID: 2672)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2848)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ToLqlgs1rpsOEiFHgRpk6mpt.exe (PID: 3504)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 296)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • siM5bGjFdchjpSExIcQ7Hulf.exe (PID: 3144)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2444)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 3232)
      • 5433.tmp.exe (PID: 3172)
      • ________djskjT76(((.exe (PID: 2312)
      • cmd.exe (PID: 3156)
      • 53275277524.exe (PID: 2496)
      • svchost.exe (PID: 860)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • 0Yv7neEiD8yLhGgYkAuPjaxC.exe (PID: 2024)
      • AppLaunch.exe (PID: 3540)
      • Koxumaecuma.exe (PID: 3616)
      • Laecuvafyky.exe (PID: 908)
      • 6DC8.tmp.exe (PID: 1524)
      • cmd.exe (PID: 3876)
      • foldershare.exe (PID: 2960)
      • foldershare.tmp (PID: 1400)
      • ckDmBlL8bRc8mIsi5nPa21JZ.exe (PID: 1468)
      • FolderShare.exe (PID: 3776)
      • AppLaunch.exe (PID: 1496)
      • FXxmbZ9n9PwHAiKKMZEiv253.exe (PID: 1364)
      • cmd.exe (PID: 1864)
      • 63845806180.exe (PID: 2468)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • cmd.exe (PID: 784)
      • Install.exe (PID: 2820)
      • SqbfIqWLpO4v9JfnHirTRtlb.exe (PID: 1080)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • Install.exe (PID: 3156)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • e5dde5c0-3314-4329-be40-a6574f7a9485.exe (PID: 8000)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 1160)
      • WinRAR.exe (PID: 2260)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • OracleSearch.exe (PID: 2672)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • ________djskjT76(((.exe (PID: 2312)
      • 6DC8.tmp.exe (PID: 1524)
      • 63845806180.exe (PID: 2468)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Koxumaecuma.exe (PID: 3616)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • Install.exe (PID: 3156)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)

    • Application launched itself

      • WinRAR.exe (PID: 2172)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2848)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 296)

    • Drops a file with a compile date too recent

      • Setup.exe (PID: 1160)
      • WinRAR.exe (PID: 2260)
      • OracleSearch.exe (PID: 2672)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ________djskjT76(((.exe (PID: 2312)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)

    • Checks for external IP

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • Adds / modifies Windows certificates

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • Koxumaecuma.exe (PID: 3616)

    • Drops a file that was compiled in debug mode

      • OracleSearch.exe (PID: 2672)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • ________djskjT76(((.exe (PID: 2312)
      • 6DC8.tmp.exe (PID: 1524)
      • 63845806180.exe (PID: 2468)
      • Koxumaecuma.exe (PID: 3616)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • Creates files in the user directory

      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • 6DC8.tmp.exe (PID: 1524)
      • 63845806180.exe (PID: 2468)

    • Executed via WMI

      • rundll32.exe (PID: 2016)

    • Creates a directory in Program Files

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ________djskjT76(((.exe (PID: 2312)
      • foldershare.tmp (PID: 1400)

    • Creates files in the program directory

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Drops a file with too old compile date

      • OracleSearch.exe (PID: 2672)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • ________djskjT76(((.exe (PID: 2312)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • Reads Windows owner or organization settings

      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • foldershare.tmp (PID: 1400)

    • Reads the Windows organization settings

      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • foldershare.tmp (PID: 1400)

    • Reads Environment values

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • 5433.tmp.exe (PID: 3172)
      • ________djskjT76(((.exe (PID: 2312)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • Laecuvafyky.exe (PID: 908)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Koxumaecuma.exe (PID: 3616)
      • AppLaunch.exe (PID: 3540)
      • 63845806180.exe (PID: 2468)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • AppLaunch.exe (PID: 1496)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Reads the cookies of Google Chrome

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • RegAsm.exe (PID: 3528)

    • Searches for installed software

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • AppLaunch.exe (PID: 1496)
      • AppLaunch.exe (PID: 3540)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Reads the cookies of Mozilla Firefox

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • RegAsm.exe (PID: 3528)

    • Starts CMD.EXE for commands execution

      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • forfiles.exe (PID: 2208)
      • forfiles.exe (PID: 2248)

    • Creates files in the Windows directory

      • svchost.exe (PID: 860)

    • Reads CPU info

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • 63845806180.exe (PID: 2468)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Starts Internet Explorer

      • Laecuvafyky.exe (PID: 908)

    • Starts CMD.EXE for self-deleting

      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1820)

