File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/e8051a8b-791c-48d7-b38b-bd0a2d0f86f8
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: May 17, 2025, 17:59:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
github
auto
generic
asyncrat
rat
njrat
quasarrat
hausbomber
bladabindi
loader
remote
backdoor
gcleaner
crypto-regex
remcos
azorult
stealer
lumma
quasar
redline
tool
rdp
screenconnect
rmm-tool
evasion
phishing
babadeda
meterpreter
donutloader
delphi
stealc
miner
sliver
scan
smbscan
adesstealer
whitesnakestealer
bruteratel
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • GENERIC has been found (auto)

      • 4363463463464363463463463.exe (PID: 1748)
      • mixseven.exe (PID: 984)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 2120)
    • RAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 1748)
      • govno__dlya_jertwy.exe (PID: 2944)
      • 4363463463464363463463463.exe (PID: 1852)
      • SteamDetector.exe (PID: 7268)
      • 4363463463464363463463463.exe (PID: 5072)
      • 4363463463464363463463463.exe (PID: 4148)
      • SteamDetector.exe (PID: 8616)
    • Uses Task Scheduler to autorun other applications

      • Client-built10.exe (PID: 3168)
      • Client-built.exe (PID: 2988)
      • Client.exe (PID: 3376)
      • SYSTEM26.exe (PID: 704)
      • cmd.exe (PID: 944)
      • spectrum.exe (PID: 2992)
      • DriverHost.exe (PID: 4564)
      • thin.exe (PID: 5744)
      • Java.exe (PID: 4724)
      • Client.exe (PID: 4920)
      • installer.exe.exe (PID: 5612)
    • QUASARRAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 1748)
      • Client-built.exe (PID: 2988)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 3788)
      • spectrum.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 944)
      • Java.exe (PID: 4724)
      • 4363463463464363463463463.exe (PID: 3788)
      • installer.exe.exe (PID: 5612)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 5072)
    • NJRAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 1748)
      • 856.exe (PID: 3280)
      • main.exe (PID: 3676)
      • svchost.exe (PID: 2752)
      • 4363463463464363463463463.exe (PID: 3420)
      • dllhost.exe (PID: 1220)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 392)
      • Server.exe (PID: 5504)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 5072)
    • LOADER has been found (auto)

      • 4363463463464363463463463.exe (PID: 1748)
    • Executing a file with an untrusted certificate

      • mixseven.exe (PID: 984)
      • Supawn.exe (PID: 2788)
      • ChatLife.exe (PID: 4540)
      • QXUserCtrlSetup_1010.exe (PID: 5920)
      • client.exe (PID: 4496)
      • ExSync.exe (PID: 6708)
      • crypted.41.exe (PID: 4860)
      • td.exe (PID: 3556)
      • 1188%E7%83%88%E7%84%B0.exe (PID: 5832)
      • crypted.41.exe (PID: 5852)
      • ClientRun.exe (PID: 8820)
    • NJRAT mutex has been found

      • 856.exe (PID: 3280)
      • svchost.exe (PID: 2752)
      • main.exe (PID: 3676)
      • dllhost.exe (PID: 1220)
    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 3048)
    • Create files in the Startup directory

      • govno__dlya_jertwy.exe (PID: 2944)
      • dllhost.exe (PID: 1220)
      • Fast%20Download.exe (PID: 2220)
    • Changes the autorun value in the registry

      • govno__dlya_jertwy.exe (PID: 2944)
      • fusca%20game.exe (PID: 2956)
      • dllhost.exe (PID: 1220)
      • NOTallowedtocrypt.exe (PID: 3588)
    • NJRAT has been detected (SURICATA)

      • govno__dlya_jertwy.exe (PID: 2944)
    • Connects to the CnC server

      • govno__dlya_jertwy.exe (PID: 2944)
      • svchost.exe (PID: 1080)
    • NjRAT is detected

      • govno__dlya_jertwy.exe (PID: 2944)
      • fusca%20game.exe (PID: 2956)
    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 2752)
      • dllhost.exe (PID: 1220)
      • PowerShell.exe (PID: 6548)
    • GCLEANER has been detected (YARA)

      • svchost015.exe (PID: 2772)
    • REMCOS mutex has been found

      • NOTallowedtocrypt.exe (PID: 3588)
    • UAC/LUA settings modification

      • reg.exe (PID: 972)
    • QUASAR has been detected (YARA)

      • SYSTEM26.exe (PID: 704)
      • Client.exe (PID: 3376)
    • LUMMA has been found (auto)

      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 5072)
      • 4363463463464363463463463.exe (PID: 3788)
    • STEALER has been found (auto)

      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 604)
    • SCREENCONNECT has been found (auto)

      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 2120)
    • QUASAR has been found (auto)

      • 4363463463464363463463463.exe (PID: 392)
      • DriverHost.exe (PID: 4564)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 3968)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4772)
      • powershell.exe (PID: 3744)
      • powershell.exe (PID: 5132)
      • powershell.exe (PID: 4320)
    • Changes Windows Defender settings

      • XClient.exe (PID: 4256)
      • thin.exe (PID: 5744)
      • requirements.exe (PID: 4508)
      • Yix.exe (PID: 4716)
    • Changes powershell execution policy (Bypass)

      • XClient.exe (PID: 4256)
      • requirements.exe (PID: 4508)
      • Yix.exe (PID: 4716)
    • Adds path to the Windows Defender exclusion list

      • XClient.exe (PID: 4256)
      • thin.exe (PID: 5744)
      • requirements.exe (PID: 4508)
      • Yix.exe (PID: 4716)
    • REMCOS has been detected (YARA)

      • NOTallowedtocrypt.exe (PID: 3588)
    • NJRAT has been detected (YARA)

      • svchost.exe (PID: 2752)
      • fusca%20game.exe (PID: 2956)
      • dllhost.exe (PID: 1220)
    • REDLINE has been found (auto)

