File name:

YouTube view bot v2.1.2.rar

Full analysis: https://app.any.run/tasks/8050c870-024b-4e16-8a69-1c7dd087ca60
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 08, 2022, 22:29:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

017E4FE0FEBEF8503B2EA5E444CE0E01

SHA1:

B2BE93B51E95952C0D7E581EA591EFECBC6D22ED

SHA256:

F65365ABF19097958DE80EEA8551507D18FB3750D03B929CF0265E83B1C7FEF6

SSDEEP:

196608:GgkhGska3JJbY1Z+KXsR+vanMfo0pESlQ0IVlTPDhprbG:ugskaA/+B+ygojGIHTPDhpHG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3620)

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 2176)
      • Setup.exe (PID: 4060)
      • Setup.exe (PID: 1812)
      • Setup.exe (PID: 4204)
      • Setup.exe (PID: 160852)
      • Setup.exe (PID: 4336)
      • Setup.exe (PID: 3492)
      • Setup.exe (PID: 4316)
      • Setup.exe (PID: 6652)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3056)

    • Stealing of credential data

      • AppLaunch.exe (PID: 188604)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 188604)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3056)
      • Setup.exe (PID: 4060)
      • AppLaunch.exe (PID: 188604)
      • Setup.exe (PID: 4204)
      • AppLaunch.exe (PID: 3196)
      • Setup.exe (PID: 160852)
      • AppLaunch.exe (PID: 3412)
      • AppLaunch.exe (PID: 2008)
      • Setup.exe (PID: 3492)
      • Setup.exe (PID: 6652)

    • Reads the computer name

      • WinRAR.exe (PID: 3056)
      • AppLaunch.exe (PID: 188604)
      • AppLaunch.exe (PID: 3196)
      • AppLaunch.exe (PID: 3412)
      • AppLaunch.exe (PID: 2008)

    • Reads default file associations for system extensions

      • SearchProtocolHost.exe (PID: 3620)

    • Reads CPU info

      • AppLaunch.exe (PID: 188604)

    • Creates files in the program directory

      • AppLaunch.exe (PID: 188604)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3056)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3056)

    • Reads Environment values

      • AppLaunch.exe (PID: 188604)

    • Searches for installed software

      • AppLaunch.exe (PID: 188604)

  • INFO

    • Manual execution by user

      • Setup.exe (PID: 2176)
      • Setup.exe (PID: 1812)
      • Setup.exe (PID: 4204)
      • Setup.exe (PID: 4060)
      • Setup.exe (PID: 3492)
      • Setup.exe (PID: 160852)
      • Setup.exe (PID: 4336)
      • NOTEPAD.EXE (PID: 5016)
      • Setup.exe (PID: 4316)
      • Setup.exe (PID: 6652)

    • Reads settings of System Certificates

      • AppLaunch.exe (PID: 188604)

    • Checks Windows Trust Settings

      • AppLaunch.exe (PID: 188604)

    • Checks supported languages

      • NOTEPAD.EXE (PID: 5016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
16
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs setup.exe no specs setup.exe applaunch.exe setup.exe no specs setup.exe applaunch.exe no specs setup.exe no specs setup.exe applaunch.exe no specs setup.exe no specs setup.exe applaunch.exe no specs notepad.exe no specs setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
1812"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
2008"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2176"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
3056"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\YouTube view bot v2.1.2.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3196"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
3412"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
3492"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\apppatch\acgenral.dll
3620"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4060"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
4204"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
Total events
7 503
Read events
7 432
Write events
71
Delete events
0

Modification events

(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3056) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\YouTube view bot v2.1.2.rar
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3056) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
24
Suspicious files
6
Text files
13
Unknown types
28

