We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
27 July 2020, 15:55
Analysis environment:
Windows 7 Pro, build 7601, x86
Win32.SofacyCarberp.exe
MD5:
36524C90CA1FAC2102E7653DFADB31B2
SHA1:
8D6DB316EA4E348021CB59CF3C6EC65C390F0497
SHA256:
FF808D0A12676BFAC88FD26F955154F8884F2BB7C534B9936510FD6296C543E8
Analysis result
Threat level:
Malicious activity
Tags:
trojan
apt
apt28
Full analysis:
Analysis Win32.SofacyCarberp.exe (MD5: 36524C90CA1FAC2102E7653DFADB31B2) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Changes the autorun value in the registry
Win32.SofacyCarberp.exe (PID: 700)
Loads dropped or rewritten executable
rundll32.exe (PID: 3528)
Changes settings of System certificates
rundll32.exe (PID: 3528)
APT28 was detected
rundll32.exe (PID: 3528)
SUSPICIOUS
Executable content was dropped or overwritten
Win32.SofacyCarberp.exe (PID: 700)
Uses RUNDLL32.EXE to load library
Win32.SofacyCarberp.exe (PID: 700)
Reads Internet Cache Settings
rundll32.exe (PID: 3528)
Adds / modifies Windows certificates
rundll32.exe (PID: 3528)
INFO
No info indicators.
Threats
No threats detected