      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 2876)
    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 5200)
    • RDP has been found (auto)

      • 4363463463464363463463463.exe (PID: 4076)
    • ASYNCRAT has been detected (YARA)

      • CPDB.exe (PID: 3124)
    • BABADEDA has been found (auto)

      • 4363463463464363463463463.exe (PID: 4148)
      • 4363463463464363463463463.exe (PID: 4076)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 1080)
      • alex12312.exe (PID: 8736)
    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 1080)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2056)
    • METERPRETER has been found (auto)

      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 2120)
    • Adds process to the Windows Defender exclusion list

      • XClient.exe (PID: 4256)
    • DONUTLOADER has been found (auto)

      • 4363463463464363463463463.exe (PID: 3968)
    • REMCOS has been detected (SURICATA)

      • Host.exe (PID: 3320)
    • ASYNCRAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 4076)
    • SLIVER has been found (auto)

      • 4363463463464363463463463.exe (PID: 2876)
    • ADESSTEALER has been found (auto)

      • 4363463463464363463463463.exe (PID: 948)
    • Attempting to scan the network

      • Meredrop.exe (PID: 6536)
    • SMBSCAN has been detected (SURICATA)

      • Meredrop.exe (PID: 6536)
    • WHITESNAKESTEALER has been found (auto)

      • 4363463463464363463463463.exe (PID: 3568)
    • Stealers network behavior

      • svchost.exe (PID: 1080)
    • REMCOS has been found (auto)

      • 4363463463464363463463463.exe (PID: 3568)
    • Signed with known abused certificate

      • 4363463463464363463463463.exe (PID: 2120)
    • BRUTERATEL has been found (auto)

      • 4363463463464363463463463.exe (PID: 3420)
  • SUSPICIOUS

    • Reads the Internet Settings

      • 4363463463464363463463463.exe (PID: 1748)
      • svchost.exe (PID: 2780)
      • powershell.exe (PID: 3112)
      • Client.exe (PID: 3348)
      • 856.exe (PID: 3280)
      • main.exe (PID: 3676)
      • svchost015.exe (PID: 2772)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 1852)
      • cHSzTDjVl.exe (PID: 4112)
    • Reads settings of System Certificates

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 3884)
    • Adds/modifies Windows certificates

      • 4363463463464363463463463.exe (PID: 1748)
    • The process checks if it is being run in the virtual environment

      • 4363463463464363463463463.exe (PID: 1748)
    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 1748)
      • svchost.exe (PID: 2780)
      • Client.exe (PID: 3348)
      • 856.exe (PID: 3280)
      • main.exe (PID: 3676)
      • svchost015.exe (PID: 2772)
    • Executable content was dropped or overwritten

      • 4363463463464363463463463.exe (PID: 1748)
      • Client-built10.exe (PID: 3168)
      • Client-built.exe (PID: 2988)
      • MS14-068.exe (PID: 3824)
      • govno__dlya_jertwy.exe (PID: 2944)
      • mixseven.exe (PID: 984)
      • svchost.exe (PID: 2780)
      • 856.exe (PID: 3280)
      • Client.exe (PID: 3348)
      • main.exe (PID: 3676)
      • svchost.exe (PID: 2752)
      • 4363463463464363463463463.exe (PID: 328)
      • dllhost.exe (PID: 1220)
      • 4363463463464363463463463.exe (PID: 3420)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 604)
      • spectrum.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 3884)
      • 99999.exe (PID: 4740)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 2120)
      • Server.exe (PID: 5504)
      • 4363463463464363463463463.exe (PID: 4148)
      • thin.exe (PID: 5744)
      • DriverHost.exe (PID: 4564)
      • 4363463463464363463463463.exe (PID: 2876)
      • qm2014chs.exe (PID: 3940)
      • 4363463463464363463463463.exe (PID: 3568)
      • Java.exe (PID: 4724)
      • client.exe (PID: 4496)
      • Build.exe (PID: 4276)
      • 4363463463464363463463463.exe (PID: 4704)
      • installer.exe.exe (PID: 5612)
      • 4363463463464363463463463.exe (PID: 5072)
      • PowerShell.exe (PID: 6548)
      • SteamDetector.exe (PID: 7268)
      • Destover.exe (PID: 8148)
      • ExSync.exe (PID: 6708)
      • 4363463463464363463463463.exe (PID: 3372)
      • ljgksdtihd.exe (PID: 8668)
      • SteamDetector.exe (PID: 8616)
    • Starts itself from another location

      • Client-built10.exe (PID: 3168)
      • Client-built.exe (PID: 2988)
      • 856.exe (PID: 3280)
      • main.exe (PID: 3676)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 99999.exe (PID: 4740)
      • Server.exe (PID: 5504)
      • thin.exe (PID: 5744)
      • SteamDetector.exe (PID: 7268)
    • Process drops legitimate windows executable

      • MS14-068.exe (PID: 3824)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3788)
      • DriverHost.exe (PID: 4564)
      • 4363463463464363463463463.exe (PID: 948)
      • client.exe (PID: 4496)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 2876)
      • Destover.exe (PID: 8148)
      • 4363463463464363463463463.exe (PID: 5072)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 4076)
    • Process drops python dynamic module

      • MS14-068.exe (PID: 3824)
    • The process creates files with name similar to system file names

      • 4363463463464363463463463.exe (PID: 1748)
      • 856.exe (PID: 3280)
      • Client.exe (PID: 3348)
      • main.exe (PID: 3676)
      • dllhost.exe (PID: 1220)
      • 4363463463464363463463463.exe (PID: 392)
    • The process drops C-runtime libraries

