File name:

redline2.exe

Full analysis: https://app.any.run/tasks/57a865eb-2010-4413-a8b4-d41ec1bf2392
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 02:19:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
amadey
stealc
auto
rdp
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

8F8BD202433540AA40F3D7B623645D78

SHA1:

3DDD36F82DFE14CF66EE5CCBDC038B469FB8CDFC

SHA256:

18AC5EE756CA3056D609698786D93C0B2A6387EDB60DD0A526D8C60BBA69DD51

SSDEEP:

98304:sn24Y5kC969FWbbl950ebBSTDBtWVZv+EJQPZ2k68dZnnzRlBVJzKEP1xZp+Z9QI:rRb9JU2i0Vss0q9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • STEALC has been found (auto)

      • redline2.exe (PID: 2284)

    • LUMMA has been found (auto)

      • g7h64.exe (PID: 2136)

    • AMADEY mutex has been found

      • 1r80E4.exe (PID: 3332)
      • rapes.exe (PID: 6112)
      • rapes.exe (PID: 1328)
      • rapes.exe (PID: 6228)
      • rapes.exe (PID: 2148)
      • rapes.exe (PID: 1240)
      • rapes.exe (PID: 5132)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • Stealers network behavior

      • svchost.exe (PID: 2196)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • STEALC has been detected

      • 3F19T.exe (PID: 1812)

    • AMADEY has been detected (YARA)

      • rapes.exe (PID: 6112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • redline2.exe (PID: 2284)
      • g7h64.exe (PID: 2136)
      • 1r80E4.exe (PID: 3332)

    • Starts a Microsoft application from unusual location

      • redline2.exe (PID: 2284)
      • g7h64.exe (PID: 2136)

    • Process drops legitimate windows executable

      • redline2.exe (PID: 2284)

    • Reads the BIOS version

      • 1r80E4.exe (PID: 3332)
      • rapes.exe (PID: 6112)
      • 2Z1366.exe (PID: 4452)
      • 3F19T.exe (PID: 1812)
      • rapes.exe (PID: 1328)
      • rapes.exe (PID: 6228)
      • rapes.exe (PID: 2148)
      • rapes.exe (PID: 5132)
      • rapes.exe (PID: 1240)

    • Reads security settings of Internet Explorer

      • 1r80E4.exe (PID: 3332)
      • rapes.exe (PID: 6112)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)

    • Starts itself from another location

      • 1r80E4.exe (PID: 3332)

    • The process executes via Task Scheduler

      • rapes.exe (PID: 1328)
      • rapes.exe (PID: 6228)
      • rapes.exe (PID: 2148)
      • rapes.exe (PID: 5132)
      • rapes.exe (PID: 1240)

    • There is functionality for enable RDP (YARA)

      • rapes.exe (PID: 6112)

  • INFO

    • The sample compiled with english language support

      • redline2.exe (PID: 2284)

    • Create files in a temporary directory

      • redline2.exe (PID: 2284)
      • g7h64.exe (PID: 2136)
      • 1r80E4.exe (PID: 3332)

    • Checks supported languages

      • redline2.exe (PID: 2284)
      • g7h64.exe (PID: 2136)
      • 1r80E4.exe (PID: 3332)
      • 2Z1366.exe (PID: 4452)
      • 3F19T.exe (PID: 1812)
      • rapes.exe (PID: 6112)
      • rapes.exe (PID: 1328)
      • rapes.exe (PID: 6228)
      • rapes.exe (PID: 2148)
      • rapes.exe (PID: 5132)
      • rapes.exe (PID: 1240)

    • Reads the computer name

      • 1r80E4.exe (PID: 3332)
      • rapes.exe (PID: 6112)
      • 2Z1366.exe (PID: 4452)
      • 3F19T.exe (PID: 1812)

    • Process checks computer location settings

      • 1r80E4.exe (PID: 3332)

    • Reads the software policy settings

      • 2Z1366.exe (PID: 4452)
      • slui.exe (PID: 6872)
      • slui.exe (PID: 5228)

    • Checks proxy server information

      • rapes.exe (PID: 6112)
      • slui.exe (PID: 5228)

