Analysis date (UTC): 14 February 2026, 10:12Analysis environment: Windows 10 Pro, build 19044, x64

https://eron4u.com/xezz/builds/Loader.zip

MD5:C4A6A8D0D9D468CD5A5688BFBC2F08A1

SHA1:ED7469EB12BC34F4EAFF44314B5DB1DF342623F5

SHA256:1D143D4ED36A1B6E260A4598D0F1D201CEBC4BEAFCBD27D3C2FB692B6199BDA8

Analysis result

Threat level:Malicious activity

Tags:

arch-execpythonstealeranti-evasionevasionantivmrustfingerprinting

Full analysis:Analysis https://eron4u.com/xezz/builds/Loader.zip Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Actions looks like stealing of personal data

Loader.exe (PID: 4936)

Steals credentials from Web Browsers

Loader.exe (PID: 4936)

Get Video Controller Information (POWERSHELL)

cmd.exe (PID: 6208)

Opens a text file (SCRIPT)

cscript.exe (PID: 7428)

SUSPICIOUS

Starts a Microsoft application from unusual location

Loader.exe (PID: 8052)
Loader.exe (PID: 6360)
Loader.exe (PID: 1188)

Process drops legitimate windows executable

chrome.exe (PID: 9208)
Loader.exe (PID: 6360)

Executable content was dropped or overwritten

Loader.exe (PID: 6360)
Loader.exe (PID: 1188)
Loader.exe (PID: 4936)

Process drops python dynamic module

Loader.exe (PID: 6360)
Loader.exe (PID: 1188)

The process drops C-runtime libraries

Loader.exe (PID: 6360)

Loads Python modules

Loader.exe (PID: 4936)
Loader.exe (PID: 7956)

Using the short paths format

Loader.exe (PID: 4936)
Loader.exe (PID: 7956)

Get information on the list of running processes

cmd.exe (PID: 1508)
cmd.exe (PID: 4064)
cmd.exe (PID: 2280)
cmd.exe (PID: 5728)
cmd.exe (PID: 1084)
cmd.exe (PID: 7760)
cmd.exe (PID: 7920)
cmd.exe (PID: 1212)
cmd.exe (PID: 6432)
cmd.exe (PID: 684)
Loader.exe (PID: 4936)
cmd.exe (PID: 7476)
cmd.exe (PID: 5604)
cmd.exe (PID: 7448)
cmd.exe (PID: 1872)
cmd.exe (PID: 4280)
cmd.exe (PID: 5100)
cmd.exe (PID: 8892)
cmd.exe (PID: 7376)
cmd.exe (PID: 2096)
cmd.exe (PID: 7028)
cmd.exe (PID: 8860)
cmd.exe (PID: 2572)
cmd.exe (PID: 5448)
cmd.exe (PID: 8672)
cmd.exe (PID: 7272)
cmd.exe (PID: 1944)
cmd.exe (PID: 8148)
cmd.exe (PID: 2496)
cmd.exe (PID: 8636)
cmd.exe (PID: 4200)
cmd.exe (PID: 5736)
cmd.exe (PID: 7392)
cmd.exe (PID: 7372)
cmd.exe (PID: 8488)
cmd.exe (PID: 5012)
cmd.exe (PID: 3552)
cmd.exe (PID: 7932)
cmd.exe (PID: 8320)
cmd.exe (PID: 8716)
cmd.exe (PID: 6864)
cmd.exe (PID: 6472)
cmd.exe (PID: 9112)
cmd.exe (PID: 5736)
cmd.exe (PID: 5260)
cmd.exe (PID: 2824)
cmd.exe (PID: 4020)
cmd.exe (PID: 8700)
cmd.exe (PID: 6300)
cmd.exe (PID: 4196)
cmd.exe (PID: 2376)

Reads the BIOS version

Loader.exe (PID: 4936)

Uses TASKKILL.EXE to kill Browsers

cmd.exe (PID: 4916)
cmd.exe (PID: 3584)
cmd.exe (PID: 5404)

Hides command output

cmd.exe (PID: 4916)
cmd.exe (PID: 3584)
cmd.exe (PID: 5404)

Starts CMD.EXE for commands execution

Loader.exe (PID: 4936)

Executes application which crashes

chrome.exe (PID: 7948)
msedge.exe (PID: 6796)

There is functionality for VM detection VMWare (YARA)

Loader.exe (PID: 4936)

There is functionality for VM detection VirtualBox (YARA)

