We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
18 May 2020, 17:28
Analysis environment:
Windows 7 Pro, build 7601, x86
Darlehensvertrag_1955_15052020.zip
MD5:
8A1D016D582D78D71006D2FE36B226CE
SHA1:
7424EB24C4D22AAED44BCF7D86F9BD38DAF712F9
SHA256:
2D0743858E7ADBF7BFA7AA66878C86C3467C844A3B4F403EE3F97D6F75ACFD20
Analysis result
Threat level:
Malicious activity
Tags:
trojan
Full analysis:
Analysis Darlehensvertrag_1955_15052020.zip (MD5: 8A1D016D582D78D71006D2FE36B226CE) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Connects to CnC server
WScript.exe (PID: 3576)
SUSPICIOUS
Executes scripts
WinRAR.exe (PID: 2700)
INFO
Manual execution by user
WScript.exe (PID: 2612)
Threats
PID
Process
Class
Message
3576
WScript.exe
A Network Trojan was detected
ET TROJAN Unk.VBSLoader Retrieving Payload
3576
WScript.exe
A Network Trojan was detected
ET TROJAN Possible Win32/Qbot/Quakbot Checkin via HTTP GET