[miso]

thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named Buster Sandbox Analyzer does the job well.

You can read about It here.

i personally use Sandboxie because i can't run VMs

[mothered]

i appreciate the info thank you very much.

You're most welcome.

When you have time, I'd be Interested to read how the tool performs.

ill notify you when i add the BSA and use it, i am currently focused on unity engine and same time learning c++

Thank you, no rush whatsoever.

[fritz]

thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named ]Buster Sandbox Analyzer does the job well.

You can read about It here.

Well the installer obviously is infected :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Code injection in process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Code injection in process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Code injection in process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Created a mutex named: IYDX2N3B35ZX7PK4HKLM Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\ANDROID TESTER.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\AUDIO\C.WAV Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\ACCOUNTMANAGER\ACCOUNT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\APPPROPERTIES\ACTIVITIES.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BAR\BLUETOOTH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BATTERY\B0FALSE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CALLSMANAGER\INCOMING.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CAMERA\FLASH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CHAT\C0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CTX_MENU\ACC.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DEVICO\ICON.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DPM\F.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEBOX\CAMERA.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEMANAGER\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FLAGS\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOCATION\ERRORIMAGE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOGO\LOGO.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\MICROPHONE\1SOUNDTEMPLATE\TEMPLATE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NETWORKSTATUS\MD2G.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NFD\NF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NOTE\NDOWN.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PAYLOAD\B0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PHONE\0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PINF\BATTERY.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\RE\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCREEN\KEY&SCREENOFF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCROLLBAR\BOTTOM-RIGHT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SKULLS\ATTACKS.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SMS\ALL.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TERMINAL\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TOOLSTRIP\0\CMD.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\W0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\WIN\0.ICO Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GEOIP\GEOIP.DAT Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GSM\GSM.DLL Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PAYLOAD\APKTOOL.ASCII Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLATFORM-TOOLS\PACK.INF Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLAYERJAVA\PLAYERJAVA.JAR Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\T\SS.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\XML\SETTINGS\ANDROIDTESTER.XML Created an event named: Global\CPFATE_1560_v4.0.30319 Created an event named: Global\CPFATE_3640_v4.0.30319 Created an event named: Global\CPFATE_4216_v4.0.30319 Created an event named: Global\CPFATE_5944_v4.0.30319 Created an event named: Global\CPFATE_6708_v4.0.30319 Created process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe, "C:\Users\root\AppData\Local\Temp\Gqyxwc.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe, "C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe, "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Defined file type created: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Defined file type created: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Defined file type created: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\{4WGW3Q1D-826409-4CNC3X-4CNC3XGK3F} = "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" .. Detected keylogger functionality Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got input locale identifiers Got system default language ID Queried DNS: dns.msftncsi.com Queried DNS: micromedia.sytes.net Queried DNS: Mju-49682.portmap.io Traces of Max++

And when I run the executable it looks almost clean (I'm not used to those reports) :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Checked for Microsoft Management Console software presence Created a mutex named: .NET CLR Data_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for Oracle_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for SqlServer_Perf_Library_Lock_PID_240 Created a mutex named: .NET Memory Cache 4.0_Perf_Library_Lock_PID_240 Created a mutex named: .NETFramework_Perf_Library_Lock_PID_240 Created a mutex named: BITS_Perf_Library_Lock_PID_240 Created a mutex named: ESENT_Perf_Library_Lock_PID_240 Created a mutex named: Global\CLR_PerfMon_WrapMutex Created a mutex named: Lsa_Perf_Library_Lock_PID_240 Created a mutex named: LSM_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC_Perf_Library_Lock_PID_240 Created a mutex named: MSSCNTRS_Perf_Library_Lock_PID_240 Created a mutex named: PerfDisk_Perf_Library_Lock_PID_240 Created a mutex named: PerfNet_Perf_Library_Lock_PID_240 Created a mutex named: PerfOS_Perf_Library_Lock_PID_240 Created a mutex named: PerfProc_Perf_Library_Lock_PID_240 Created a mutex named: rdyboost_Perf_Library_Lock_PID_240 Created a mutex named: RemoteAccess_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Spooler_Perf_Library_Lock_PID_240 Created a mutex named: TapiSrv_Perf_Library_Lock_PID_240 Created a mutex named: Tcpip_Perf_Library_Lock_PID_240 Created a mutex named: TermService_Perf_Library_Lock_PID_240 Created a mutex named: UGatherer_Perf_Library_Lock_PID_240 Created a mutex named: UGTHRSVC_Perf_Library_Lock_PID_240 Created a mutex named: usbhub_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: WmiApRpl_Perf_Library_Lock_PID_240 Created a mutex named: WSearchIdxPi_Perf_Library_Lock_PID_240 Created an event named: Global\CLR_PerfMon_DoneEnumEvent Created an event named: Global\CLR_PerfMon_StartEnumEvent Created an event named: Global\CPFATE_576_v4.0.30319 Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Data\Linkage\Export = .NET CLR Data Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Networking\Linkage\Export = .NET CLR Networking Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for Oracle\Linkage\Export = .NET Data Provider for Oracle Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for SqlServer\Linkage\Export = .NET Data Provider for SqlServer Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got computer name Locked screen Traces of Max++

