File name:

Akira Client.zip.zip

Full analysis: https://app.any.run/tasks/521ede2f-380e-4d01-a30a-e1982dc6f4b9
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 26, 2023, 11:53:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
netsupport
remote
unwanted
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

168C53A46A9BE431DC81829F663EA7C6

SHA1:

D7D2DAF929FD8DB3483D9A5D2EF187FC21C73568

SHA256:

2A1D0F433CB37965C86F48A462E6E5E3BB9E781C13AD8D3E6A265416A358E39C

SSDEEP:

49152:dXaZUxcoCN9EEuwdv2VpCHhrI6oRHsGiPDwRgl8EjZBm0Yc2WUKOFGVB0jmEeM8a:MWxQN2zcv2VpOI6oRHLiPF8yzQ2OFGVE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Akira Client.exe (PID: 3216)
      • Akira Client.exe (PID: 3140)
      • setup.exe (PID: 2728)
      • Akira Client.tmp (PID: 3200)
      • setup.tmp (PID: 3332)
      • a1.exe (PID: 3252)
      • a1.tmp (PID: 3240)

    • NETSUPPORT has been detected (SURICATA)

      • wmiprvse.exe (PID: 3512)

    • Connects to the CnC server

      • wmiprvse.exe (PID: 3512)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 3060)

    • Reads the Windows owner or organization settings

      • Akira Client.tmp (PID: 3200)
      • setup.tmp (PID: 3332)
      • a1.tmp (PID: 3240)

    • Reads the Internet Settings

      • Akira Client.tmp (PID: 3200)
      • setup.tmp (PID: 3332)
      • cmd.exe (PID: 3456)
      • wmiprvse.exe (PID: 3512)
      • a2.exe (PID: 3136)

    • Reads security settings of Internet Explorer

      • setup.tmp (PID: 3332)

    • Searches for installed software

      • setup.tmp (PID: 3332)

    • Reads settings of System Certificates

      • setup.tmp (PID: 3332)

    • Checks Windows Trust Settings

      • setup.tmp (PID: 3332)

    • The process drops C-runtime libraries

      • expand.exe (PID: 4020)
      • a1.tmp (PID: 3240)

    • Process drops legitimate windows executable

      • expand.exe (PID: 4020)
      • a1.tmp (PID: 3240)

    • Starts CMD.EXE for commands execution

      • a1.tmp (PID: 3240)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4044)

    • Adds/modifies Windows certificates

      • setup.exe (PID: 2728)

    • Connects to the server without a host name

      • wmiprvse.exe (PID: 3512)

    • Connects to unusual port

      • wmiprvse.exe (PID: 3512)

    • Process requests binary or script from the Internet

      • setup.tmp (PID: 3332)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 476)
      • WinRAR.exe (PID: 1444)
      • Akira Client.exe (PID: 3216)
      • wmpnscfg.exe (PID: 2896)
      • msedge.exe (PID: 3020)
      • wmpnscfg.exe (PID: 2492)

    • Checks supported languages

      • Akira Client.exe (PID: 3216)
      • Akira Client.tmp (PID: 2336)
      • Akira Client.exe (PID: 3140)
      • Akira Client.tmp (PID: 3200)
      • wmpnscfg.exe (PID: 2896)
      • setup.exe (PID: 2728)
      • setup.tmp (PID: 3332)
      • a1.exe (PID: 3252)
      • a1.tmp (PID: 3240)
      • a2.exe (PID: 3136)
      • wmiprvse.exe (PID: 3512)
      • wmpnscfg.exe (PID: 2492)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 476)
      • expand.exe (PID: 4020)

    • Create files in a temporary directory

      • Akira Client.exe (PID: 3216)
      • Akira Client.exe (PID: 3140)
      • Akira Client.tmp (PID: 3200)
      • setup.tmp (PID: 3332)
      • setup.exe (PID: 2728)
      • a1.exe (PID: 3252)
      • a1.tmp (PID: 3240)
      • a2.exe (PID: 3136)

    • Reads the computer name

      • Akira Client.tmp (PID: 2336)
      • Akira Client.tmp (PID: 3200)
      • wmpnscfg.exe (PID: 2896)
      • setup.tmp (PID: 3332)
      • a1.tmp (PID: 3240)
      • wmiprvse.exe (PID: 3512)
      • a2.exe (PID: 3136)
      • wmpnscfg.exe (PID: 2492)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2896)
      • setup.tmp (PID: 3332)
      • wmiprvse.exe (PID: 3512)
      • wmpnscfg.exe (PID: 2492)
      • a2.exe (PID: 3136)