Loader.exe (PID: 4936)

Uses WMIC.EXE to obtain Windows Installer data

Loader.exe (PID: 4936)

Possible stealing of messenger data

Loader.exe (PID: 4936)

Accesses product unique identifier via WMI (SCRIPT)

WMIC.exe (PID: 5308)
WMIC.exe (PID: 8168)
WMIC.exe (PID: 8716)

Starts POWERSHELL.EXE for commands execution

cmd.exe (PID: 1784)
cmd.exe (PID: 8064)
cmd.exe (PID: 6208)
cmd.exe (PID: 7652)

Possible stealing from crypto wallets

Loader.exe (PID: 4936)

Reads data from a binary Stream object (SCRIPT)

cscript.exe (PID: 7428)

Uses WMI to retrieve WMI-managed resources (SCRIPT)

cscript.exe (PID: 7428)

Creates FileSystem object to access computer's file system (SCRIPT)

cscript.exe (PID: 7428)

Executes WMI query (SCRIPT)

cscript.exe (PID: 7428)

Gets full path of the running script (SCRIPT)

cscript.exe (PID: 7428)

Uses NETSH.EXE to obtain data on the network

cmd.exe (PID: 5728)

Checks for external IP

Loader.exe (PID: 4936)

Searches for installed software

Loader.exe (PID: 4936)

Reads the date of Windows installation

Loader.exe (PID: 4936)

INFO

Drops script file

msedge.exe (PID: 6784)
Loader.exe (PID: 4936)
Loader.exe (PID: 7956)
powershell.exe (PID: 1368)
powershell.exe (PID: 1044)
cscript.exe (PID: 7428)
powershell.exe (PID: 6336)
powershell.exe (PID: 4304)
msedge.exe (PID: 4876)

Manual execution by a user

Loader.exe (PID: 8052)
Loader.exe (PID: 6360)
Loader.exe (PID: 1188)
msedge.exe (PID: 6784)

Application launched itself

chrome.exe (PID: 7992)
msedge.exe (PID: 6784)

Checks supported languages

Loader.exe (PID: 6360)
Loader.exe (PID: 7956)
Loader.exe (PID: 4936)
Loader.exe (PID: 1188)
WinSystemAuth.exe (PID: 792)
identity_helper.exe (PID: 6484)

Creates files or folders in the user directory

Loader.exe (PID: 6360)
Loader.exe (PID: 4936)
Loader.exe (PID: 1188)

The sample compiled with english language support

Loader.exe (PID: 6360)

Checks proxy server information

Loader.exe (PID: 4936)
WerFault.exe (PID: 6992)
slui.exe (PID: 7960)

Reads the computer name

Loader.exe (PID: 7956)
Loader.exe (PID: 4936)
identity_helper.exe (PID: 6484)

Reads CPU info

Loader.exe (PID: 4936)

Create files in a temporary directory

Loader.exe (PID: 4936)

Application based on Rust

Loader.exe (PID: 4936)

There is functionality for taking screenshot (YARA)

Loader.exe (PID: 4936)

Reads security settings of Internet Explorer

WMIC.exe (PID: 5308)
WMIC.exe (PID: 8168)
cscript.exe (PID: 7428)
WMIC.exe (PID: 8716)

Checks operating system version

Loader.exe (PID: 4936)

Reads the machine GUID from the registry

Loader.exe (PID: 4936)

Displays MAC addresses of computer network adapters

getmac.exe (PID: 6936)

Reads Environment values

identity_helper.exe (PID: 6484)

Threats

PID	Process	Class	Message
2292	svchost.exe	Misc activity	INFO [ANY.RUN] Google DNS-over-HTTPS service requested (dns. google)
4936	Loader.exe	Misc activity	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)
2292	svchost.exe	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
4936	Loader.exe	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
6880	msedge.exe	Misc activity	ET INFO Temporary File Hosting Domain in DNS Lookup (tmpfiles .org)
6880	msedge.exe	Misc activity	ET INFO Temporary File Hosting Domain in DNS Lookup (tmpfiles .org)
6880	msedge.exe	Misc activity	INFO [ANY.RUN] Temporary File Share Service (tmpfiles .org)
6880	msedge.exe	Misc activity	ET INFO Temporary File Hosting Domain in DNS Lookup (tmpfiles .org)
6880	msedge.exe	Misc activity	INFO [ANY.RUN] Temporary File Share Service (tmpfiles .org)
6880	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)

Rows per page