File name:

sample.zip

Full analysis: https://app.any.run/tasks/0fb71e2f-4ce6-4039-9e0f-90b8d901ee7b
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: July 26, 2023, 22:39:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
agenttesla
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

79B5CE321D0AAF6044D600C123F1C2C9

SHA1:

5ACB1A34EB459F69FDC9362E05742B1B268ECFD2

SHA256:

2BB932AD45C06D8084E4781DA418C0E03E4B08D88BBB17872E8500D22B9E8D7D

SSDEEP:

12288:W3mN4o9HHPr3YaEs1tcSFUNRhyXTiihoyGHn3PrlZidrCY80mvCTm:9pJrEst+smiK3pZAz80mvim

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Steals credentials from Web Browsers

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • AGENTTESLA detected by memory dumps

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Actions looks like stealing of personal data

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Application launched itself

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)

    • Reads settings of System Certificates

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Adds/modifies Windows certificates

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)

    • Accesses Microsoft Outlook profiles

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Connects to SMTP port

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

  • INFO

    • Reads the computer name

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Application launched itself

      • chrome.exe (PID: 1304)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2852)

    • Manual execution by a user

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • chrome.exe (PID: 1304)

    • Checks supported languages

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • The process uses the downloaded file

      • chrome.exe (PID: 3912)
      • chrome.exe (PID: 1880)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • Reads Environment values

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)

    • The process checks LSA protection

      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 564)
      • SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe (PID: 2616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(2616) SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe
Protocolsmtp
Hostmail.sgbumperscar.com
Port587
Usernameptt-mary@sgbumperscar.com
Passwordtien3012m
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Unknown (99)
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
35
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe securiteinfo.com.trojan.packednet.2200.8496.10942.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #AGENTTESLA securiteinfo.com.trojan.packednet.2200.8496.10942.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
348"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1364 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\cryptbase.dll
c:\program files\google\chrome\application\chrome.exe
564"C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe" C:\Users\admin\Desktop\SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
QLPhim
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\users\admin\desktop\securiteinfo.com.trojan.packednet.2200.8496.10942.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4420 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1024"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1328 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1040"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6ce08b38,0x6ce08b48,0x6ce08b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1104"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=804 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1284"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3368 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1304"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3660 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1836"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1948 --field-trial-handle=1212,i,11258979954019980813,16139273992487653836,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
8 164
Read events
8 039
Write events
124
Delete events
1

Modification events

(PID) Process:(2852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
6
Suspicious files
678
Text files
136
Unknown types
8