      • MS14-068.exe (PID: 3824)
    • Application launched itself

      • MS14-068.exe (PID: 3824)
      • con12312211221.exe (PID: 4632)
      • AA_v3.exe (PID: 8156)
      • installer_ver19.02.exe (PID: 4068)
      • crypted.41.exe (PID: 4860)
      • alex12312.exe (PID: 8480)
    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • govno__dlya_jertwy.exe (PID: 2944)
      • 856.exe (PID: 3280)
      • fusca%20game.exe (PID: 2956)
      • svchost.exe (PID: 2752)
      • sdc.exe (PID: 5100)
      • SteamDetector.exe (PID: 8616)
    • Starts POWERSHELL.EXE for commands execution

      • svchost.exe (PID: 2780)
      • XClient.exe (PID: 4256)
      • Build.exe (PID: 4276)
      • thin.exe (PID: 5744)
      • requirements.exe (PID: 4508)
      • Yix.exe (PID: 4716)
    • BASE64 encoded PowerShell command has been detected

      • svchost.exe (PID: 2780)
      • Build.exe (PID: 4276)
    • Base64-obfuscated command line is found

      • svchost.exe (PID: 2780)
      • Build.exe (PID: 4276)
    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 5072)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 2876)
      • XZCADEEW22.exe (PID: 4612)
      • ZZXSWRGGSD.exe (PID: 2296)
    • Connects to unusual port

      • CPDB.exe (PID: 3124)
      • Client.exe (PID: 3376)
      • SYSTEM26.exe (PID: 704)
      • govno__dlya_jertwy.exe (PID: 2944)
      • svchost.exe (PID: 2244)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3568)
      • dllhost.exe (PID: 1220)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 944)
      • sdc.exe (PID: 5100)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 4148)
      • Host.exe (PID: 3320)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3788)
      • Client.exe (PID: 4920)
      • benpolatalemdar.exe (PID: 2068)
      • shell.exe (PID: 8000)
      • Fast%20Download.exe (PID: 2220)
    • Process requests binary or script from the Internet

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 4148)
      • 4363463463464363463463463.exe (PID: 3568)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 5072)
    • Creates file in the systems drive root

      • ntvdm.exe (PID: 3284)
      • 856.exe (PID: 3280)
    • Found regular expressions for crypto-addresses (YARA)

      • 4363463463464363463463463.exe (PID: 1748)
      • CPDB.exe (PID: 3124)
    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • 856.exe (PID: 3280)
      • svchost.exe (PID: 2752)
    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3112)
    • Contacting a server suspected of hosting an CnC

      • govno__dlya_jertwy.exe (PID: 2944)
      • svchost.exe (PID: 1080)
      • Host.exe (PID: 3320)
      • alex12312.exe (PID: 8736)
    • Executing commands from a ".bat" file

      • Client.exe (PID: 3348)
      • run.exe (PID: 5084)
      • av_downloader.exe (PID: 3936)
    • Starts CMD.EXE for commands execution

      • Client.exe (PID: 3348)
      • main.exe (PID: 3676)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 76y5trfed675ytg.exe (PID: 5088)
      • ChatLife.exe (PID: 4540)
      • run.exe (PID: 5084)
      • QuizPokemon.exe (PID: 576)
      • av_downloader.exe (PID: 3936)
      • ApiUpdater.exe (PID: 9208)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3600)
    • Potential Corporate Privacy Violation

      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 4148)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 3568)
      • Meredrop.exe (PID: 6536)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 5072)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1812)
      • cmd.exe (PID: 5180)
      • cmd.exe (PID: 5348)
    • Reads the date of Windows installation

      • NOTallowedtocrypt.exe (PID: 3588)
    • There is functionality for taking screenshot (YARA)

      • SYSTEM26.exe (PID: 704)
      • NOTallowedtocrypt.exe (PID: 3588)
      • Client.exe (PID: 3376)
      • Supawn.exe (PID: 2788)
      • dllhost.exe (PID: 1220)
    • Uses TASKKILL.EXE to kill process

      • dllhost.exe (PID: 1220)
    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 3408)
      • schtasks.exe (PID: 3700)
      • schtasks.exe (PID: 3520)
      • schtasks.exe (PID: 9028)
    • The process executes via Task Scheduler

      • StUpdate.exe (PID: 4272)
      • StUpdate.exe (PID: 4520)
      • dllhost.exe (PID: 6444)
      • StUpdate.exe (PID: 6456)
      • StUpdate.exe (PID: 5672)
      • dllhost.exe (PID: 9424)
    • Starts a Microsoft application from unusual location

      • DriverHost.exe (PID: 4564)
      • client.exe (PID: 4496)
      • Destover.exe (PID: 8148)
    • Script adds exclusion path to Windows Defender

      • XClient.exe (PID: 4256)
      • thin.exe (PID: 5744)
      • requirements.exe (PID: 4508)
      • Yix.exe (PID: 4716)
    • Executing commands from ".cmd" file

      • ChatLife.exe (PID: 4540)
      • QuizPokemon.exe (PID: 576)
    • Checks for external IP

      • thin.exe (PID: 5744)
      • svchost.exe (PID: 1080)
      • requirements.exe (PID: 4508)
      • Yix.exe (PID: 4716)
      • Client.exe (PID: 4920)
      • CefSharp.BrowsersSubprocess.exe (PID: 6684)
    • Manipulates environment variables

      • powershell.exe (PID: 2056)
    • Process uses IPCONFIG to clear DNS cache

      • thin.exe (PID: 5744)
    • Script adds exclusion process to Windows Defender

      • XClient.exe (PID: 4256)
    • Crypto Currency Mining Activity Detected

      • 4363463463464363463463463.exe (PID: 3968)
    • Executes as Windows Service

      • AA_v3.exe (PID: 8156)
    • Uses ATTRIB.EXE to modify file attributes

      • Fast%20Download.exe (PID: 2220)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 5808)
    • Starts application with an unusual extension

