analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

17-07-2019.ZIP

Full analysis: https://app.any.run/tasks/0d2467c6-9e5b-458e-93e0-87614e6ff12e
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: July 17, 2019, 07:54:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
redaman
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

18BB58FCCCDA893976BEE89A32D6351C

SHA1:

55FDC06229C979E8FD5688DE056F4491AFA20BCC

SHA256:

F2A0C280DF9A8B647FF173F9919F18FA5106567754753F8B25FAB0B3DE3547E1

SSDEEP:

3072:y7Txfl6BYlguE0K5OCp1chpaiUKIoC/0C9VoTbe33mMScVTFU330i+xZROmRo+K:yfZleQK54SiaoC/0CfSy3WWTF23ORfRE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Для оплаты июль.exe (PID: 2684)

    • Changes the autorun value in the registry

      • Для оплаты июль.exe (PID: 2684)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3192)
      • rundll32.exe (PID: 1092)
      • explorer.exe (PID: 284)

    • Loads the Task Scheduler COM API

      • rundll32.exe (PID: 1092)

    • REDAMAN was detected

      • rundll32.exe (PID: 3192)

  • SUSPICIOUS

    • Creates files in the user directory

      • explorer.exe (PID: 284)

    • Uses RUNDLL32.EXE to load library

      • Для оплаты июль.exe (PID: 2684)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3856)
      • Для оплаты июль.exe (PID: 2684)
      • rundll32.exe (PID: 1092)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 284)

    • Connects to server without host name

      • rundll32.exe (PID: 3192)

    • Creates files in the program directory

      • rundll32.exe (PID: 1092)

    • Executed via Task Scheduler

      • rundll32.exe (PID: 3192)

  • INFO

    • Manual execution by user

      • Для оплаты июль.exe (PID: 2684)
      • WinRAR.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0003
ZipCompression: Deflated
ZipModifyDate: 2019:07:17 09:25:05
ZipCRC: 0xe4504eb2
ZipCompressedSize: 226265
ZipUncompressedSize: 226183
ZipFileName: ??? ?????? ????.001
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe для оплаты июль.exe rundll32.exe #REDAMAN rundll32.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\17-07-2019.ZIP"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3856"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ä½n «»½áGd ¿e½8.001"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2684"C:\Users\admin\Desktop\Для оплаты июль.exe" C:\Users\admin\Desktop\Для оплаты июль.exe
explorer.exe
User:
admin
Company:
Корпорация Майкрософт
Integrity Level:
MEDIUM
Description:
Самоизвлечение CAB-файлов Win32
Exit code:
0
Version:
6.00.2900.5512 (xpsp.080413-2105)
1092rundll32.exe core.dll,DllGetClassObject dfsr 000000000000 Post Install program: <None>C:\Windows\system32\rundll32.exe
Для оплаты июль.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3192rundll32.exe "C:\ProgramData\2daf8815353e\2eac8b16363d.dat",DllGetClassObject dfsrC:\Windows\system32\rundll32.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
284C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 592
Read events
2 502
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
2864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2864.12452\ä½n «»½áGd ¿e½8.001 —
MD5:—
SHA256:—
284explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:A21145D7AD2BCFC0421D9F666D380A11
SHA256:ADA02AE9F9C732AF62A65B07A648254A9D9962B304077154C1B2E98790C7D0F4
2684Для оплаты июль.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\core.dllexecutable
MD5:9EC486A1CF423D8B339352C0710693F8
SHA256:6307CB8D53763A015AAD72B569D050B0AFD8CE6042DE8CC896715B8464351489
284explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019071720190718\index.datdat
MD5:B4BB393D7EADEDA400A00F588F994CB5
SHA256:973CA12B9065CD0CB743841E8F5C81CA24D459895BD4AB791960E870A32F95CB
284explorer.exeC:\Users\admin\Desktop\ä½n «»½áGd ¿e½8.001compressed
MD5:A894BE68FD8F16C527683C1E9EA93018
SHA256:4F66EAB78CE76D87863F28D1523AD5A2551E444311FB34D012A35A8DF8E5392C
284explorer.exeC:\Users\admin\Desktop\Для оплаты июль.exeexecutable
MD5:A08B179F55DD332140F909CFB3C8FBE3
SHA256:FAC0BC130B7BFACEF610521F2B83C15A9D288FD8080E75FFB20A57730979E85F
1092rundll32.exeC:\ProgramData\2daf8815353e\2eac8b16363d.datexecutable
MD5:9EC486A1CF423D8B339352C0710693F8
SHA256:6307CB8D53763A015AAD72B569D050B0AFD8CE6042DE8CC896715B8464351489
2864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2864.15905\ä½n «»½áGd ¿e½8.001compressed
MD5:A894BE68FD8F16C527683C1E9EA93018
SHA256:4F66EAB78CE76D87863F28D1523AD5A2551E444311FB34D012A35A8DF8E5392C
284explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\ä½n «»½áGd ¿e½8.001.lnklnk
MD5:F302301B9E96C1829539B14CEC9E0DDA
SHA256:BB14D6DDC978BA48BADC03C8D96DF2670170CDD27D8DA2233DF51D17CC3ECBE8
284explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:E4B26B98F723C2F97DF8F1C0B1CD5B55
SHA256:F7BFBFAD9F5BF18C241DF2EAFB20476AD08138A10240666BC7ABBAEF1CB9E212
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
rundll32.exe
POST
—
185.203.118.102:80
http://185.203.118.102/index.php
BG
—
—
malicious
3192
rundll32.exe
POST
200
195.123.246.225:80
http://195.123.246.225/index.php
UA
binary
9 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3192
rundll32.exe
104.25.47.99:443
chain.so
Cloudflare Inc
US
shared
3192
rundll32.exe
185.203.118.102:80
—
BelCloud Hosting Corporation
BG
malicious
3192
rundll32.exe
195.123.246.225:80
—
—
UA
suspicious

DNS requests

Domain
IP
Reputation
chain.so
  • 104.25.47.99
  • 104.25.48.99
whitelisted

Threats

PID
Process
Class
Message
3192
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan[Banker]/Win32.RTM
3192
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.RTM.N (Redaman)
3192
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Spy.RTM.N (Redaman)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
17-07-2019.ZIP