analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

549c23278d248e811ccb8487b27ab635d0a71cf2a9eab95e656eb9dc9e64557a.zip

Full analysis: https://app.any.run/tasks/d3b3fa1a-44fb-47c7-86f9-4a9677192d2d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 08:30:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
stealer
masslogger
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D6A1F2C087E6ED0E18C7EA491FC70A01

SHA1:

EB2273CBFC4853CBB6C7AAA0C54BFC886B54B500

SHA256:

FB160A8E640553DA22EB9CF50CFAE7E69151FA40EF1DD14FC96B5CEC6E80964C

SSDEEP:

12288:bOiy5hJ1640W2/CfePKRftOlBsWyMDZe/A820q6WxVym:ij4W2/CfPLfW9kc9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MASSLOGGER was detected

      • InstallUtil.exe (PID: 2988)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2112)

    • Stealing of credential data

      • InstallUtil.exe (PID: 2988)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 2988)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2740)
      • powershell.exe (PID: 3308)

    • PowerShell script executed

      • powershell.exe (PID: 2740)

    • Reads Environment values

      • InstallUtil.exe (PID: 2988)

    • Checks for external IP

      • InstallUtil.exe (PID: 2988)

    • Starts CMD.EXE for commands execution

      • InstallUtil.exe (PID: 2988)

    • Checks supported languages

      • InstallUtil.exe (PID: 2988)

  • INFO

    • Manual execution by user

      • powershell.exe (PID: 2740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2020:09:30 08:29:19
ZipCRC: 0xc25d831c
ZipCompressedSize: 516408
ZipUncompressedSize: 1870735
ZipFileName: 549c23278d248e811ccb8487b27ab635d0a71cf2a9eab95e656eb9dc9e64557a.ps1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs powershell.exe no specs #MASSLOGGER installutil.exe cmd.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2552"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\549c23278d248e811ccb8487b27ab635d0a71cf2a9eab95e656eb9dc9e64557a.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2740"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Desktop\549c23278d248e811ccb8487b27ab635d0a71cf2a9eab95e656eb9dc9e64557a.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2988"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
2112"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe' & exitC:\Windows\system32\cmd.exe—InstallUtil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3308powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 027
Read events
869
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2740powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OM9YEJFOOJQQEV21P2C4.temp —
MD5:—
SHA256:—
2988InstallUtil.exeC:\Users\admin\AppData\Local\D04F4D4D0D\DotNetZip-gqrxvcwf.tmp —
MD5:—
SHA256:—
3308powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\89XCPFJDRRYGC99M5VSR.temp —
MD5:—
SHA256:—
2988InstallUtil.exeC:\Users\admin\AppData\Local\D04F4D4D0D\admin_United States_D04F4D4D0D_09-30-2020 9.30.56.zipcompressed
MD5:9EB837087BDF7020739AC7A9855FA611
SHA256:CDC3441C62F76BE09EBDB991ED172A18AD938639A9ADA02D99E011367B8768CE
3308powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF231f55.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
3308powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2740powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2740powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF22d0c7.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2552WinRAR.exeC:\Users\admin\Desktop\549c23278d248e811ccb8487b27ab635d0a71cf2a9eab95e656eb9dc9e64557a.ps1text
MD5:574AB20556BC71F14AD9FF1E2A1CAA76
SHA256:549C23278D248E811CCB8487B27AB635D0A71CF2A9EAB95E656EB9DC9E64557A
2988InstallUtil.exeC:\Users\admin\AppData\Local\D04F4D4D0D\Log.txttext
MD5:A49957D39989724D418FE582EDC82078
SHA256:CACB87DD6FDFDAEF4F8D66B2D2A3A188FBB4DA8AB6FC467B4630B098BAA85E5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2988
InstallUtil.exe
GET
200
54.235.83.248:80
http://api.ipify.org/
US
text
14 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2988
InstallUtil.exe
94.127.7.174:21
milebgd.mycpanel.rs
Serbia BroadBand-Srpske Kablovske mreze d.o.o.
RS
malicious
2988
InstallUtil.exe
64.233.184.108:587
smtp.gmail.com
Google Inc.
US
whitelisted
2988
InstallUtil.exe
54.235.83.248:80
api.ipify.org
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 54.235.83.248
  • 23.21.252.4
  • 23.21.126.66
  • 23.21.109.69
  • 54.227.255.202
  • 54.204.14.42
  • 174.129.214.20
  • 184.73.247.141
shared
milebgd.mycpanel.rs
  • 94.127.7.174
malicious
smtp.gmail.com
  • 64.233.184.108
shared

Threats

PID
Process
Class
Message
2988
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] External IP Lookup (possible MassLogger)
2988
InstallUtil.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
2988
InstallUtil.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2988
InstallUtil.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
549c23278d248e811ccb8487b27ab635d0a71cf2a9eab95e656eb9dc9e64557a.zip