File name: | Revenge-RAT v0.3.zip |
Full analysis: | https://app.any.run/tasks/3b658127-fff3-4c52-bcc9-64d2de332140 |
Verdict: | Malicious activity |
Analysis date: | January 25, 2022, 01:35:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 731F7D2D071ACE35AB51AFAEA9B01FC5 |
SHA1: | 918A1D049030DBBD1D2C8541999AF7E43FBC0353 |
SHA256: | FB8769780B09D900272DE8F4E293144F35E737FA6EC0038792AC08B5B491D28C |
SSDEEP: | 393216:V8xVGp8RmL6eHGjRMua4AYS0wXJ645x+fDi:6xVGp8Fpjha4ABSDi |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Revenge-RAT v0.3/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2021:12:19 17:09:15 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3836 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Revenge-RAT v0.3.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 | ||||
4072 | "C:\Users\admin\Desktop\Revenge-RAT v0.3\Revenge-Rat v0.3.exe" | C:\Users\admin\Desktop\Revenge-RAT v0.3\Revenge-Rat v0.3.exe | Explorer.EXE | |
User: admin Company: melody Integrity Level: MEDIUM Description: bladderdishonest Exit code: 3762507597 Version: 18.28.48.45 | ||||
3912 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) | ||||
3748 | dw20.exe -x -s 828 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe | — | Revenge-Rat v0.3.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Error Reporting Shim Exit code: 0 Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400) | ||||
3640 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Revenge-RAT Client Source Code.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
3784 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3640.21063\.suo | C:\Windows\system32\rundll32.exe | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1164 | "C:\Users\admin\Desktop\Revenge-RAT v0.3\Revenge-Rat v0.3.exe" | C:\Users\admin\Desktop\Revenge-RAT v0.3\Revenge-Rat v0.3.exe | Explorer.EXE | |
User: admin Company: melody Integrity Level: MEDIUM Description: bladderdishonest Exit code: 3762507597 Version: 18.28.48.45 | ||||
2720 | dw20.exe -x -s 828 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe | — | Revenge-Rat v0.3.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Error Reporting Shim Exit code: 0 Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400) |
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Revenge-RAT v0.3.zip | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3836) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-04\3-45-31 PM.log | text | |
MD5:39EFAE9B2E32107BA2277BF541D5DB23 | SHA256:C7C3AA82034725D85F61A3AECFA19EE1BCF20292CB512A05C62F8F51CF13563B | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-04\3-35-28 PM.log | text | |
MD5:1397AF170E83031C1EE070D3D02F8E71 | SHA256:2F04BD465D78F6772DF1703770070F29132F654E4BFEDD07674802C162B8E47D | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-11-30\1-12-57 PM.log | text | |
MD5:1BED574F3F2238FC092C413F0D0AE4A6 | SHA256:CFA704D5E9E788C417D7B826E1384D211D80E5A813F8A6470F608C30834F9E3A | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-04\3-50-57 PM.log | text | |
MD5:D904C37993038C24E52320BBD9EFDA66 | SHA256:008BE9850B6828605BE97230D9F27D302BA1E904CCD793D9FBB4AC590009EE45 | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-04\3-05-44 PM.log | text | |
MD5:8B02CFA8B6036F60380F988212F19B7D | SHA256:6A4EB49935BE8F3FDBD22AAE6D14E4AE4FD564D6F8C399F67A27E5EB6B798302 | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-05\1-39-21 PM.log | text | |
MD5:DE025115AD55A46F118FAA32087524C5 | SHA256:D07A68378BDD0D3A14C804CC050D459B214DBC4D118309BF85784633A62E19A2 | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Config.XML | xml | |
MD5:2AE683E41394007AD63610EBE983D5AC | SHA256:D9A358D3EED9FFF77DCC77B09A1C949926793F0D60D093A9ED6C35298942412D | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-01\12-40-34 PM.log | text | |
MD5:B4FABB43BF1A0A63A02B5ADA5CBFA5E5 | SHA256:4785A4E07DA723725A1AFE64FEA5D863552DFFF0C2B571D4ABF916F290791B2A | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-04\3-48-26 PM.log | text | |
MD5:D0268569D5869687E68007D3EC9C1248 | SHA256:93D6514FAE112CFF259F1398FEA5F18E376E6E3FCF8D98BC38DBFD687F81191B | |||
3836 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3836.18362\Revenge-RAT v0.3\Database\2021-12-04\3-44-09 PM.log | text | |
MD5:63E59B67005B2DC496E3AABB5B3FDCA6 | SHA256:BD944D3A083D6F06E33C233DA1F45A5CC52A56F1363C581188300BD8C03E69A0 |