      • cmd.exe (PID: 5808)
  • INFO

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 1748)
      • Client-built10.exe (PID: 3168)
      • Client-built.exe (PID: 2988)
      • CPDB.exe (PID: 3124)
      • Client.exe (PID: 3376)
      • govno__dlya_jertwy.exe (PID: 2944)
      • SYSTEM26.exe (PID: 704)
      • mixseven.exe (PID: 984)
      • 856.exe (PID: 3280)
      • MS14-068.exe (PID: 3824)
      • fusca%20game.exe (PID: 2956)
      • main.exe (PID: 3676)
      • MS14-068.exe (PID: 2860)
      • svchost.exe (PID: 2780)
      • svchost015.exe (PID: 2772)
      • Client.exe (PID: 3348)
      • svchost.exe (PID: 2752)
      • dllhost.exe (PID: 1220)
      • 4363463463464363463463463.exe (PID: 328)
      • svchost.exe (PID: 2244)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3388)
      • Supawn.exe (PID: 2788)
      • 4363463463464363463463463.exe (PID: 3048)
      • Fast%20Download.exe (PID: 2220)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 3372)
      • PXray_Cast_Sort.exe (PID: 4024)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 3884)
      • RedLineStealer.exe (PID: 116)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 1852)
      • spectrum.exe (PID: 2992)
      • cHSzTDjVl.exe (PID: 4112)
    • Reads Environment values

      • 4363463463464363463463463.exe (PID: 1748)
      • Client-built.exe (PID: 2988)
      • Client-built10.exe (PID: 3168)
      • SYSTEM26.exe (PID: 704)
      • Client.exe (PID: 3376)
      • govno__dlya_jertwy.exe (PID: 2944)
      • fusca%20game.exe (PID: 2956)
      • svchost.exe (PID: 2752)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3884)
      • spectrum.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 1852)
      • cHSzTDjVl.exe (PID: 4112)
    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 1748)
      • Client-built.exe (PID: 2988)
      • CPDB.exe (PID: 3124)
      • Client-built10.exe (PID: 3168)
      • SYSTEM26.exe (PID: 704)
      • mixseven.exe (PID: 984)
      • Client.exe (PID: 3376)
      • 856.exe (PID: 3280)
      • main.exe (PID: 3676)
      • govno__dlya_jertwy.exe (PID: 2944)
      • svchost.exe (PID: 2780)
      • Client.exe (PID: 3348)
      • svchost.exe (PID: 2752)
      • dllhost.exe (PID: 1220)
      • fusca%20game.exe (PID: 2956)
      • svchost.exe (PID: 2244)
      • svchost015.exe (PID: 2772)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • Supawn.exe (PID: 2788)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • Fast%20Download.exe (PID: 2220)
      • 4363463463464363463463463.exe (PID: 944)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3788)
      • spectrum.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 1852)
      • cHSzTDjVl.exe (PID: 4112)
    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 1852)
    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 1748)
      • Client-built10.exe (PID: 3168)
      • SYSTEM26.exe (PID: 704)
      • mixseven.exe (PID: 984)
      • Client.exe (PID: 3376)
      • Client-built.exe (PID: 2988)
      • 856.exe (PID: 3280)
      • CPDB.exe (PID: 3124)
      • MS14-068.exe (PID: 2860)
      • govno__dlya_jertwy.exe (PID: 2944)
      • Client.exe (PID: 3348)
      • svchost.exe (PID: 2752)
      • fusca%20game.exe (PID: 2956)
      • main.exe (PID: 3676)
      • svchost015.exe (PID: 2772)
      • svchost.exe (PID: 2244)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3388)
      • Fast%20Download.exe (PID: 2220)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 944)
      • NOTallowedtocrypt.exe (PID: 3588)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 1852)
      • spectrum.exe (PID: 2992)
      • cHSzTDjVl.exe (PID: 4112)
    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 1748)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 3884)
    • Creates files in the program directory

      • Client-built10.exe (PID: 3168)
      • main.exe (PID: 3676)
    • Creates files or folders in the user directory

      • Client-built.exe (PID: 2988)
      • 856.exe (PID: 3280)
      • govno__dlya_jertwy.exe (PID: 2944)
      • dllhost.exe (PID: 1220)
      • NOTallowedtocrypt.exe (PID: 3588)
      • Fast%20Download.exe (PID: 2220)
    • Create files in a temporary directory

      • 856.exe (PID: 3280)
      • MS14-068.exe (PID: 3824)
      • mixseven.exe (PID: 984)
      • Client.exe (PID: 3348)
      • svchost.exe (PID: 2752)
    • The sample compiled with english language support

      • MS14-068.exe (PID: 3824)
      • mixseven.exe (PID: 984)
      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 4148)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 944)
      • client.exe (PID: 4496)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 5072)
      • Destover.exe (PID: 8148)
      • ExSync.exe (PID: 6708)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 3568)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3112)
    • Checks proxy server information

      • svchost015.exe (PID: 2772)
      • cHSzTDjVl.exe (PID: 4112)
    • Manual execution by a user

