download:

/asdfg.exe

Full analysis: https://app.any.run/tasks/f27e9d73-4065-458b-80f0-c8a8db173085
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: February 15, 2024, 06:11:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rhadamanthys
stealer
azorult
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1A917A85DCBB1D3DF5F4DD02E3A62873

SHA1:

567F528FEC8E7A4787F8C253446D8F1B620DC9D6

SHA256:

217FBF967C95D1359314FCD53AE8D04489EB3C7BDC1F22110D5A8A476D1FC92E

SSDEEP:

98304:LiWqg2DGA1VesIBquLgBwTudymWvOGAqVDjhTjThycwGOPRQYpKoh6g4nMrRjRcO:HyBsfbe0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3164)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2832)
      • powershell.exe (PID: 2560)

    • RHADAMANTHYS has been detected (SURICATA)

      • dialer.exe (PID: 3304)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2832)
      • powershell.exe (PID: 2560)

    • AZORULT has been detected (SURICATA)

      • h7fs8Fy$Qf.exe (PID: 3976)

    • Connects to the CnC server

      • h7fs8Fy$Qf.exe (PID: 3976)

    • Actions looks like stealing of personal data

      • dialer.exe (PID: 3304)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3164)
      • dialer.exe (PID: 3304)

    • Reads the Internet Settings

      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3892)
      • powershell.exe (PID: 2832)
      • h7fs8Fy$Qf.exe (PID: 3976)
      • powershell.exe (PID: 2560)

    • Application launched itself

      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3348)
      • BBLb.exe (PID: 1348)
      • AttributeString.exe (PID: 492)
      • h7fs8Fy$Qf.exe (PID: 2112)
      • InstallUtil.exe (PID: 2620)

    • Starts CMD.EXE for commands execution

      • BBLb.exe (PID: 3892)

    • Reads security settings of Internet Explorer

      • BBLb.exe (PID: 3892)
      • h7fs8Fy$Qf.exe (PID: 3976)
      • asdfg.exe (PID: 3864)

    • The executable file from the user directory is run by the CMD process

      • BBLb.exe (PID: 1348)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 3304)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2832)
      • powershell.exe (PID: 2560)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 2832)
      • powershell.exe (PID: 2560)
      • AttributeString.exe (PID: 492)

    • Loads DLL from Mozilla Firefox

      • dialer.exe (PID: 3304)

    • Reads browser cookies

      • dialer.exe (PID: 3304)

    • Searches for installed software

      • dialer.exe (PID: 3304)

    • Executed via WMI

      • h7fs8Fy$Qf.exe (PID: 2112)

    • Connects to unusual port

      • InstallUtil.exe (PID: 3528)

    • Accesses Microsoft Outlook profiles

      • dialer.exe (PID: 3304)

  • INFO

    • Checks supported languages

      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3348)
      • asdfg.exe (PID: 2920)
      • BBLb.exe (PID: 3892)
      • BBLb.exe (PID: 1348)
      • BBLb.exe (PID: 3164)
      • wmpenc.exe (PID: 2320)
      • AttributeString.exe (PID: 492)
      • h7fs8Fy$Qf.exe (PID: 2112)
      • AttributeString.exe (PID: 2176)
      • h7fs8Fy$Qf.exe (PID: 3976)
      • InstallUtil.exe (PID: 2620)
      • InstallUtil.exe (PID: 3528)

    • Reads the computer name

      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3348)
      • BBLb.exe (PID: 3892)
      • BBLb.exe (PID: 1348)
      • BBLb.exe (PID: 3164)
      • AttributeString.exe (PID: 492)
      • h7fs8Fy$Qf.exe (PID: 2112)
      • AttributeString.exe (PID: 2176)
      • h7fs8Fy$Qf.exe (PID: 3976)
      • InstallUtil.exe (PID: 2620)
      • InstallUtil.exe (PID: 3528)

    • Create files in a temporary directory

      • asdfg.exe (PID: 3864)

    • Reads the machine GUID from the registry

      • BBLb.exe (PID: 3348)
      • asdfg.exe (PID: 3864)
      • BBLb.exe (PID: 3892)
      • BBLb.exe (PID: 3164)
      • BBLb.exe (PID: 1348)
      • h7fs8Fy$Qf.exe (PID: 2112)
      • AttributeString.exe (PID: 2176)
      • h7fs8Fy$Qf.exe (PID: 3976)
      • InstallUtil.exe (PID: 2620)
      • InstallUtil.exe (PID: 3528)
      • wmpenc.exe (PID: 2320)
      • AttributeString.exe (PID: 492)

    • Creates files or folders in the user directory

      • BBLb.exe (PID: 3164)
      • dialer.exe (PID: 3304)

    • Reads product name

      • h7fs8Fy$Qf.exe (PID: 3976)

    • Reads Environment values

      • h7fs8Fy$Qf.exe (PID: 3976)

    • Checks proxy server information

      • h7fs8Fy$Qf.exe (PID: 3976)

    • Drops the executable file immediately after the start

      • dialer.exe (PID: 3304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:30 12:16:31+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 2229760
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2224fe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: native.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: native.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
17
Malicious processes
9
Suspicious processes
4

