File name:

SecuriteInfo.com.Win64.MalwareX-gen.15932.4492

Full analysis: https://app.any.run/tasks/cb5bdf8d-e28f-49d4-9e1e-7fe6c14d0718
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: February 11, 2025, 10:45:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
evasion
rat
quasar
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

08470C644B61ED4B473020EB6C455908

SHA1:

FAE885140CC9DA77827128C8769DE3B73E40D4FF

SHA256:

32C14F0518965F6B1262E1E66B5BCA6BCAAE957CD38F9C035DA6D4C1399DCA1A

SSDEEP:

12288:gEh4JOy6zAoHEruibBzVIIz3e8S9d8WYjaRQ4+:gEh4JOy6zAokrbxSNQ4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6344)
      • powershell.exe (PID: 6780)

    • Adds path to the Windows Defender exclusion list

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 6720)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 6720)

    • Uses Task Scheduler to autorun other applications

      • mmytljldrgl.exe (PID: 4128)
      • Client.exe (PID: 3820)

    • QUASAR has been detected (SURICATA)

      • Client.exe (PID: 3820)

    • QUASAR has been detected (YARA)

      • Client.exe (PID: 3820)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6400)
      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)

    • Reads the date of Windows installation

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6400)
      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)

    • Application launched itself

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6400)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 6720)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 6720)

    • Starts CMD.EXE for commands execution

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 6720)

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • mmytljldrgl.exe (PID: 4128)

    • Checks Windows Trust Settings

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)

    • Starts itself from another location

      • mmytljldrgl.exe (PID: 4128)

    • Checks for external IP

      • svchost.exe (PID: 2192)

    • Contacting a server suspected of hosting an CnC

      • Client.exe (PID: 3820)

    • Connects to unusual port

      • Client.exe (PID: 3820)

    • There is functionality for taking screenshot (YARA)

      • Client.exe (PID: 3820)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6400)
      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • mmytljldrgl.exe (PID: 4128)
      • Client.exe (PID: 3820)

    • Reads the computer name

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6400)
      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • Client.exe (PID: 3820)
      • mmytljldrgl.exe (PID: 4128)

    • Process checks computer location settings

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6400)
      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6344)
      • powershell.exe (PID: 6780)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6344)
      • powershell.exe (PID: 6780)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • Client.exe (PID: 3820)
      • mmytljldrgl.exe (PID: 4128)

    • Reads the software policy settings

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • Client.exe (PID: 3820)

    • Checks proxy server information

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • Client.exe (PID: 3820)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe (PID: 6688)
      • mmytljldrgl.exe (PID: 4128)

    • Reads Environment values

      • Client.exe (PID: 3820)
      • mmytljldrgl.exe (PID: 4128)