      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 952)
      • 4363463463464363463463463.exe (PID: 3420)
      • 4363463463464363463463463.exe (PID: 3200)
      • 4363463463464363463463463.exe (PID: 3220)
      • 4363463463464363463463463.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 2780)
      • 4363463463464363463463463.exe (PID: 3332)
      • 4363463463464363463463463.exe (PID: 2768)
      • 4363463463464363463463463.exe (PID: 3172)
      • 4363463463464363463463463.exe (PID: 3204)
      • 4363463463464363463463463.exe (PID: 3388)
      • 4363463463464363463463463.exe (PID: 3048)
      • 4363463463464363463463463.exe (PID: 3788)
      • 4363463463464363463463463.exe (PID: 3968)
      • 4363463463464363463463463.exe (PID: 944)
      • 4363463463464363463463463.exe (PID: 3372)
      • 4363463463464363463463463.exe (PID: 604)
      • 4363463463464363463463463.exe (PID: 4076)
      • 4363463463464363463463463.exe (PID: 3568)
      • 4363463463464363463463463.exe (PID: 3608)
      • 4363463463464363463463463.exe (PID: 2636)
      • 4363463463464363463463463.exe (PID: 3884)
      • 4363463463464363463463463.exe (PID: 1852)
      • 4363463463464363463463463.exe (PID: 392)
      • 4363463463464363463463463.exe (PID: 448)
      • 4363463463464363463463463.exe (PID: 948)
      • 4363463463464363463463463.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 2600)
      • 4363463463464363463463463.exe (PID: 3172)
      • 4363463463464363463463463.exe (PID: 2876)
      • 4363463463464363463463463.exe (PID: 3568)
      • 4363463463464363463463463.exe (PID: 3636)
      • 4363463463464363463463463.exe (PID: 2120)
      • 4363463463464363463463463.exe (PID: 4148)
      • 4363463463464363463463463.exe (PID: 4364)
      • 4363463463464363463463463.exe (PID: 4452)
      • 4363463463464363463463463.exe (PID: 4704)
      • 4363463463464363463463463.exe (PID: 5072)
      • 4363463463464363463463463.exe (PID: 5856)
      • 4363463463464363463463463.exe (PID: 5604)
      • 4363463463464363463463463.exe (PID: 6348)
      • 4363463463464363463463463.exe (PID: 2616)
    • Reads product name

      • NOTallowedtocrypt.exe (PID: 3588)
      • cHSzTDjVl.exe (PID: 4112)
    • The sample compiled with korean language support

      • 4363463463464363463463463.exe (PID: 328)
      • 4363463463464363463463463.exe (PID: 3968)
      • client.exe (PID: 4496)
    • Connects to unusual port

      • iexplore.exe (PID: 5200)
    • Compiled with Borland Delphi (YARA)

      • 4363463463464363463463463.exe (PID: 3048)
      • Supawn.exe (PID: 2788)
    • The sample compiled with chinese language support

      • 4363463463464363463463463.exe (PID: 944)
    • Changes the display of characters in the console

      • cmd.exe (PID: 5808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(704) SYSTEM26.exe
Version1.4.1
C2 (2)193.161.193.99:43242
Sub_DirSubDir
Install_NameSYSTEM26.exe
Mutex45bfb701-bea2-411a-948d-9a6abe001f83
StartupQuasar Client Startup
TagOffice04
LogDirLogs
SignaturefgGaLVju6grfZnD4PPuru2jUduIFJygb5i6fCpU3bziLhuLT5af3XSRbhwZLLa6TE2gcGWOGYZsTfu2JQENil9JWYLxuaslxPjsfablnw40FlQTR2cATsntd0SDjvqNXPbN/qeLvnSBdfnIQ/nvSx2eSxrveB3/AM/IHQP3jKnDTQgrCMkquVLbL8TUF7UYmJ+fgDelDbnFmURMFJLKyKppfDXNdaooIkpPMmQelRpf+FvrKGvyXs0g8MsnrPV2CDVQl2Hi3qDu95MWrq6LM4LxULL3M1MJKzYXRB1DWDs90...
CertificateMIIE9DCCAtygAwIBAgIQAL0ekW4W+GtVWO3mhdexIzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMTEwMjEwMTUyNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwB8TLl8NiSNYTIL30uRXiovzaQVRY49Q4J5LKHvSxVvE97GAtyLoPCsixC+nvRPN3OOi8d1x...
(PID) Process(3376) Client.exe
Version1.4.1
C2 (2)0.tcp.ap.ngrok.io:10431
Sub_Dirkazeku
Install_NameClient.exe
Mutex7fb11f4b-e530-407c-a46c-8834ab5c4f45
Startupkazeku
Tagkazeku
LogDirLogs
SignatureaMYVFTI8bGBPC7PouD2vwX/brxoHYpnB+5N+J03N7p5Xs/o16IuqXSbe/TmoNMA8820i4g/yWsrVtI5tWW8PCM62pkqq2SoxkmSYh/KzjwHMMJQpiqq8e/2jFZHKsYIQfcz1hpcFmisvPeTRsEdNI3xoPyCm0182mcvoVl7KPt2/v1jKNvTCo3hibOR2NqLcXicDFcY9EfbVQ19hHHfja0j8o2IQ//59NTxPhouZF3eO1H/PaAOIgSLUYY1Jh3NvT9AS5DKwRSJw1OhWyMjIjwZFG6Mkdd2tkECKzjR4cR7h...
CertificateMIIE9DCCAtygAwIBAgIQANc8h9qchCFSUU+cYA3KWTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI1MDIyNTA3MzgyN1oYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqiYNu1Fz6WGc2+cUwJi9+hM8emrgoGRKv0eQjwodUqSQAGkyo052y+7ws3stDxX2/J8XJW0O...

Remcos

(PID) Process(3588) NOTallowedtocrypt.exe
C2 (1)185.225.73.67:1050
BotnetCrypt
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%APPDATA%
Copy_file76y5trfed675ytg.exe
Startup_value6754ytr756ytr7654yretg8765uyt
Hide_fileTrue
Mutex_name89765y4tergfw6587ryute-80UMP1
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_file654ytrf654trf654ytgref.dat
Keylog_cryptFalse
Hide_keylogTrue
Screenshot_flagTrue
Screenshot_time5
Take_ScreenshotTrue
Screenshot_namebank
Screenshot_path%TEMP%
Screenshot_file67y4htergf65trgewfd654tyrfg
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileTrue
Audio_record_time5
Audio_path%windir%
Audio_dir576ruythg6534trewf
Connect_delay0
Copy_dirkjhgfdc
Keylog_dir67yrtg564tr6754yter
Max_keylog_file0

NjRat

(PID) Process(2752) svchost.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\003fe4ef3220cc6abe0338ba4d8225ca
Splitter|'|'|
Version0.7d
(PID) Process(2956) fusca%20game.exe
C2127.0.0.1
Ports2022
BotnetClient
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\220fe34d4dcc4a99fe35d2fb7ce78939
Splitter|'|'|
Versionim523
(PID) Process(1220) dllhost.exe
C2109.111.167.215
Ports25565
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\dllhost.exe
Splitter|Ghost|
Versionnull

