File name:

Техническое Задание.rar

Full analysis: https://app.any.run/tasks/50b18c15-78b4-4099-859f-7484f0567aab
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: February 23, 2021, 19:03:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C2CB2129190DD0C2974557726652192C

SHA1:

5F47BA9EA9B6D094F6D4AE1CD3E0876CD0071C90

SHA256:

F8F3EC285EEBF2A4D26E70A31358EA193E5C60EF53E1645EC0F065728F25BBBA

SSDEEP:

3072:/DKW1LgppLRHMY0TBfJvjcTp5XCfR9yzGKDYyyKHs3onK95K/x4LpeRl:/DKW1Lgbdl0TBBvjc/CzDK8KHs3N9Zw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
    • REDLINE was detected

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
    • Application was dropped or rewritten from another process

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
      • Техническое Задание.scr (PID: 2492)
    • Actions looks like stealing of personal data

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
  • SUSPICIOUS

    • Reads Environment values

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
    • Reads the cookies of Google Chrome

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
    • Reads the cookies of Mozilla Firefox

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
    • Searches for installed software

      • Техническое Задание.scr (PID: 3656)
      • Техническое Задание.scr (PID: 3436)
      • Техническое Задание.scr (PID: 2532)
  • INFO

    • Manual execution by user

      • Техническое Задание.scr (PID: 2532)
      • Техническое Задание.scr (PID: 3656)
      • NOTEPAD.EXE (PID: 2984)
      • Техническое Задание.scr (PID: 3436)
      • Техническое Задание.scr (PID: 2492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #REDLINE техническое задание.scr #REDLINE техническое задание.scr notepad.exe no specs #REDLINE техническое задание.scr техническое задание.scr no specs

Process information

PID
CMD
Path
Indicators
Parent process
2444"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Техническое Задание.rar"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2492"C:\Users\admin\Desktop\Техническое Задание.scr" /SC:\Users\admin\Desktop\Техническое Задание.screxplorer.exe
User:
admin
Company:
FireEye Inc
Integrity Level:
MEDIUM
Description:
FireEye Client
Exit code:
0
Version:
1.2.3.1
Modules
Images
c:\users\admin\desktop\техническое задание.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2532"C:\Users\admin\Desktop\Техническое Задание.scr" /SC:\Users\admin\Desktop\Техническое Задание.scr
explorer.exe
User:
admin
Company:
FireEye Inc
Integrity Level:
MEDIUM
Description:
FireEye Client
Exit code:
0
Version:
1.2.3.1
Modules
Images
c:\users\admin\desktop\техническое задание.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2984"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\New Text Document.txtC:\Windows\system32\NOTEPAD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3436"C:\Users\admin\Desktop\Техническое Задание.scr" /SC:\Users\admin\Desktop\Техническое Задание.scr
explorer.exe
User:
admin
Company:
FireEye Inc
Integrity Level:
MEDIUM
Description:
FireEye Client
Exit code:
0
Version:
1.2.3.1
Modules
Images
c:\users\admin\desktop\техническое задание.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3656"C:\Users\admin\Desktop\Техническое Задание.scr" /SC:\Users\admin\Desktop\Техническое Задание.scr
explorer.exe
User:
admin
Company:
FireEye Inc
Integrity Level:
MEDIUM
Description:
FireEye Client
Exit code:
0
Version:
1.2.3.1
Modules
Images
c:\users\admin\desktop\техническое задание.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 424
Read events
2 366
Write events
58
Delete events
0

Modification events

(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2444) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2444) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Техническое Задание.rar
(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2444) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2444) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@shell32,-10162
Value:
Screen saver
Executable files
0
Suspicious files
0
Text files
18
Unknown types
1

Dropped files

PID
Process
Filename
Type
2444WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2444.39243\Техническое Задание.scr
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp23F7.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24B7.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24C8.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24DA.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24EC.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24ED.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24EE.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24EF.tmp
MD5:
SHA256:
2532Техническое Задание.scrC:\Users\admin\AppData\Local\Temp\tmp24FF.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
12
DNS requests
7
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2532
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
965 b
malicious
3436
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
965 b
malicious
3436
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
147 b
malicious
3436
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
250 b
malicious
3656
Техническое Задание.scr
POST
185.51.247.144:81
http://185.51.247.144:81/
UA
malicious
2532
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
250 b
malicious
2532
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
147 b
malicious
3656
Техническое Задание.scr
POST
200
185.51.247.144:81
http://185.51.247.144:81/
UA
text
965 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2532
Техническое Задание.scr
185.51.247.144:81
ITL Company
UA
malicious
2532
Техническое Задание.scr
104.26.13.31:443
api.ip.sb
Cloudflare Inc
US
suspicious
2532
Техническое Задание.scr
192.0.47.59:43
whois.iana.org
ICANN
US
unknown
2532
Техническое Задание.scr
199.5.26.46:43
WHOIS.ARIN.NET
ARIN Operations
US
suspicious
3656
Техническое Задание.scr
185.51.247.144:81
ITL Company
UA
malicious
3656
Техническое Задание.scr
104.26.12.31:443
api.ip.sb
Cloudflare Inc
US
suspicious
3656
Техническое Задание.scr
192.0.47.59:43
whois.iana.org
ICANN
US
unknown
3656
Техническое Задание.scr
199.5.26.46:43
WHOIS.ARIN.NET
ARIN Operations
US
suspicious
3436
Техническое Задание.scr
185.51.247.144:81
ITL Company
UA
malicious
3436
Техническое Задание.scr
104.26.12.31:443
api.ip.sb
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
api.ip.sb
  • 104.26.13.31
  • 172.67.75.172
  • 104.26.12.31
whitelisted
whois.iana.org
  • 192.0.47.59
whitelisted
WHOIS.ARIN.NET
  • 199.5.26.46
  • 199.71.0.46
  • 199.212.0.46
suspicious

Threats

PID
Process
Class
Message
A Network Trojan was detected
SPYWARE [PTsecurity] RedLine
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
A Network Trojan was detected
SPYWARE [PTsecurity] RedLine
A Network Trojan was detected
SPYWARE [PTsecurity] RedLine
9 ETPRO signatures available at the full report
No debug info