I didn't go further yet, but despite that it seems to work as expected.

EDIT : Replaced Report.txt with Analysis.txt, much more concise

[mothered]

thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named ]Buster Sandbox Analyzer does the job well.

You can read about It here.

Well the installer obviously is infected :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Code injection in process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Code injection in process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Code injection in process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Created a mutex named: IYDX2N3B35ZX7PK4HKLM Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\ANDROID TESTER.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\AUDIO\C.WAV Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\ACCOUNTMANAGER\ACCOUNT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\APPPROPERTIES\ACTIVITIES.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BAR\BLUETOOTH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BATTERY\B0FALSE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CALLSMANAGER\INCOMING.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CAMERA\FLASH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CHAT\C0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CTX_MENU\ACC.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DEVICO\ICON.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DPM\F.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEBOX\CAMERA.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEMANAGER\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FLAGS\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOCATION\ERRORIMAGE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOGO\LOGO.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\MICROPHONE\1SOUNDTEMPLATE\TEMPLATE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NETWORKSTATUS\MD2G.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NFD\NF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NOTE\NDOWN.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PAYLOAD\B0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PHONE\0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PINF\BATTERY.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\RE\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCREEN\KEY&SCREENOFF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCROLLBAR\BOTTOM-RIGHT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SKULLS\ATTACKS.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SMS\ALL.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TERMINAL\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TOOLSTRIP\0\CMD.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\W0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\WIN\0.ICO Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GEOIP\GEOIP.DAT Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GSM\GSM.DLL Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PAYLOAD\APKTOOL.ASCII Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLATFORM-TOOLS\PACK.INF Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLAYERJAVA\PLAYERJAVA.JAR Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\T\SS.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\XML\SETTINGS\ANDROIDTESTER.XML Created an event named: Global\CPFATE_1560_v4.0.30319 Created an event named: Global\CPFATE_3640_v4.0.30319 Created an event named: Global\CPFATE_4216_v4.0.30319 Created an event named: Global\CPFATE_5944_v4.0.30319 Created an event named: Global\CPFATE_6708_v4.0.30319 Created process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe, "C:\Users\root\AppData\Local\Temp\Gqyxwc.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe, "C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe, "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Defined file type created: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Defined file type created: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Defined file type created: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\{4WGW3Q1D-826409-4CNC3X-4CNC3XGK3F} = "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" .. Detected keylogger functionality Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got input locale identifiers Got system default language ID Queried DNS: dns.msftncsi.com Queried DNS: micromedia.sytes.net Queried DNS: Mju-49682.portmap.io Traces of Max++