AsyncRat

(PID) Process(3124) CPDB.exe
C2 (1)otrodia8912.gleeze.com
Ports (1)3333
VersionAsyncRAT
Options
AutoRunfalse
Mutex123
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva...
Server_SignatureYb0A0wFFdZq7k+2mWOYErgU8CpEJsfYP2+Sc2i6pnO+GJpZwSwwaQLO2rLmYfncpEp+K4esZbjQb5skHkUdR2KV2WpVSo7GrUh0b1WPhD6n/BTTYb9Qqy0imtM1I4QQTdkccOHrEbJjZ6GPxo9Txe++20MLa5Y2nIbFwrzcwkVMceWSesF+9qBvDtdd7gAs9iTtYvv+D3EH4IwJDCakRnMK8mn/PjV5rK1P7tVG1Ft4BmKNVCh+8YPYP4IQ966OXM9N6BE18iUHGKgAuUq5IxE1LDPsg/i6q+giP0UzblwKT...
Keys
AES93681e16e25396dc0692667599eb8f0a2281fb4d2246054fd2ddcfc943e4f7fe
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
449
Monitored processes
267
Malicious processes
60
Suspicious processes
12

Behavior graph

Click at the process to see the details
start #GENERIC 4363463463464363463463463.exe client-built10.exe #NJRAT govno__dlya_jertwy.exe #QUASARRAT client-built.exe #ASYNCRAT cpdb.exe schtasks.exe no specs #QUASAR client.exe schtasks.exe no specs #QUASAR system26.exe #GENERIC mixseven.exe schtasks.exe no specs #NJRAT 856.exe schtasks.exe no specs ms14-068.exe #NJRAT fusca%20game.exe #NJRAT main.exe netsh.exe no specs ms14-068.exe no specs svchost.exe #LUMMA svchost.exe #GCLEANER svchost015.exe powershell.exe no specs ntvdm.exe no specs client.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs #NJRAT svchost.exe cmd.exe cmd.exe no specs netsh.exe no specs schtasks.exe no specs timeout.exe no specs #NJRAT dllhost.exe cmd.exe no specs choice.exe no specs netsh.exe no specs svchost.exe netsh.exe no specs netsh.exe no specs schtasks.exe no specs #GENERIC 4363463463464363463463463.exe 4363463463464363463463463.exe no specs #NJRAT 4363463463464363463463463.exe supawn.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs #LUMMA 4363463463464363463463463.exe #HAUSBOMBER 4363463463464363463463463.exe #QUASARRAT 4363463463464363463463463.exe 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs redlinestealer.exe #QUASARRAT 4363463463464363463463463.exe #QUASARRAT 4363463463464363463463463.exe 4363463463464363463463463.exe #METERPRETER 4363463463464363463463463.exe #STEALER 4363463463464363463463463.exe #QUASAR 4363463463464363463463463.exe fast%20download.exe #GENERIC 4363463463464363463463463.exe #QUASAR 4363463463464363463463463.exe 4363463463464363463463463.exe no specs #REMCOS notallowedtocrypt.exe cmd.exe no specs #NJRAT 4363463463464363463463463.exe reg.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe no specs taskkill.exe no specs pxray_cast_sort.exe no specs #SLIVER 4363463463464363463463463.exe #WHITESNAKESTEALER 4363463463464363463463463.exe 4363463463464363463463463.exe no specs #SCREENCONNECT 4363463463464363463463463.exe #QUASARRAT spectrum.exe ntvdm.exe no specs schtasks.exe no specs chsztdjvl.exe no specs #BABADEDA 4363463463464363463463463.exe xclient.exe no specs stupdate.exe no specs 4363463463464363463463463.exe no specs ntvdm.exe no specs 4363463463464363463463463.exe no specs nfe.sfx.exe no specs requirements.exe stupdate.exe chatlife.exe no specs #QUASAR driverhost.exe schtasks.exe no specs addmefast%20bot.exe no specs 4363463463464363463463463.exe yix.exe #QUASARRAT java.exe 99999.exe javaw.exe no specs powershell.exe no specs schtasks.exe no specs #QUASARRAT 4363463463464363463463463.exe 76y5trfed675ytg.exe no specs sdc.exe cmd.exe no specs iexplore.exe invoice4231284.exe no specs vb.net%20crypter%20v2.exe no specs server.exe no specs cmd.exe no specs svchost.exe no specs cmd.exe no specs #NJRAT server.exe #QUASARRAT installer.exe.exe vpnwinsetup.exe no specs thin.exe msiexec.exe no specs reg.exe no specs 4363463463464363463463463.exe no specs reg.exe no specs qxuserctrlsetup_1010.exe no specs support.client.exe no specs netsh.exe no specs cabal.exe msiexec.exe no specs installer_ver19.02.exe no specs dfsvc.exe server.exe no specs build.exe ntvdm.exe con12312211221.exe schtasks.exe no specs con12312211221.exe ntvdm.exe no specs schtasks.exe no specs run.exe no specs infinitycrypt.exe no specs powershell.exe no specs 4363463463464363463463463.exe backdoor.exe no specs taskkill.exe no specs client.exe powershell.exe no specs billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe qm2014chs.exe av_downloader.exe no specs client-built4.exe no specs hl2dm_updater.exe no specs cloudy.exe no specs schtasks.exe no specs powershell.exe no specs #REMCOS host.exe ipconfig.exe no specs cmd.exe no specs donut.exe no specs quizpokemon.exe no specs schtasks.exe no specs ntvdm.exe no specs tretiy.exe no specs adobepdfreader.exe no specs powershell.exe no specs schtasks.exe no specs powershell.exe no specs boleto.exe no specs wildfire-test-pe-file.exe no specs konsol.exe no specs client.exe qm2014chs.tmp no specs ntvdm.exe no specs ntvdm.exe no specs jjsploit.v2.exe