    • Creates files in the program directory

      • Akira Client.tmp (PID: 3200)
      • a1.tmp (PID: 3240)
      • expand.exe (PID: 4020)

    • Checks proxy server information

      • setup.tmp (PID: 3332)
      • wmiprvse.exe (PID: 3512)
      • a2.exe (PID: 3136)

    • Drop NetSupport executable file

      • expand.exe (PID: 4020)

    • Creates files or folders in the user directory

      • setup.tmp (PID: 3332)
      • wmiprvse.exe (PID: 3512)
      • a2.exe (PID: 3136)

    • Application launched itself

      • msedge.exe (PID: 3020)
      • msedge.exe (PID: 3340)

    • Reads mouse settings

      • a2.exe (PID: 3136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2023:11:26 11:53:28
ZipCRC: 0x98f371ab
ZipCompressedSize: 1112171
ZipUncompressedSize: 1672076
ZipFileName: Akira Client.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
46
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs akira client.exe no specs akira client.tmp no specs akira client.exe akira client.tmp wmpnscfg.exe no specs setup.exe no specs setup.tmp a1.exe no specs a1.tmp no specs cmd.exe no specs expand.exe no specs cmd.exe no specs reg.exe no specs #NETSUPPORT wmiprvse.exe cmd.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs a2.exe msedge.exe no specs msedge.exe no specs ntvdm.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4012 --field-trial-handle=1300,i,6864843825782331572,2517805395823771171,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
476"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Akira Client.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
824"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3368 --field-trial-handle=1300,i,6864843825782331572,2517805395823771171,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
880"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2560 --field-trial-handle=1300,i,6864843825782331572,2517805395823771171,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
900"cmd.exe" /c expand C:\Users\admin\AppData\Local\Temp\is-7O47F.tmp\{app}\tkveum.cab -F:* %ProgramData%C:\Windows\System32\cmd.exe—a1.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1356"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3404 --field-trial-handle=1300,i,6864843825782331572,2517805395823771171,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1444"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Akira Client.zip.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1496"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1508 --field-trial-handle=1300,i,6864843825782331572,2517805395823771171,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1840"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1300,i,6864843825782331572,2517805395823771171,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xf0,0x6b38f598,0x6b38f5a8,0x6b38f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
17 055
Read events
16 839
Write events
203
Delete events
13

Modification events

(PID) Process:(3060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
47
Suspicious files
129
Text files
80
Unknown types
0

Dropped files

PID
Process
Filename
Type
3060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3060.12776\Akira Client.zipcompressed
MD5:7FD8217E14266181C56D1DF82D8AD3B3
SHA256:A07E0F99658E8583199ECECA656B98974779BB840CB8D52C6A13B26FE78E0729
3200Akira Client.tmpC:\Program Files\Akira Client.exe\unins000.datbinary
MD5:9A460DA584008D4175ABD95065E52E04
SHA256:7CFD3AE891E17E242D6BD3FD178DD59719370E219085C73A7398B46D9B1DA521
3216Akira Client.exeC:\Users\admin\AppData\Local\Temp\is-0T5II.tmp\Akira Client.tmpexecutable
MD5:C0D2F8F2399AE2890934F34F90ACB86D
SHA256:97563A5BAEA501A9B39DB70299D792BE7977B689315C3CED5BC8F2CE00BE1C63
3200Akira Client.tmpC:\Users\admin\AppData\Local\Temp\is-L4K16.tmp\rettext
MD5:444BCB3A3FCF8389296C49467F27E1D6
SHA256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
3200Akira Client.tmpC:\Users\admin\AppData\Local\Temp\is-L4K16.tmp\is-AVNOF.tmptext
MD5:444BCB3A3FCF8389296C49467F27E1D6
SHA256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
2728setup.exeC:\Users\admin\AppData\Local\Temp\is-M6T4G.tmp\setup.tmpexecutable
MD5:2FDA5286C6B3A562A7371A620ED27FA1
SHA256:097B582936C71294B1D850A5FC2A3E4CF27F7D33025F71D38300EF3FDAAE79AF
3200Akira Client.tmpC:\Users\admin\AppData\Local\Temp\is-L4K16.tmp\is-BK3SA.tmpexecutable
MD5:A089DE372689E026446DF26C104DE983
SHA256:5F20F42A966084F33B3E1AEB5BF450C146DE71538580B1D40346CF876BE770F0
3200Akira Client.tmpC:\Program Files\Akira Client.exe\unins000.exeexecutable
MD5:17BAED4D90E413474423C1560F883584
SHA256:A0E78BFE9F5EE31D35581F57200FDA7026C85A4605C3547029B31D527462A73D
3332setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:01AE309D18045A0F64A8C18593F6EF1F
SHA256:1CA51DC9A8E59EA0E165EF3162096A8A1C146F849B30F3ECC637D798F267BC96
3332setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
44
DNS requests
56
Threats
33