Dropped files

PID
Process
Filename
Type
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dbghelp.dllexecutable
MD5:74EDBB03DE3291FCF2094AF1FB363F1D
SHA256:DCA9F45EFED8EAB442B491AEBDA3E3CCE7F5F9FC5DE527D2DBDFD85A5BE85DFA
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\data\project.xmlxml
MD5:2F304C0481C9C95D132D2704F6A17E85
SHA256:2CB8463D4F35B0226397F9968F27F138AD19A4071BF9700A82B97BF1C808D1A4
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\data\remote_settings.initext
MD5:F904D94BE2E4E5DD262E84FAE2884865
SHA256:EFC3A099238B9E63556B7B0342029830843072FFF4A721CE95ABCDAAA94F302C
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dll\DLL_AnalyzeGesturesInOne.dllexecutable
MD5:06302FA1044CE5F410B4E50B45EE89D0
SHA256:30EA045A8804AEA07D4C10A1B65029459D45075033DB71F91C5DDCE9C35656F1
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dll\DLL_MouseDeviceManager.dllexecutable
MD5:D9E11A2AB50B4FF6AD95EEE5FED3EB48
SHA256:A48D804C0732591B4C891AC2A7B32D0D627602B950FEC30143A5DAFD5AEE103B
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\borlndmm.dllexecutable
MD5:E3FCF256B4683AB92703842985B5E725
SHA256:CA1F509D6779BC005F332027D50E9BAFA952BCF970953593A9566973B4122759
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dll\DLL_MouseEventHook.dllexecutable
MD5:CE1FA57E863CCDC8CFE9AE58E51198DF
SHA256:B998518FE80B73D140D12E09A8BCC25E4C9E40E6623C6B86006693169B590A63
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dll\DLL_ZoomControl.dllexecutable
MD5:ADA979540911494C857A89AB110152EC
SHA256:02E887718CC03263E594C09D12777926A45CA7E82A9D8D9C7B4E4177A107F042
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dll\DLL_Wheel4D.dllexecutable
MD5:9D1E44B28200D8C3F34D00250F97ED9B
SHA256:6C2A2B0C2D005C4D1F434871B494C72D126EC8AF17ED43D34F80E2249078AFFD
3056WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3056.45673\YouTube view bot v2.1.2\dll\DLL_ScrollbarControl.dllexecutable
MD5:16AB9BDACDD35134895B8681D25089C0
SHA256:B751E0A0C31F31847948003C094D2F0C6024501048CE87F2C2E9274E1A5CC0FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
4
DNS requests
3
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
188604
AppLaunch.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQC2T6rhHiP0ng%3D%3D
US
der
1.74 Kb
whitelisted
188604
AppLaunch.exe
GET
200
95.217.246.234:80
http://95.217.246.234/1375
DE
text
107 b
malicious
188604
AppLaunch.exe
GET
200
95.217.246.234:80
http://95.217.246.234/8970337519.zip
DE
compressed
3.47 Mb
malicious
188604
AppLaunch.exe
POST
200
95.217.246.234:80
http://95.217.246.234/
DE
text
4 b
malicious
188604
AppLaunch.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
188604
AppLaunch.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
188604
AppLaunch.exe
GET
200
8.238.189.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0187ec2b89eea134
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
188604
AppLaunch.exe
8.238.189.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
188604
AppLaunch.exe
149.154.167.99:443
t.me
Telegram Messenger LLP
GB
malicious
188604
AppLaunch.exe
192.124.249.22:80
ocsp.godaddy.com
Sucuri
US
suspicious
188604
AppLaunch.exe
95.217.246.234:80
—
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
t.me
  • 149.154.167.99
whitelisted
ctldl.windowsupdate.com
  • 8.238.189.126
  • 8.248.139.254
  • 8.248.145.254
  • 67.27.159.254
  • 8.248.119.254
whitelisted
ocsp.godaddy.com
  • 192.124.249.22
  • 192.124.249.36
  • 192.124.249.24
  • 192.124.249.41
  • 192.124.249.23
whitelisted

Threats

PID
Process
Class
Message
188604
AppLaunch.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host ZIP Request
188604
AppLaunch.exe
A Network Trojan was detected
ET TROJAN W32/Agent.OGR!tr.pws Stealer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
YouTube view bot v2.1.2.rar