And when I run the executable it looks almost clean (I'm not used to those reports) :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Checked for Microsoft Management Console software presence Created a mutex named: .NET CLR Data_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for Oracle_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for SqlServer_Perf_Library_Lock_PID_240 Created a mutex named: .NET Memory Cache 4.0_Perf_Library_Lock_PID_240 Created a mutex named: .NETFramework_Perf_Library_Lock_PID_240 Created a mutex named: BITS_Perf_Library_Lock_PID_240 Created a mutex named: ESENT_Perf_Library_Lock_PID_240 Created a mutex named: Global\CLR_PerfMon_WrapMutex Created a mutex named: Lsa_Perf_Library_Lock_PID_240 Created a mutex named: LSM_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC_Perf_Library_Lock_PID_240 Created a mutex named: MSSCNTRS_Perf_Library_Lock_PID_240 Created a mutex named: PerfDisk_Perf_Library_Lock_PID_240 Created a mutex named: PerfNet_Perf_Library_Lock_PID_240 Created a mutex named: PerfOS_Perf_Library_Lock_PID_240 Created a mutex named: PerfProc_Perf_Library_Lock_PID_240 Created a mutex named: rdyboost_Perf_Library_Lock_PID_240 Created a mutex named: RemoteAccess_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Spooler_Perf_Library_Lock_PID_240 Created a mutex named: TapiSrv_Perf_Library_Lock_PID_240 Created a mutex named: Tcpip_Perf_Library_Lock_PID_240 Created a mutex named: TermService_Perf_Library_Lock_PID_240 Created a mutex named: UGatherer_Perf_Library_Lock_PID_240 Created a mutex named: UGTHRSVC_Perf_Library_Lock_PID_240 Created a mutex named: usbhub_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: WmiApRpl_Perf_Library_Lock_PID_240 Created a mutex named: WSearchIdxPi_Perf_Library_Lock_PID_240 Created an event named: Global\CLR_PerfMon_DoneEnumEvent Created an event named: Global\CLR_PerfMon_StartEnumEvent Created an event named: Global\CPFATE_576_v4.0.30319 Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Data\Linkage\Export = .NET CLR Data Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Networking\Linkage\Export = .NET CLR Networking Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for Oracle\Linkage\Export = .NET Data Provider for Oracle Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for SqlServer\Linkage\Export = .NET Data Provider for SqlServer Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got computer name Locked screen Traces of Max++

I didn't go further yet, but despite that it seems to work as expected.

EDIT : Replaced Report.txt with Analysis.txt, much more concise

In your view, do you believe the file contains any form of malicious Intent?

[fritz]

All good, no problem whatsoever.

A tool named ]Buster Sandbox Analyzer does the job well.

You can read about It here.

Well the installer obviously is infected :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Code injection in process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Code injection in process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Code injection in process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Created a mutex named: IYDX2N3B35ZX7PK4HKLM Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\ANDROID TESTER.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\AUDIO\C.WAV Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\ACCOUNTMANAGER\ACCOUNT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\APPPROPERTIES\ACTIVITIES.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BAR\BLUETOOTH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BATTERY\B0FALSE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CALLSMANAGER\INCOMING.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CAMERA\FLASH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CHAT\C0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CTX_MENU\ACC.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DEVICO\ICON.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DPM\F.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEBOX\CAMERA.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEMANAGER\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FLAGS\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOCATION\ERRORIMAGE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOGO\LOGO.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\MICROPHONE\1SOUNDTEMPLATE\TEMPLATE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NETWORKSTATUS\MD2G.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NFD\NF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NOTE\NDOWN.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PAYLOAD\B0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PHONE\0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PINF\BATTERY.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\RE\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCREEN\KEY&SCREENOFF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCROLLBAR\BOTTOM-RIGHT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SKULLS\ATTACKS.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SMS\ALL.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TERMINAL\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TOOLSTRIP\0\CMD.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\W0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\WIN\0.ICO Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GEOIP\GEOIP.DAT Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GSM\GSM.DLL Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PAYLOAD\APKTOOL.ASCII Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLATFORM-TOOLS\PACK.INF Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLAYERJAVA\PLAYERJAVA.JAR Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\T\SS.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\XML\SETTINGS\ANDROIDTESTER.XML Created an event named: Global\CPFATE_1560_v4.0.30319 Created an event named: Global\CPFATE_3640_v4.0.30319 Created an event named: Global\CPFATE_4216_v4.0.30319 Created an event named: Global\CPFATE_5944_v4.0.30319 Created an event named: Global\CPFATE_6708_v4.0.30319 Created process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe, "C:\Users\root\AppData\Local\Temp\Gqyxwc.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe, "C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe, "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Defined file type created: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Defined file type created: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Defined file type created: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\{4WGW3Q1D-826409-4CNC3X-4CNC3XGK3F} = "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" .. Detected keylogger functionality Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got input locale identifiers Got system default language ID Queried DNS: dns.msftncsi.com Queried DNS: micromedia.sytes.net Queried DNS: Mju-49682.portmap.io Traces of Max++