    • Themida protector has been detected

      • rapes.exe (PID: 6112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6112) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)lv:
msi
Kaspersky Lab
av:
|
#
"
\App
00000422
dm:
Powershell.exe
ProgramData\
ps1
rundll32
http://
Content-Disposition: form-data; name="data"; filename="
SOFTWARE\Microsoft\Windows NT\CurrentVersion
5.21
dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
id:
VideoID
cred.dll|clip.dll|
0000043f
cmd
00000423
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
-executionpolicy remotesigned -File "
2022
------
2016
og:
\0000
CurrentBuild
2019
:::
S-%lu-
" && timeout 1 && del
ProductName
Panda Security
ESET
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/k
+++
?scr=1
Doctor Web
GET
SYSTEM\ControlSet001\Services\BasicDisplay\Video
/quiet
.jpg
vs:
sd:
rundll32.exe
"taskkill /f /im "
pc:
random
=
bb556cff4a
360TotalSecurity
<d>
wb
Content-Type: multipart/form-data; boundary=----
Startup
rapes.exe
Norton
176.113.115.6
&& Exit"
os:
https://
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2025
Avira
%-lu
zip
POST
" Content-Type: application/octet-stream
Rem
------
<c>
clip.dll
AVAST Software
\
shell32.dll
" && ren
e3
kernel32.dll
DefaultSettings.XResolution
d1
DefaultSettings.YResolution
r=
cred.dll
--
GetNativeSystemInfo
-%lu
ComputerName
&unit=
Keyboard Layout\Preload
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
ar:
Sophos
%USERPROFILE%
exe
e1
e2
st=s
Programs
0123456789
/Ni9kiput/index.php
un:
rb
bi:
abcdefghijklmnopqrstuvwxyz0123456789-_
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
Bitdefender
-unicode-
AVG
WinDefender
&&
shutdown -s -t 0
Comodo
00000419
Content-Type: application/x-www-form-urlencoded
/Plugins/
Main
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 6454784
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
19
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #STEALC redline2.exe #LUMMA g7h64.exe 1r80e4.exe sppextcomobj.exe no specs slui.exe #AMADEY rapes.exe 2z1366.exe #LUMMA svchost.exe #STEALC 3f19t.exe no specs rapes.exe no specs slui.exe rapes.exe no specs rapes.exe no specs rapes.exe no specs ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs rapes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1328"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1812C:\Users\admin\AppData\Local\Temp\IXP000.TMP\3F19T.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\3F19T.exe
redline2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\3f19t.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2136C:\Users\admin\AppData\Local\Temp\IXP000.TMP\g7h64.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\g7h64.exe
redline2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\g7h64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2148"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2284"C:\Users\admin\AppData\Local\Temp\redline2.exe" C:\Users\admin\AppData\Local\Temp\redline2.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\redline2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
2 142
Read events
2 139
Write events
3
Delete events
0

Modification events

(PID) Process:(6112) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6112) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6112) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2284redline2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\3F19T.exeexecutable
MD5:0D40B55E1F552DB81C2B8400E1F25558
SHA256:0B921636568EE3E1F8CE71FF9C931DA5675089BA796B65A6B212440425D63C8C
33321r80E4.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:4AFAE939B4028412A49667D82BFD12E6
SHA256:678FAA5C47726719F8483E7B74DFE48BCA64BA8202C1160C4AD097BA413461A8
33321r80E4.exeC:\Windows\Tasks\rapes.jobbinary
MD5:AC7F9BA3ED1144D7998E2726C3C2CFA4
SHA256:864CD1BEF0FF10C025529A5BE66E5B81DB596B4814B0B6A71E1C2AE170099716
2136g7h64.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\1r80E4.exeexecutable
MD5:4AFAE939B4028412A49667D82BFD12E6
SHA256:678FAA5C47726719F8483E7B74DFE48BCA64BA8202C1160C4AD097BA413461A8
2136g7h64.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\2Z1366.exeexecutable
MD5:D186C703E85FA3F4DFEEAAA48B1A83C7
SHA256:0FAC62C7BB069712650BDF37777E91E080A9D011EC241EE25F601ECB862B2247
2284redline2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\g7h64.exeexecutable
MD5:CB1B5CBE9E13F3FE4E7EDB1954B074C0
SHA256:2901C7B24AB0294CC12782630E66CCB35FEFC505DBE3658FE68C1324CD485EDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
44
DNS requests
29
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4692
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4692
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4452
2Z1366.exe
104.102.49.106:443
steamcommunity.com
AKAMAI-AS
DE
whitelisted
6112
rapes.exe
176.113.115.6:80
—
Red Bytes LLC
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
pepperiop.digital
  • —
unknown
jrxsafer.top
  • —
unknown
plantainklj.run
  • —
unknown
puerrogfh.live
  • —
unknown
quavabvc.top
  • —
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pepperiop .digital)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (jrxsafer .top)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (advennture .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (jrxsafer .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (plantainklj .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (advennture .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (puerrogfh .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quavabvc .top)
2196
svchost.exe
A Network Trojan was detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (targett .top)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
redline2.exe