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
104.21.52.223:80
http://sparksteam.site/ill.php?p=3811&t=47720861&title=QWtpcmEgQ2xpZW50LmV4ZQ==&sub=2477&ps=656330871cb04
unknown
text
120 b
unknown
3200
Akira Client.tmp
GET
200
104.21.93.211:80
http://clamstew.website/pe/buildIN.php?sub=2477&source=3811&s1=47720861&title=QWtpcmEgQ2xpZW50LmV4ZQ%3D%3D&ti=1700999702
unknown
executable
4.90 Mb
unknown
3200
Akira Client.tmp
GET
200
104.21.52.223:80
http://sparksteam.site/pill.php
unknown
text
2 b
unknown
3332
setup.tmp
GET
200
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ff562072da7437cc
unknown
compressed
4.66 Kb
unknown
3332
setup.tmp
GET
200
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6991284cb41a101b
unknown
compressed
61.6 Kb
unknown
3332
setup.tmp
GET
200
23.212.210.158:80
http://x2.c.lencr.org/
unknown
binary
300 b
unknown
3332
setup.tmp
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1080
svchost.exe
GET
304
87.248.205.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8aef2fa3cb5e0a37
unknown
—
—
unknown
3332
setup.tmp
GET
200
184.24.77.67:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPXvFgZTnegQocWvQARpRx%2B5A%3D%3D
unknown
binary
503 b
unknown
3512
wmiprvse.exe
GET
200
51.142.119.24:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
text
15 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3200
Akira Client.tmp
104.21.52.223:80
sparksteam.site
CLOUDFLARENET
—
unknown
3200
Akira Client.tmp
104.21.93.211:80
clamstew.website
CLOUDFLARENET
—
unknown
3332
setup.tmp
188.114.97.3:443
ou.dimeflowers.website
CLOUDFLARENET
NL
unknown
3332
setup.tmp
87.248.205.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
3332
setup.tmp
23.212.210.158:80
x1.c.lencr.org
AKAMAI-AS
AU
unknown
1080
svchost.exe
87.248.205.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
sparksteam.site
  • 104.21.52.223
  • 172.67.204.180
unknown
clamstew.website
  • 104.21.93.211
  • 172.67.214.200
unknown
ou.dimeflowers.website
  • 188.114.97.3
  • 188.114.96.3
unknown
ctldl.windowsupdate.com
  • 87.248.205.0
whitelisted
x1.c.lencr.org
  • 23.212.210.158
whitelisted
x2.c.lencr.org
  • 23.212.210.158
whitelisted
www.zmukel.cloud
  • 185.154.15.70
unknown
r3.o.lencr.org
  • 184.24.77.67
  • 184.24.77.79
  • 184.24.77.54
shared
send.planewool.xyz
  • 104.21.90.147
  • 172.67.157.197
unknown
geo.netsupportsoftware.com
  • 51.142.119.24
  • 62.172.138.8
  • 62.172.138.67
unknown

Threats

PID
Process
Class
Message
3200
Akira Client.tmp
Possibly Unwanted Program Detected
ET ADWARE_PUP Win32/TrojanDownloader Variant Activity (GET)
3200
Akira Client.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
3200
Akira Client.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
3200
Akira Client.tmp
Misc activity
ET INFO EXE - Served Attached HTTP
3200
Akira Client.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3512
wmiprvse.exe
Potential Corporate Privacy Violation
ET POLICY NetSupport GeoLocation Lookup Request
3512
wmiprvse.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
3512
wmiprvse.exe
Misc activity
ET INFO NetSupport Remote Admin Response
3512
wmiprvse.exe
Misc activity
ET INFO NetSupport Remote Admin Checkin
14 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Akira Client.zip.zip