    • Starts Microsoft Office Application

      • ________djskjT76(((.exe (PID: 2312)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 784)

    • Starts itself from another location

      • FXxmbZ9n9PwHAiKKMZEiv253.exe (PID: 1364)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3688)

  • INFO

    • Checks supported languages

      • NOTEPAD.EXE (PID: 824)
      • rundll32.exe (PID: 2016)
      • schtasks.exe (PID: 1248)
      • schtasks.exe (PID: 2176)
      • PING.EXE (PID: 348)
      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1820)
      • taskkill.exe (PID: 3164)
      • timeout.exe (PID: 2768)
      • forfiles.exe (PID: 2208)
      • cmd.exe (PID: 3068)
      • reg.exe (PID: 3052)
      • forfiles.exe (PID: 2248)
      • cmd.exe (PID: 3688)
      • reg.exe (PID: 2368)

    • Reads settings of System Certificates

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • ________djskjT76(((.exe (PID: 2312)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Laecuvafyky.exe (PID: 908)
      • iexplore.exe (PID: 1820)
      • Koxumaecuma.exe (PID: 3616)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • iexplore.exe (PID: 3792)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)

    • Checks Windows Trust Settings

      • OracleSearch.exe (PID: 2672)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • iexplore.exe (PID: 1820)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • iexplore.exe (PID: 3792)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)

    • Reads the computer name

      • rundll32.exe (PID: 2016)
      • schtasks.exe (PID: 2176)
      • schtasks.exe (PID: 1248)
      • PING.EXE (PID: 348)
      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1820)
      • taskkill.exe (PID: 3164)

    • Application was dropped or rewritten from another process

      • ________djskjT76(((.exe (PID: 2312)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)

    • Creates files in the program directory

      • ________djskjT76(((.exe (PID: 2312)
      • foldershare.tmp (PID: 1400)

    • Application launched itself

      • iexplore.exe (PID: 3792)

    • Changes internet zones settings

      • iexplore.exe (PID: 3792)

    • Creates a software uninstall entry

      • foldershare.tmp (PID: 1400)

    • Creates files in the user directory

      • iexplore.exe (PID: 1820)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1820)

    • Dropped object may contain Bitcoin addresses

      • OracleSearch.exe (PID: 2672)

    • Loads dropped or rewritten executable

      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • foldershare.tmp (PID: 1400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2022:01:15 04:01:01
ZipCRC: 0x51fa9d48
ZipCompressedSize: 137141
ZipUncompressedSize: 137088
ZipFileName: Setup.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
75
Malicious processes
29
Suspicious processes
12