no specs voidrat.exe no specs 4363463463464363463463463.exe no specs cmd.exe no specs dllhost.exe no specs stupdate.exe no specs #SMBSCAN meredrop.exe powershell.exe cefsharp.browserssubprocess.exe wenzcord.exe no specs justpoc.exe no specs schtasks.exe no specs schtasks.exe no specs screenconnect.clientsetup_2.exe no specs #RAT steamdetector.exe ntvdm.exe no specs 1.exe no specs taskkill.exe no specs aa_v3.exe no specs shell.exe setup.exe no specs aa_v3.exe no specs aa_v3.exe no specs bootstrapper.exe no specs 24321.exe schtasks.exe no specs schtasks.exe no specs msiexec.exe no specs installer_ver19.02.exe schtasks.exe no specs plswork.exe no specs exsync.exe benpolatalemdar.exe attrib.exe no specs schtasks.exe no specs cleanerv2.exe no specs sentil.exe no specs attrib.exe no specs icacls.exe no specs bnkrigkawd.exe random.exe no specs destover.exe xzcadeew22.exe icacls.exe no specs down.exe no specs ffdggg.exe no specs crypted.41.exe no specs td.exe no specs crypted.41.exe 1188%e7%83%88%e7%84%b0.exe no specs zzxswrggsd.exe clientside.exe no specs proctoru.1.30.win.07.exe no specs self-injection.exe no specs stupdate.exe 4363463463464363463463463.exe asyncclient.exe no specs chcp.com no specs aspnet_compiler.exe no specs trojan.malpack.themida%20(anti%20vm).exe no specs heo.exe no specs maza-0.16.3-win32-setup-unsigned.exe no specs alex12312.exe billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe #RAT steamdetector.exe device2.exe ljgksdtihd.exe taskkill.exe no specs #LUMMA alex12312.exe asistenciaok3.exe alphamm.exe no specs clientrun.exe no specs systempreter.exe no specs plantrojan.exe schtasks.exe no specs regasm.exe no specs powershell.exe no specs cmd.exe no specs apiupdater.exe no specs screenconnect.clientsetup.exe no specs img001.exe no specs icacls.exe no specs dllhost.exe no specs schtasks.exe no specs terminal_9235.exe no specs ntvdm.exe no specs netsh.exe no specs mshta.exe no specs njrat%20dangerous.exe no specs cmd.exe no specs 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\Files\RedLineStealer.exe" C:\Users\admin\Desktop\Files\RedLineStealer.exe
4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\files\redlinestealer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
328"C:\Users\admin\Desktop\4363463463464363463463463.exe" C:\Users\admin\Desktop\4363463463464363463463463.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
392"C:\Users\admin\Desktop\4363463463464363463463463.exe" C:\Users\admin\Desktop\4363463463464363463463463.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
448"C:\Users\admin\Desktop\4363463463464363463463463.exe" C:\Users\admin\Desktop\4363463463464363463463463.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.exe
c:\windows\system32\ntdll.dll
576"C:\Users\admin\Desktop\Files\QuizPokemon.exe" C:\Users\admin\Desktop\Files\QuizPokemon.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\files\quizpokemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
604"C:\Users\admin\Desktop\4363463463464363463463463.exe" C:\Users\admin\Desktop\4363463463464363463463463.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
676"schtasks" /create /tn "kazeku" /sc ONLOGON /tr "C:\Program Files\kazeku\Client.exe" /rl HIGHEST /fC:\Windows\System32\schtasks.exeClient.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
704"C:\Users\admin\AppData\Roaming\SubDir\SYSTEM26.exe"C:\Users\admin\AppData\Roaming\SubDir\SYSTEM26.exe
Client-built.exe
User:
admin
Company:
Armadillo
Integrity Level:
HIGH
Description:
Armadillo
Version:
1.1.1.1
Modules
Images
c:\users\admin\appdata\roaming\subdir\system26.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(704) SYSTEM26.exe
Version1.4.1
C2 (2)193.161.193.99:43242
Sub_DirSubDir
Install_NameSYSTEM26.exe
Mutex45bfb701-bea2-411a-948d-9a6abe001f83
StartupQuasar Client Startup
TagOffice04
LogDirLogs
SignaturefgGaLVju6grfZnD4PPuru2jUduIFJygb5i6fCpU3bziLhuLT5af3XSRbhwZLLa6TE2gcGWOGYZsTfu2JQENil9JWYLxuaslxPjsfablnw40FlQTR2cATsntd0SDjvqNXPbN/qeLvnSBdfnIQ/nvSx2eSxrveB3/AM/IHQP3jKnDTQgrCMkquVLbL8TUF7UYmJ+fgDelDbnFmURMFJLKyKppfDXNdaooIkpPMmQelRpf+FvrKGvyXs0g8MsnrPV2CDVQl2Hi3qDu95MWrq6LM4LxULL3M1MJKzYXRB1DWDs90...
CertificateMIIE9DCCAtygAwIBAgIQAL0ekW4W+GtVWO3mhdexIzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMTEwMjEwMTUyNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwB8TLl8NiSNYTIL30uRXiovzaQVRY49Q4J5LKHvSxVvE97GAtyLoPCsixC+nvRPN3OOi8d1x...
880"C:\Windows\system32\ntvdm.exe" -i7 C:\Windows\System32\ntvdm.exe4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
944"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\WIndows\svchost.exe"' & exitC:\Windows\System32\cmd.exe
Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
191 081
Read events
188 800
Write events
2 213
Delete events
68