Behavior graph

Click at the process to see the details
start asdfg.exe bblb.exe no specs asdfg.exe bblb.exe no specs #RHADAMANTHYS dialer.exe cmd.exe bblb.exe no specs bblb.exe powershell.exe no specs wmpenc.exe no specs attributestring.exe no specs h7fs8fy$qf.exe no specs attributestring.exe no specs #AZORULT h7fs8fy$qf.exe installutil.exe no specs installutil.exe powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
492C:\Users\admin\AppData\Local\TypeId\fnnyy\AttributeString.exe C:\Users\admin\AppData\Local\TypeId\fnnyy\AttributeString.exe—taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\typeid\fnnyy\attributestring.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1348"C:\Users\admin\AppData\Local\Temp\BBLb.exe" C:\Users\admin\AppData\Local\Temp\BBLb.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\bblb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2112"C:\Users\admin\AppData\Local\Microsoft\h7fs8Fy$Qf.exe"C:\Users\admin\AppData\Local\Microsoft\h7fs8Fy$Qf.exe—WmiPrvSE.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\h7fs8fy$qf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2176C:\Users\admin\AppData\Local\TypeId\fnnyy\AttributeString.exeC:\Users\admin\AppData\Local\TypeId\fnnyy\AttributeString.exe—AttributeString.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\typeid\fnnyy\attributestring.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2320"C:\Program Files\Windows Media Player\wmpenc.exe"C:\Program Files\Windows Media Player\wmpenc.exe—dialer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Encoder Helper
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpenc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2560powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABBAHQAdAByAGkAYgB1AHQAZQBTAHQAcgBpAG4AZwAuAGUAeABlADsAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2620C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—AttributeString.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2832powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABBAHQAdAByAGkAYgB1AHQAZQBTAHQAcgBpAG4AZwAuAGUAeABlADsAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2896"C:\Windows\System32\cmd.exe" /k START "" "C:\Users\admin\AppData\Local\Temp\BBLb.exe" & EXITC:\Windows\System32\cmd.exe
BBLb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2920C:\Users\admin\AppData\Local\Temp\asdfg.exeC:\Users\admin\AppData\Local\Temp\asdfg.exe
asdfg.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\asdfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
Total events
16 351
Read events
16 184
Write events
161
Delete events
6

Modification events

(PID) Process:(3864) asdfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3864) asdfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3864) asdfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3864) asdfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2920) asdfg.exeKey:HKEY_CURRENT_USER\Software\SibCode
Operation:writeName:sn
Value:
(PID) Process:(3892) BBLb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3892) BBLb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3892) BBLb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3892) BBLb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2832) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
6
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
3864asdfg.exeC:\Users\admin\AppData\Local\Temp\BBLb.exeexecutable
MD5:71EB1BC6E6DA380C1CB552D78B391B2A
SHA256:CEFA92EE6CC2FAD86C49DD37D57FF8AFCB9B9ABEF0A110689E6D771394256BD6
2832powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:42E3956892291F5EE35E1B989213EF05
SHA256:D4E6947871B5FD00AD32F8707479DD6EC92AB65D8C6D157B1C0C3D99D575E468
2832powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF183fe2.TMPbinary
MD5:0268C3470C936E6FBAC2945B9E1C2099
SHA256:DF2AF58E8879B48826D8A418ED3B02CC8D484BCFC231C5B7A11BD153ED3998E9
2560powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:42E3956892291F5EE35E1B989213EF05
SHA256:D4E6947871B5FD00AD32F8707479DD6EC92AB65D8C6D157B1C0C3D99D575E468
3164BBLb.exeC:\Users\admin\AppData\Local\TypeId\fnnyy\AttributeString.exeexecutable
MD5:71EB1BC6E6DA380C1CB552D78B391B2A
SHA256:CEFA92EE6CC2FAD86C49DD37D57FF8AFCB9B9ABEF0A110689E6D771394256BD6
2832powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U5GAJ1YHJBBPH78L7ACP.tempbinary
MD5:42E3956892291F5EE35E1B989213EF05
SHA256:D4E6947871B5FD00AD32F8707479DD6EC92AB65D8C6D157B1C0C3D99D575E468
2832powershell.exeC:\Users\admin\AppData\Local\Temp\wjbafqzm.ldg.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2832powershell.exeC:\Users\admin\AppData\Local\Temp\pmeaosea.2hs.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2560powershell.exeC:\Users\admin\AppData\Local\Temp\fwrhopfr.add.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2560powershell.exeC:\Users\admin\AppData\Local\Temp\4chinhs3.2to.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
49
DNS requests
7
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3976
h7fs8Fy$Qf.exe
POST
200
91.215.85.223:80
http://parals.ac.ug/index.php
unknown
text
4 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3304
dialer.exe
194.50.153.126:443
pastratas.ac.ug
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3976
h7fs8Fy$Qf.exe
91.215.85.223:80
parals.ac.ug
—
RU
unknown
3528
InstallUtil.exe
94.156.69.145:58001
junks.ac.ug
Terasyst Ltd
BG
unknown
3528
InstallUtil.exe
94.156.69.145:58002
junks.ac.ug
Terasyst Ltd
BG
unknown
3528
InstallUtil.exe
94.156.69.145:58003
junks.ac.ug
Terasyst Ltd
BG
unknown

DNS requests

Domain
IP
Reputation
pastratas.ac.ug
  • 194.50.153.126
  • 185.196.21.45
unknown
parals.ac.ug
  • 91.215.85.223
unknown
nickshort.ug
  • —
unknown
kodedea.ug
  • —
unknown
junks.ac.ug
  • 94.156.69.145
unknown
ugas.ug
  • —
unknown
fillah.ac.ug
  • —
unknown

Threats

PID
Process
Class
Message
3304
dialer.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
3976
h7fs8Fy$Qf.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M2
9 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/asdfg.exe