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs notepad.exe no specs winrar.exe setup.exe no specs setup.exe oraclesearch.exe 4wqlnk0dcer3lp2xf6o1lim7.exe zn2pumnkov9mcrtuxcqg3flk.exe no specs ixt1donaxy7tlwzognobbguw.exe no specs ibvcpkcx4yf3fecm3p7tp_z_.exe #REDLINE zivktnar7w9xt_7bhdo2jpff.exe tolqlgs1rpsoeifhgrpk6mpt.exe esfzvcmtppicnkwlxbgkxn8d.exe no specs esfzvcmtppicnkwlxbgkxn8d.exe sim5bgjfdchjpsexicq7hulf.exe no specs zn2pumnkov9mcrtuxcqg3flk.exe no specs #VIDAR hxfg2stvcsfyj7fdxturywci.exe #REDLINE xm0yk3tw8ek6tsvgmq5wovie.exe rcqoz1u7z3966wgnhyjg6mhl.exe 8cgpjydlzmist6seagq4vr5o.exe #REDLINE hhzwrgvwqwakbkbsvddhjklm.exe #REDLINE regasm.exe rundll32.exe svchost.exe tlhakssf9ze42egceu2ycxuo.exe tlhakssf9ze42egceu2ycxuo.tmp ixt1donaxy7tlwzognobbguw.exe no specs 5433.tmp.exe no specs ________djskjt76(((.exe cmd.exe no specs 53275277524.exe cyysv7jizuzyn7jvmjsmh6th.exe schtasks.exe no specs schtasks.exe no specs 0yv7neeid8ylhggykaupjaxc.exe no specs #REDLINE applaunch.exe laecuvafyky.exe koxumaecuma.exe 6dc8.tmp.exe cmd.exe no specs ping.exe no specs iexplore.exe iexplore.exe foldershare.exe no specs foldershare.tmp no specs ckdmbll8brc8misi5npa21jz.exe no specs foldershare.exe no specs cmd.exe no specs #REDLINE applaunch.exe 63845806180.exe fxxmbz9n9pwhaikkmzeiv253.exe no specs #VIDAR sodmuhhpgbhjtrv6da70hbpi.exe cmd.exe no specs taskkill.exe no specs install.exe no specs sqbfiqwlpo4v9jfnhirtrtlb.exe no specs install.exe #REDLINE 1jhulqmnslcmske6ywr3oobi.exe forfiles.exe no specs forfiles.exe no specs timeout.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs 020z8fsk1qh9_iqhhrtqhamd.exe aorr6nrqysuw1apt6g1se8fz.exe reg.exe no specs naxx7bbat0yzhl8cxiegp8zb.exe e5dde5c0-3314-4329-be40-a6574f7a9485.exe no specs #REDLINE neofim.exe 17e09b54-912d-491f-8ac7-f4dfd9fe255f.exe no specs 98cj2d1mgyvg7fkms2eeq2k1.exe schtasks.exe no specs bc25hvakfqeitmwjfzidlixd.exe no specs rdavolifkuhwvqlopscyeu8l.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2172"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\f1642209292.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
824"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb2172.47376\password-is-485136.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2260"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb2172.48236\Setup.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1420"C:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\Setup.exe—WinRAR.exe
User:
admin
Company:
Setup
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
3221226540
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2260.48760\setup.exe
c:\windows\system32\ntdll.dll
1160"C:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\Setup.exe
WinRAR.exe
User:
admin
Company:
Setup
Integrity Level:
HIGH
Description:
Setup
Exit code:
1
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2260.48760\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2672"C:\Users\admin\AppData\Local\Temp\OracleSearch.exe" C:\Users\admin\AppData\Local\Temp\OracleSearch.exe
Setup.exe
User:
admin
Company:
React
Integrity Level:
HIGH
Description:
React Dispatcher
Version:
1.11020.9.51
Modules
Images
c:\users\admin\appdata\local\temp\oraclesearch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\imm32.dll
3568"C:\Users\admin\Pictures\Adobe Films\4WQLnK0dCeR3Lp2xf6O1LiM7.exe" C:\Users\admin\Pictures\Adobe Films\4WQLnK0dCeR3Lp2xf6O1LiM7.exe
OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\pictures\adobe films\4wqlnk0dcer3lp2xf6o1lim7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
2848"C:\Users\admin\Pictures\Adobe Films\zn2PumNkov9MCRtUxcQg3Flk.exe" C:\Users\admin\Pictures\Adobe Films\zn2PumNkov9MCRtUxcQg3Flk.exe—OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\pictures\adobe films\zn2pumnkov9mcrtuxcqg3flk.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
296"C:\Users\admin\Pictures\Adobe Films\ixT1donAxy7TlWzoGnObbGUw.exe" C:\Users\admin\Pictures\Adobe Films\ixT1donAxy7TlWzoGnObbGUw.exe—OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\adobe films\ixt1donaxy7tlwzognobbguw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3024"C:\Users\admin\Pictures\Adobe Films\iBvCPKCX4yF3fECm3p7Tp_z_.exe" C:\Users\admin\Pictures\Adobe Films\iBvCPKCX4yF3fECm3p7Tp_z_.exe
OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\adobe films\ibvcpkcx4yf3fecm3p7tp_z_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
Total events
99 093
Read events
98 134
Write events
944
Delete events
15

Modification events

(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2172) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\f1642209292.zip
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
116
Suspicious files
67
Text files
48
Unknown types
31