Modification events

(PID) Process:(1080) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
D4DA6D3E3157
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1748) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
201
Suspicious files
120
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\TEST.exeexecutable
MD5:3435DFBBE9E1FB098036AFCD7B7E0D32
SHA256:6A3222ECABE6739E9016073DA83D46D2B8E2BD59B1AC200C3285FDE3287E3EA8
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\856.exeexecutable
MD5:68EDAFE0A1705D5C7DD1CB14FA1CA8CE
SHA256:68F0121F2062AEDE8AE8BD52BBA3C4C6C8AA19BDF32958B4E305CF716A92CC3D
3168Client-built10.exeC:\Program Files\kazeku\Client.exeexecutable
MD5:8B09B710CF79DA2DBB54AC8548EEE0AD
SHA256:F47017465588D49383D9BB5071956E251D4C2AB024270F97B6BA35A3E6E7DEC8
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\MS14-068.exeexecutable
MD5:6450254D888950D0137DA706C58B2FE4
SHA256:6782C5111ABD17435851432895B55CC6371D323A06D710801551CEA800BF65D0
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\Client-built.exeexecutable
MD5:BE5735282826036DCACC522C081365A0
SHA256:78FE9F9CAC3E4D5CF653BE4475C8F247D4803379365DD44320716EA7384A8C11
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\govno__dlya_jertwy.exeexecutable
MD5:BF68EA3C0EDD59A4238C9789BA1B4996
SHA256:32AC6C7FAEE6EE709F1AC4EAC2254C171C683A1911495101CAA91012F790A287
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\mixseven.exeexecutable
MD5:B3DBEC41EE7D66679D2A6DFD87BC8D8D
SHA256:5316D399E974A1D82FC6556C809617847A429AA0417531A82CBD8A1EC066973F
17484363463463464363463463463.exeC:\Users\admin\Desktop\Files\CPDB.exeexecutable
MD5:DAF531BE28CA056A8E9A40966AB83CF0
SHA256:8B96D4F6DDFCB00B4921F876FEA0420B9BAB29C3D572DA3E95335E978C2F94E5
3824MS14-068.exeC:\Users\admin\AppData\Local\Temp\_MEI38242\Microsoft.VC90.CRT.manifestxml
MD5:7DCB4E72D0CED888DF4A6C224F284DEE
SHA256:97DCBB29DFAF4076CFAB4D6503855CFB03102AC1932910DCEA0A22E61D0A6549
2988Client-built.exeC:\Users\admin\AppData\Roaming\SubDir\SYSTEM26.exeexecutable
MD5:BE5735282826036DCACC522C081365A0
SHA256:78FE9F9CAC3E4D5CF653BE4475C8F247D4803379365DD44320716EA7384A8C11
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
11 423
DNS requests
142
Threats
315

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3420
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/ff245185/payload/raw/refs/heads/main/Fast%20Download.exe
unknown
whitelisted
328
4363463463464363463463463.exe
GET
200
75.127.7.164:80
http://75.127.7.164/Supawn.exe
unknown
unknown
3420
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/mariolalo/myrec/raw/refs/heads/main/NOTallowedtocrypt.exe
unknown
whitelisted
1748
4363463463464363463463463.exe
GET
200
185.158.94.217:80
http://185.158.94.217/02.08.2022.exe
unknown
unknown
328
4363463463464363463463463.exe
GET
200
114.201.95.60:80
http://www.medises.co.kr/AsMedises/PXray_Cast_Sort.exe
unknown
unknown
3048
4363463463464363463463463.exe
GET
158.101.35.62:9000
http://158.101.35.62:9000/xblkpfZ8Y4.exe
unknown
unknown
944
4363463463464363463463463.exe
GET
200
51.195.19.98:80
http://dddos.persiangig.com/.GgQ2Q4JUpA/other/jingling.exe
unknown
unknown
3968
4363463463464363463463463.exe
GET
200
87.121.84.254:80
http://check-for-status.cc/1337/TORRENTOLD-1.exe
unknown
unknown
328
4363463463464363463463463.exe
GET
200
159.253.43.129:80
http://turkey-ivf.org/Invoice4231284.exe
unknown
malicious
3884
4363463463464363463463463.exe
GET
200
154.29.78.35:80
http://tirtasentosa.com/give/ukbros003.exe
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1080
svchost.exe
224.0.0.252:5355
whitelisted
1748
4363463463464363463463463.exe
151.101.130.49:443
urlhaus.abuse.ch
FASTLY
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1748
4363463463464363463463463.exe
80.72.24.103:443
test.aionclassic.pro
Mikhail Mayorov
RU
unknown
1748
4363463463464363463463463.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted
1748
4363463463464363463463463.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
1748
4363463463464363463463463.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
3376
Client.exe
18.141.106.224:10431
0.tcp.ap.ngrok.io
AMAZON-02
SG
malicious
704
SYSTEM26.exe
193.161.193.99:43242
OOO Bitree Networks
RU
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
urlhaus.abuse.ch
  • 151.101.130.49
  • 151.101.194.49
  • 151.101.66.49
  • 151.101.2.49
whitelisted
test.aionclassic.pro
  • 80.72.24.103
unknown
github.com
  • 140.82.121.3
  • 140.82.121.4
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
whitelisted
objects.githubusercontent.com
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.111.133
whitelisted
0.tcp.ap.ngrok.io
  • 18.141.106.224
  • 54.169.93.143
malicious
otrodia8912.gleeze.com
  • 78.108.216.225
malicious
download.pdf00.cn
  • 101.72.254.91
  • 119.188.174.58
  • 122.188.45.140
  • 116.196.150.249
  • 119.188.174.59
  • 122.188.45.182
  • 122.188.44.51
  • 122.188.45.51
  • 60.221.17.73
  • 116.153.3.100
  • 122.188.44.139
  • 59.83.212.226
malicious
6.tcp.eu.ngrok.io
  • 3.69.157.220
  • 18.197.239.109
  • 3.68.171.119
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.gleeze .com Domain
1748
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
2944
govno__dlya_jertwy.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
2944
govno__dlya_jertwy.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2944
govno__dlya_jertwy.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
Process
Message
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
Unable to connect to the remote server
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.