File name:

280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552

Full analysis: https://app.any.run/tasks/5f6e1972-0ce5-421a-b386-4231c2809954
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: January 10, 2025, 22:20:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
stealer
telegram
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

F28C3285968229B7E0C723633FB5C161

SHA1:

8BE784DCCFD84953C94642021A261A4459C68DF8

SHA256:

280344D8A94A23A0E351B1C1553ED3F1AE6DB9C06C75ECDA292211F5562DE552

SSDEEP:

49152:atNtm2+bHSew2K1biUNEZ1/SVCZq9dRR30gZxNvHg5ldMPjiiyObpFE5JnNs3sOQ:0N82eyrXRaq70q8dEWiyOLE5Xs3s0nh+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Actions looks like stealing of personal data

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Steals credentials from Web Browsers

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
    • The process creates files with name similar to system file names

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
    • Application launched itself

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
    • Reads security settings of Internet Explorer

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Possible usage of Discord/Telegram API has been detected (YARA)

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Checks Windows Trust Settings

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Checks for external IP

      • svchost.exe (PID: 2192)
      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • The process verifies whether the antivirus software is installed

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
  • INFO

    • Checks supported languages

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • The sample compiled with english language support

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
    • Creates files or folders in the user directory

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Create files in a temporary directory

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
    • Reads the computer name

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6276)
      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Checks proxy server information

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Reads the machine GUID from the registry

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Disables trace logs

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
    • Reads the software policy settings

      • 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe (PID: 6776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:24:36+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x34a5
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.0.0
ProductVersionNumber: 1.5.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: pleurosaurus obfuscates
CompanyName: mangler bronchia bedrevne
FileDescription: privatbil efterhaandsoplysning
FileVersion: 1.5.0.0
InternalName: supraocular tailorizes.exe
LegalCopyright: blindlandings
OriginalFileName: supraocular tailorizes.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe #SNAKEKEYLOGGER 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6276"C:\Users\admin\AppData\Local\Temp\280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe" C:\Users\admin\AppData\Local\Temp\280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
explorer.exe
User:
admin
Company:
mangler bronchia bedrevne
Integrity Level:
MEDIUM
Description:
privatbil efterhaandsoplysning
Exit code:
0
Version:
1.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6776"C:\Users\admin\AppData\Local\Temp\280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe" C:\Users\admin\AppData\Local\Temp\280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
User:
admin
Company:
mangler bronchia bedrevne
Integrity Level:
MEDIUM
Description:
privatbil efterhaandsoplysning
Version:
1.5.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
1 585
Read events
1 564
Write events
21
Delete events
0

Modification events

(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\Stormskadeserstatninger\Uninstall\Trsteprmie\kartoflerne
Operation:writeName:trsteges
Value:
0
(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLI\Start
Operation:writeName:CLI start
Value:
2
(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 49233920, i 0x3000, i 0x40)p.r2
(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::ReadFile(i r5, i r2, i 49233920,*i 0, i 0)
(PID) Process:(6276) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
user32::EnumWindows(i r2 ,i 0)
(PID) Process:(6776) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6776) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6776) 280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
14
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Iw\14-scaled.jpgimage
MD5:5C727AE28F0DECF497FBB092BAE01B4E
SHA256:77CCACF58330509839E17A6CFD6B17FE3DE31577D8E2C37DC413839BA2FEEC80
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Iw\Uncomeliness.Lbabinary
MD5:9414AC12239022414DCE454B2F9DA8A1
SHA256:4A977072857D8FCFDBE8ABFF9BE46A3809544B21848EF7106DACDB1624F7D23C
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Iw\Sensuousnesses.opkbinary
MD5:A4340182CDDD2EC1F1480360218343F9
SHA256:B91E5B1FF5756F0B93DCF11CBC8B467CDA0C5792DE24D27EC86E7C74388B44B3
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Iw\prepares.plibinary
MD5:B0FB6B583D6902DE58E1202D12BA4832
SHA256:E6EA5F6D0C7F5FA407269C7F4FF6D97149B7611071BF5BF6C454B810501AE661
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Iw\Kbmandsskole.strbinary
MD5:4D1D72CFC5940B09DFBD7B65916F532E
SHA256:479F1904096978F1011DF05D52021FAEEE028D4CF331024C965CED8AF1C8D496
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Iw\Hjforrdere.Pyrbinary
MD5:2B84547146C33EACE918454BBB321D1E
SHA256:D2CBB5A4E949819D3D6F1959AAFE1690993CFD926EE2E57C0E632D9BBE0039C3
6776280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
6276280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\Local\Temp\nsa5817.tmpbinary
MD5:9A9CCC3CCCE3305D7BF0D4EA385269AD
SHA256:486666369323B4030572089BABA690081877958623BE60CC383FE35A32BDFF9B
6776280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:92B839135741069B05829B07B6F3F3FB
SHA256:4AE12FEDBB424DA1938E2BF5B343DC175D9CDAAFD4123715BE68DDA9BB2F18C5
6776280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:47D1D9F17294F813620FA48617B7B10A
SHA256:AD8636616D7504B064D760DE3AD795AAC2ECB481DDDF6ABC2565F9775F0BA70F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
41
DNS requests
28
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6776
280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
GET
200
142.250.181.227:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
2220
RUXIMICS.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6776
280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
GET
200
142.250.181.227:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj
unknown
whitelisted
6776
280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
malicious
5432
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
6776
280344d8a94a23a0e351b1c1553ed3f1ae6db9c06c75ecda292211f5562de552.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
malicious
7136
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7136
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5732
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5064
SearchApp.exe
2.16.110.121:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
unknown
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
1176
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
2220
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
2220
RUXIMICS.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
unknown
google.com
  • 142.250.185.174
unknown
www.bing.com
  • 2.16.110.121
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
login.live.com
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.72
unknown
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.164
  • 23.48.23.173
unknown
www.microsoft.com
  • 23.52.120.96
  • 95.101.149.131
unknown
go.microsoft.com
  • 23.213.166.81
unknown
drive.google.com
  • 142.250.185.142
unknown
ocsp.pki.goog
  • 172.217.18.3
unknown

Threats

PID
Process
Class
Message
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
No debug info