Dropped files

PID
Process
Filename
Type
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1125b5.TMP —
MD5:—
SHA256:—
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:CDCC923CEC2CD9228330551E6946A9C2
SHA256:592F4750166BE662AA88728F9969537163FEC5C3E95E81537C8C6917F8D0929E
2852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2852.20022\SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exeexecutable
MD5:179975642C1E6FE458E446AAA9328596
SHA256:AB701AC288408C45B6A0D0D7CC7F71B44309CD32B64544A3244511098EE20BF6
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF112855.TMPtext
MD5:F13F92FE0277FBD908E4410DEB43609A
SHA256:5746DB776E91B0EF58626F444ADC79E4F8B76C7CEDEEC1BD8D59F7726280880B
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF11277a.TMPtext
MD5:74174B4F8AEB3CFDC18745625ED7865C
SHA256:419223BAED85740D27E427C390FDCA869AE1F4089A8415DE13CC4305F6907FDF
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldtext
MD5:99EC94B2503FAD33EDAF99779EBA5BC8
SHA256:DC554AB7EDCAD375F39ED106CA1EF9A89FB8D9063A4D08F377F2C80D66799D7E
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:561161B0FF5BCA89BF47F8AC972A7499
SHA256:ECCA5CCFA0BEED7581B39FCE03D0FD3B694DF0F92BFFF780F702118AD51FC17D
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF1125d4.TMPtext
MD5:CF083E99BB51786FA31BD0E0FE2686E4
SHA256:BC8DE81EFA52674CA26D55DFAFCBCE7A4D38994BEF5D267548EADF9985DBF5AC
1304chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.oldtext
MD5:7C1C23F006788D107F8A01B852CC6701
SHA256:9FA4E627077EDCBEC8AAA1ED2DD5538E630790893F88F02F1E9CC863E6A27848
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
144
DNS requests
114
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
868
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxpsjblnoxgjoqggdsbvujtof4_58/khaoiebndkojlmppeemjhbpbandiljpe_58_win_advr4ucepztwtigvw3fduftsvbeq.crx3
US
—
—
whitelisted
348
chrome.exe
GET
204
142.250.184.195:80
http://www.gstatic.com/generate_204
US
—
—
whitelisted
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad62d4tkq2bdt5z2zyx3aawqfcxa_2981/jflookgnkcckhobaglndicnbbgbonegd_2981_all_kxzjyll3bml7uhowed3e3qnnam.crx3
US
binary
36.4 Kb
whitelisted
348
chrome.exe
GET
301
142.250.184.197:80
http://gmail.com/
US
html
230 b
shared
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/g4ptxcyjfyndlflbodcujfvinq_8138/hfnkpimlhhgieaddgfemjhofmfblmnib_8138_all_gm7aajixvtxy7qkjpwua74zaoa.crx3
US
binary
9.67 Kb
whitelisted
868
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad62d4tkq2bdt5z2zyx3aawqfcxa_2981/jflookgnkcckhobaglndicnbbgbonegd_2981_all_kxzjyll3bml7uhowed3e3qnnam.crx3
US
binary
4.96 Kb
whitelisted
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/g4ptxcyjfyndlflbodcujfvinq_8138/hfnkpimlhhgieaddgfemjhofmfblmnib_8138_all_gm7aajixvtxy7qkjpwua74zaoa.crx3
US
binary
11.0 Kb
whitelisted
868
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/delta-update/lmelglejhemejginpboagddgdfbepgmp/1.e29e642db998c8147d0a35c42b80be2cb85e013bb1288a80d3ceaba0289bccd8/1.248d99a92d5adc640c1fdf1d26c3821298c74646ab8fa6d1b94f2b984075eead/7d46b596714f69b716a2283ee42e5181d1d6ac8d41689239338e038ee98ca6f7.crxd
US
binary
5.46 Kb
whitelisted
868
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/delta-update/lmelglejhemejginpboagddgdfbepgmp/1.e29e642db998c8147d0a35c42b80be2cb85e013bb1288a80d3ceaba0289bccd8/1.248d99a92d5adc640c1fdf1d26c3821298c74646ab8fa6d1b94f2b984075eead/7d46b596714f69b716a2283ee42e5181d1d6ac8d41689239338e038ee98ca6f7.crxd
US
binary
3.49 Kb
whitelisted
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad62d4tkq2bdt5z2zyx3aawqfcxa_2981/jflookgnkcckhobaglndicnbbgbonegd_2981_all_kxzjyll3bml7uhowed3e3qnnam.crx3
US
binary
23.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
348
chrome.exe
142.250.184.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2720
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1304
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
348
chrome.exe
142.250.181.237:443
accounts.google.com
GOOGLE
US
suspicious
348
chrome.exe
216.58.212.132:443
www.google.com
—
—
whitelisted
348
chrome.exe
142.250.186.131:443
update.googleapis.com
GOOGLE
US
whitelisted
1304
chrome.exe
224.0.0.251:5353
—
—
—
unknown
348
chrome.exe
142.250.184.238:443
encrypted-tbn0.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 142.250.184.227
whitelisted
accounts.google.com
  • 142.250.181.237
  • 142.250.185.173
shared
www.google.com
  • 216.58.212.132
  • 172.217.18.4
malicious
encrypted-tbn0.gstatic.com
  • 142.250.184.238
whitelisted
update.googleapis.com
  • 142.250.186.131
whitelisted
gmail.com
  • 142.250.184.197
shared
mail.google.com
  • 142.250.186.37
shared
optimizationguide-pa.googleapis.com
  • 172.217.18.106
  • 142.250.186.42
  • 142.250.74.202
  • 142.250.186.138
  • 142.250.184.234
  • 142.250.184.202
  • 142.250.181.234
  • 142.250.186.106
  • 142.250.186.74
  • 142.250.185.234
  • 142.250.185.202
  • 142.250.185.170
  • 142.250.185.138
  • 142.250.185.106
  • 142.250.185.74
  • 172.217.23.106
whitelisted
api.ipify.org
  • 173.231.16.76
  • 104.237.62.211
  • 64.185.227.156
shared
www.googleapis.com
  • 142.250.184.202
  • 142.250.185.202
  • 142.250.185.170
  • 172.217.18.106
  • 216.58.212.138
  • 142.250.184.234
  • 142.250.185.74
  • 216.58.212.170
  • 142.250.185.106
  • 142.250.185.138
  • 142.250.186.74
  • 142.250.186.106
  • 142.250.181.234
  • 142.250.185.234
  • 172.217.16.138
  • 172.217.23.106
whitelisted

Threats

PID
Process
Class
Message
2616
SecuriteInfo.com.Trojan.PackedNET.2200.8496.10942.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sample.zip