Dropped files

PID
Process
Filename
Type
1160Setup.exeC:\Users\admin\AppData\Local\Temp\OracleSearch.exeexecutable
MD5:02721CC2C7B951DEE87DFF82FA87012E
SHA256:BF822CE98236C3F2BC05701DEFB708B5710BB9404408DAD421F1D47B9B3EFB5A
2672OracleSearch.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\NiceProcessX32[1].bmpexecutable
MD5:A89561ABD740E80AA85B8E86EFE9A210
SHA256:E83F58825C02DB8659491FE6E3DECEC9ADA7040BAF22DE5957FA17477466CA46
2672OracleSearch.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3BEFA0CDBC5158FFAF209081F52BBA4F
SHA256:6919F882EE0185F7CA7C74B45ABCA5D5332BD8E4E5E9DDE3298F255A1BAD61B8
2260WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\bin0binary
MD5:8BAA182D2307FFE5B9FABFDF49A5D305
SHA256:58BD35BCEC9A36A79A4778799F24808EA43B0AEEF11F37C1F8D46739CDA2CCF3
2172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2172.47376\password-is-485136.txttext
MD5:9683880DB2FFBEC05BC75F9D697C776A
SHA256:345019657FD7F0473733333EDC275B195197774EF04D166C0CFA65EC7B76CBDB
2260WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\Setup.exeexecutable
MD5:7EB73699144F23CDD8E5139F12BDEC8C
SHA256:2415FFFB7AD3A2090EB8C53DF0719E0CF268C9003F024E1AA3DFBCF286D84758
2672OracleSearch.exeC:\Users\admin\Documents\Ei8DrAmaYu9K8ghN89CsjOW1.tmpbinary
MD5:57F492DB3101CA040176C4CEACCC8C5E
SHA256:9BFB00DFDF0BB2AD99D138F721260F2B3FB1BD7CDDEC20EC92291CF57EA63C4B
2672OracleSearch.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2672OracleSearch.exeC:\Users\admin\Pictures\Adobe Films\9EjFEV6qTIlMPihUeezSbSLl.exehtml
MD5:C8DDCE4DE7D2FD26927E6DB3D554AFD0
SHA256:4A47941324BC9F45254B507AA228D2652064B7277C7FCB0674D1E5FE7DC68467
2672OracleSearch.exeC:\Users\admin\Pictures\Adobe Films\4WQLnK0dCeR3Lp2xf6O1LiM7.exeexecutable
MD5:A89561ABD740E80AA85B8E86EFE9A210
SHA256:E83F58825C02DB8659491FE6E3DECEC9ADA7040BAF22DE5957FA17477466CA46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
142
TCP/UDP connections
301
DNS requests
129
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2672
OracleSearch.exe
HEAD
404
212.193.30.45:80
http://212.193.30.45/WW/file5.exe
RU
—
—
malicious
2672
OracleSearch.exe
HEAD
200
45.144.225.57:80
http://45.144.225.57/WW/search_target1kpd.exe
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
200
185.215.113.208:80
http://185.215.113.208/ferrari.exe
PT
—
—
malicious
2672
OracleSearch.exe
HEAD
200
45.144.225.57:80
http://45.144.225.57/download/NiceProcessX32.bmp
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
404
45.144.225.57:80
http://45.144.225.57/WW/sfx_123_310.exe
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
404
212.193.30.29:80
http://212.193.30.29/WW/file1.exe
RU
—
—
malicious
2672
OracleSearch.exe
GET
400
212.193.30.45:80
http://212.193.30.45/proxies.txt
RU
html
301 b
malicious
2672
OracleSearch.exe
GET
200
45.144.225.57:80
http://45.144.225.57/download/NiceProcessX32.bmp
unknown
executable
259 Kb
malicious
2672
OracleSearch.exe
GET
400
45.144.225.57:80
http://45.144.225.57/server.txt
unknown
html
301 b
malicious
2672
OracleSearch.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
45.144.225.57:80
—
—
—
malicious
2672
OracleSearch.exe
162.159.129.233:80
cdn.discordapp.com
Cloudflare Inc
—
shared
2672
OracleSearch.exe
2.56.59.42:80
—
—
—
malicious
2672
OracleSearch.exe
172.67.133.215:80
wfsdragon.ru
—
US
malicious
2672
OracleSearch.exe
212.193.30.45:80
—
—
RU
malicious
2672
OracleSearch.exe
104.23.98.190:443
pastebin.com
Cloudflare Inc
US
malicious
2672
OracleSearch.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
2672
OracleSearch.exe
162.159.130.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
2672
OracleSearch.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2672
OracleSearch.exe
172.67.75.166:443
db-ip.com
—
US
malicious

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
shared
wfsdragon.ru
  • 172.67.133.215
  • 104.21.5.208
malicious
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.134.233
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ipinfo.io
  • 34.117.59.81
shared
db-ip.com
  • 172.67.75.166
  • 104.26.4.15
  • 104.26.5.15
whitelisted
api.db-ip.com
  • 104.26.5.15
  • 104.26.4.15
  • 172.67.75.166
shared
stylesheet.faseaegasdfase.com
  • 85.209.157.230
malicious
xmtbsj.com
  • 91.224.22.193
suspicious

Threats

PID
Process
Class
Message
2672
OracleSearch.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
2672
OracleSearch.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2672
OracleSearch.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2672
OracleSearch.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
2672
OracleSearch.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2672
OracleSearch.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2672
OracleSearch.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2672
OracleSearch.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
2672
OracleSearch.exe
A Network Trojan was detected
ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin
2672
OracleSearch.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
324 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f1642209292.zip