URL:

https://github.com/mertcuan/borat-rat/releases/download/borat/Borat.rar

Full analysis: https://app.any.run/tasks/174f6da8-2fdb-445e-8d07-c9d1b4604853
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: June 29, 2024, 19:37:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
limerat
trojan
Indicators:
MD5:

D20999CD4549BEAC11D7FFD65E7DAC96

SHA1:

1E51D3AF729A89879764426E89452C30C159BF0F

SHA256:

FF82C24F6B58E8CD04EF0A9FC1DA438E800D543881EE11D98CC30B8C5F3408EB

SSDEEP:

3:N8tEd4FtsqEnKkCldXB:2uuFSqEnKbdXB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 6768)
      • BoratRat.exe (PID: 6448)

    • Drops the executable file immediately after the start

      • BoratRat.exe (PID: 6448)

    • ASYNCRAT has been detected (YARA)

      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)

    • LimeRAT is detected

      • Client.exe (PID: 6632)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 6768)

    • The process checks if it is being run in the virtual environment

      • BoratRat.exe (PID: 6448)

    • Reads security settings of Internet Explorer

      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 4004)
      • StartMenuExperienceHost.exe (PID: 6868)

    • Executable content was dropped or overwritten

      • BoratRat.exe (PID: 6448)

    • Creates file in the systems drive root

      • Client.exe (PID: 6632)
      • BoratRat.exe (PID: 6448)

    • Starts CMD.EXE for commands execution

      • Client.exe (PID: 6632)
      • Client.exe (PID: 4004)

    • Executing commands from a ".bat" file

      • Client.exe (PID: 6632)

    • Reads the date of Windows installation

      • Client.exe (PID: 4004)
      • StartMenuExperienceHost.exe (PID: 6868)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 5344)

    • Executes application which crashes

      • BoratRat.exe (PID: 6448)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 6604)

    • The system shut down or reboot

      • cmd.exe (PID: 3396)

  • INFO

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 5392)

    • The process uses the downloaded file

      • chrome.exe (PID: 5420)
      • WinRAR.exe (PID: 6768)

    • Application launched itself

      • chrome.exe (PID: 5392)

    • Reads the computer name

      • TextInputHost.exe (PID: 3748)
      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)
      • Client.exe (PID: 4004)
      • Client.exe (PID: 2044)
      • PLUGScheduler.exe (PID: 6604)
      • StartMenuExperienceHost.exe (PID: 6868)
      • SearchApp.exe (PID: 5308)

    • Checks supported languages

      • TextInputHost.exe (PID: 3748)
      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)
      • Client.exe (PID: 4004)
      • Client.exe (PID: 2044)
      • PLUGScheduler.exe (PID: 6604)
      • StartMenuExperienceHost.exe (PID: 6868)
      • SearchApp.exe (PID: 5308)

    • Manual execution by a user

      • WinRAR.exe (PID: 6768)
      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)
      • Client.exe (PID: 2044)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6768)
      • chrome.exe (PID: 4136)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 5392)
      • WinRAR.exe (PID: 6768)
      • chrome.exe (PID: 4136)

    • Reads the machine GUID from the registry

      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)
      • Client.exe (PID: 4004)
      • Client.exe (PID: 2044)
      • SearchApp.exe (PID: 5308)

    • Create files in a temporary directory

      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)

    • Creates files or folders in the user directory

      • BoratRat.exe (PID: 6448)

    • Reads Environment values

      • BoratRat.exe (PID: 6448)
      • Client.exe (PID: 6632)
      • Client.exe (PID: 4004)

    • Reads the software policy settings

      • Client.exe (PID: 6632)
      • Client.exe (PID: 4004)

    • Disables trace logs

      • BoratRat.exe (PID: 6448)

    • Checks proxy server information

      • BoratRat.exe (PID: 6448)
      • SearchApp.exe (PID: 5308)

    • Process checks computer location settings

      • Client.exe (PID: 4004)
      • StartMenuExperienceHost.exe (PID: 6868)
      • SearchApp.exe (PID: 5308)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 6604)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 1832)

    • Process checks Internet Explorer phishing filters

      • SearchApp.exe (PID: 5308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
208
Monitored processes
42
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs textinputhost.exe no specs chrome.exe no specs rundll32.exe no specs winrar.exe #ASYNCRAT boratrat.exe chrome.exe no specs chrome.exe no specs #LIMERAT client.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs client.exe no specs chrome.exe no specs client.exe no specs cmd.exe no specs conhost.exe no specs shutdown.exe no specs werfault.exe no specs rundll32.exe no specs plugscheduler.exe no specs startmenuexperiencehost.exe no specs tiworker.exe no specs searchapp.exe no specs dllhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1924,i,12694830992097680930,9258616286063255631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1228C:\WINDOWS\system32\WerFault.exe -u -p 6448 -s 916C:\Windows\System32\WerFault.exe—BoratRat.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
3221226091
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
1596\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1632timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1768Shutdown /l /fC:\Windows\System32\shutdown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1784C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1832C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2044"C:\Users\admin\Desktop\Borat\Borat\Client.exe" C:\Users\admin\Desktop\Borat\Borat\Client.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.7.0
Modules
Images
c:\users\admin\desktop\borat\borat\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=840 --field-trial-handle=1924,i,12694830992097680930,9258616286063255631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2648"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1924,i,12694830992097680930,9258616286063255631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
53 211
Read events
52 929
Write events
257
Delete events
25

Modification events

(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(5392) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(5392) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
32
Suspicious files
313
Text files
48
Unknown types
42

Dropped files

PID
Process
Filename
Type
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1ae64a.TMP —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1ae65a.TMP —
MD5:—
SHA256:—
5392chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
5392chrome.exeC:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CRASHPAD\SETTINGS.DATbinary
MD5:FC81892AC822DCBB09441D3B58B47125
SHA256:FB077C966296D02D50CCBF7F761D2A3311A206A784A7496F331C2B0D6AD205C8
5392chrome.exeC:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\VARIATIONSbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
66
TCP/UDP connections
572
DNS requests
39
Threats
460

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
—
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
—
2872
MoUsoCoreWorker.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
—
3872
svchost.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
—
2872
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
—
3872
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
—
1968
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
—
1784
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
—
1784
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
—
3668
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
6244
chrome.exe
140.82.121.4:443
github.com
GITHUB
US
unknown
5392
chrome.exe
239.255.255.250:1900
—
—
—
unknown
6244
chrome.exe
108.177.127.84:443
accounts.google.com
GOOGLE
US
unknown
1544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6244
chrome.exe
185.199.111.133:443
objects.githubusercontent.com
FASTLY
US
unknown
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
unknown

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.4
unknown
accounts.google.com
  • 108.177.127.84
unknown
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.73
  • 40.126.31.73
unknown
objects.githubusercontent.com
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
unknown
go.microsoft.com
  • 23.35.238.131
unknown
www.google.com
  • 172.217.18.100
unknown
r.bing.com
  • 104.126.37.160
  • 104.126.37.146
  • 104.126.37.161
  • 104.126.37.123
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.179
  • 104.126.37.128
  • 104.126.37.131
unknown
self.events.data.microsoft.com
  • 20.189.173.12
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
unknown
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.145
  • 23.48.23.156
  • 23.48.23.180
  • 23.48.23.164
  • 23.48.23.166
  • 23.48.23.159
  • 23.48.23.194
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
—
—
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/mertcuan/borat-rat/releases/download/borat/Borat.rar