And when I run the executable it looks almost clean (I'm not used to those reports) :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Checked for Microsoft Management Console software presence Created a mutex named: .NET CLR Data_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for Oracle_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for SqlServer_Perf_Library_Lock_PID_240 Created a mutex named: .NET Memory Cache 4.0_Perf_Library_Lock_PID_240 Created a mutex named: .NETFramework_Perf_Library_Lock_PID_240 Created a mutex named: BITS_Perf_Library_Lock_PID_240 Created a mutex named: ESENT_Perf_Library_Lock_PID_240 Created a mutex named: Global\CLR_PerfMon_WrapMutex Created a mutex named: Lsa_Perf_Library_Lock_PID_240 Created a mutex named: LSM_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC_Perf_Library_Lock_PID_240 Created a mutex named: MSSCNTRS_Perf_Library_Lock_PID_240 Created a mutex named: PerfDisk_Perf_Library_Lock_PID_240 Created a mutex named: PerfNet_Perf_Library_Lock_PID_240 Created a mutex named: PerfOS_Perf_Library_Lock_PID_240 Created a mutex named: PerfProc_Perf_Library_Lock_PID_240 Created a mutex named: rdyboost_Perf_Library_Lock_PID_240 Created a mutex named: RemoteAccess_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Spooler_Perf_Library_Lock_PID_240 Created a mutex named: TapiSrv_Perf_Library_Lock_PID_240 Created a mutex named: Tcpip_Perf_Library_Lock_PID_240 Created a mutex named: TermService_Perf_Library_Lock_PID_240 Created a mutex named: UGatherer_Perf_Library_Lock_PID_240 Created a mutex named: UGTHRSVC_Perf_Library_Lock_PID_240 Created a mutex named: usbhub_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: WmiApRpl_Perf_Library_Lock_PID_240 Created a mutex named: WSearchIdxPi_Perf_Library_Lock_PID_240 Created an event named: Global\CLR_PerfMon_DoneEnumEvent Created an event named: Global\CLR_PerfMon_StartEnumEvent Created an event named: Global\CPFATE_576_v4.0.30319 Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Data\Linkage\Export = .NET CLR Data Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Networking\Linkage\Export = .NET CLR Networking Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for Oracle\Linkage\Export = .NET Data Provider for Oracle Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for SqlServer\Linkage\Export = .NET Data Provider for SqlServer Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got computer name Locked screen Traces of Max++

I didn't go further yet, but despite that it seems to work as expected.

EDIT : Replaced Report.txt with Analysis.txt, much more concise

In your view, do you believe the file contains any form of malicious Intent?

I'd say the installer has been corrupted, specially seeing those :

Code:

Created process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe, "C:\Users\root\AppData\Local\Temp\Gqyxwc.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe, "C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe, "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6

Plus there are definitively some weird DNS calls :

Code:

Queried DNS: dns.msftncsi.com Queried DNS: micromedia.sytes.net Queried DNS: Mju-49682.portmap.io

But maybe I could change something in the config to get more info about those queries (or just use wireshark)

The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io


EDIT : Oh and thank you mothered for suggesting BSA, really like this tool !

[mothered]

The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io

It seems Inconclusive at this stage.

Thanks for your analysis.

Oh and thank you mothered for suggesting BSA, really like this tool !

You're most welcome.

[fritz]

The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io

It seems Inconclusive at this stage.

Thanks for your analysis.

Yes of course I wouldn't recommend at all to use it, for sure not outside of a VM, imo it's more likely there are some other surprises.
But maybe they're obvious and we can find a workaround (if the program worth it)

[mothered]

Yes of course I wouldn't recommend at all to use it, for sure not outside of a VM, imo it's more likely there are some other surprises.

Absolutely.

Every tool of this nature, should be executed In a controlled environment. I never use my main Host/physical machine, regardless of the contributor.

[miso]

The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io

It seems Inconclusive at this stage.

Thanks for your analysis.

Oh and thank you mothered for suggesting BSA, really like this tool !

You're most welcome.

the application is a self extractor, it contains the application however its behind like 3 exes, the installer isn't corrupted but is just a obfuscated .NET application.

the report @fritz gave shows 2 lists, one with the extracted files while the other (i think) is about the registry calls. the first one shows the 3 malicious apps & the actual application files.
@fritz even though opening the application (even in a controlled environment) helps, try to not load malwares at all since we don't really know what can be in them beforehand

[fritz]

the application is a self extractor, it contains the application however its behind like 3 exes, the installer isn't corrupted but is just a obfuscated .NET application.

the report @fritz gave shows 2 lists, one with the extracted files while the other (i think) is about the registry calls. the first one shows the 3 malicious apps & the actual application files.

Sorry if I wasn't very clear, the first list is the installer analysis and the second one is the app itself (just launched it, not using any feature).

@fritz even though opening the application (even in a controlled environment) helps, try to not load malwares at all since we don't really know what can be in them beforehand

Thanks but no worry, I don't mind taking some risks for the sake of curiosity.