    • Disables trace logs

      • Client.exe (PID: 3820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(3820) Client.exe
Version1.4.1
C2 (2)87.228.57.81:4782
Sub_DirSubDir
Install_NameClient.exe
Mutexcf3988ab-2fd9-4544-a16f-9faa71eb5bac
Startupsvchoost.exe
Taggithubyt
LogDirLogs
SignatureSSSXaR44GRb6RYmfFpZjNvvxDEF0KI5jH8nAxi6KcQzCkmdFj4EmiNa7wzIn6QlTh6m9p8r0dvOdGcKp9R7a0feJ+9nftufivecVEcRMW+w9A0X3vAKDbhMDGoJK/oCpkIWanwn5htUKhAJB1lNPjwjIbjG59Xr7nQuXbI0zG8R5zUBqkB7LcDn23y9ViJS55kXsDdCMrrrzn3PsDzs0HTUE4E9W1OuqLpiq9ipYZce25NDQPlIfeAVgyRYzjvec4Uu1mthPaSYUvBiWdDBx5a+gN5tH6ZXROlVMsEMnIJhg...
CertificateMIIE9jCCAt6gAwIBAgIQAMCIrkV3lAMp6Vz+9SYptTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFQaGFudG9tIFNlcnZlciBDQTAgFw0yNTAxMjQxNzU0MjFaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRUGhhbnRvbSBTZXJ2ZXIgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCLqDcacB918PiS52/zK8NuYRFBjeeZXbEfkolana8gflQhGUIyaXW73olgd952Z18rz4CB...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:09 13:40:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 192000
InitializedDataSize: 95744
UninitializedDataSize: -
EntryPoint: 0xb9d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
29
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start securiteinfo.com.win64.malwarex-gen.15932.4492.exe no specs conhost.exe no specs securiteinfo.com.win64.malwarex-gen.15932.4492.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs mmytljldrgl.exe schtasks.exe no specs conhost.exe no specs #QUASAR client.exe schtasks.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3612"schtasks" /create /tn "svchoost.exe" /sc ONLOGON /tr "C:\Users\admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—mmytljldrgl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3820"C:\Users\admin\AppData\Roaming\SubDir\Client.exe"C:\Users\admin\AppData\Roaming\SubDir\Client.exe
mmytljldrgl.exe
User:
admin
Integrity Level:
HIGH
Description:
Quasar Client
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\roaming\subdir\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Quasar
(PID) Process(3820) Client.exe
Version1.4.1
C2 (2)87.228.57.81:4782
Sub_DirSubDir
Install_NameClient.exe
Mutexcf3988ab-2fd9-4544-a16f-9faa71eb5bac
Startupsvchoost.exe
Taggithubyt
LogDirLogs
SignatureSSSXaR44GRb6RYmfFpZjNvvxDEF0KI5jH8nAxi6KcQzCkmdFj4EmiNa7wzIn6QlTh6m9p8r0dvOdGcKp9R7a0feJ+9nftufivecVEcRMW+w9A0X3vAKDbhMDGoJK/oCpkIWanwn5htUKhAJB1lNPjwjIbjG59Xr7nQuXbI0zG8R5zUBqkB7LcDn23y9ViJS55kXsDdCMrrrzn3PsDzs0HTUE4E9W1OuqLpiq9ipYZce25NDQPlIfeAVgyRYzjvec4Uu1mthPaSYUvBiWdDBx5a+gN5tH6ZXROlVMsEMnIJhg...
CertificateMIIE9jCCAt6gAwIBAgIQAMCIrkV3lAMp6Vz+9SYptTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFQaGFudG9tIFNlcnZlciBDQTAgFw0yNTAxMjQxNzU0MjFaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRUGhhbnRvbSBTZXJ2ZXIgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCLqDcacB918PiS52/zK8NuYRFBjeeZXbEfkolana8gflQhGUIyaXW73olgd952Z18rz4CB...
4052"schtasks" /create /tn "svchoost.exe" /sc ONLOGON /tr "C:\Users\admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4128"C:\MFCSK\mmytljldrgl.exe" C:\MFCSK\mmytljldrgl.exe
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
User:
admin
Integrity Level:
HIGH
Description:
Quasar Client
Exit code:
3
Version:
1.4.1
Modules
Images
c:\mfcsk\mmytljldrgl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4704\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6276C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6292C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6324C:\WINDOWS\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\MFCSK'"C:\Windows\System32\cmd.exe—SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
17 213
Read events
17 196
Write events
17
Delete events
0

Modification events

(PID) Process:(6688) SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6688) SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6688) SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3820) Client.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
3
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:3B34627E489E8CBDE92211412037FFEC
SHA256:83D88B88EFD2A40BAB2BDEE59F9F86516ED7EF53DB44B3A58400A82D8E7AD3DB
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:03B815803BF902C7303A1070BE87B02E
SHA256:BDE003E6759575A5C575F23CC5833E1325BA094451086D7791AB8B74AA74F874
6780powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0rreg5q5.4iw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:CC610C38566D7D7A538A3FB9CD877BD5
SHA256:4E63670525F015690339E8FE6F4969F7B263FE911DC5FDF0F1AEE9B3AA1EB983
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:D9A279464926DD85476DA380BB67139D
SHA256:B97D5DD4D565EFEBA2F625AE3AB0202D5CD45CDFC37BBBEA9509AF71468E45A8
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CA54E0FA212456E1DB00704A97658Ebinary
MD5:3FF083DCAA1A057EDC8803427FC39A00
SHA256:F5E7AC1513B1968C1B913ECA52E1B7E6EA6BE1160458C204B19C16131BFA2855
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:5FFF8813C7C3B0A919D01DB2AEDD911C
SHA256:070524DC07B3FE6F3AE2E41C63C9717EA6D67BD9B7B62E7D59B6C8603DB213BA
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\MFCSK\mmytljldrgl.exeexecutable
MD5:766E053D13E4F6750E8F694EFB00FAD0
SHA256:0502A8DA4A9F46A7375766B83D181AA9F38E9969B10801F80736A3598410A281
6688SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\mmytljldrgl[1].exeexecutable
MD5:766E053D13E4F6750E8F694EFB00FAD0
SHA256:0502A8DA4A9F46A7375766B83D181AA9F38E9969B10801F80736A3598410A281
4128mmytljldrgl.exeC:\Users\admin\AppData\Roaming\SubDir\Client.exeexecutable
MD5:766E053D13E4F6750E8F694EFB00FAD0
SHA256:0502A8DA4A9F46A7375766B83D181AA9F38E9969B10801F80736A3598410A281
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6688
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
6688
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6688
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
7032
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7032
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.18.97.227:443
go.microsoft.com
Akamai International B.V.
FR
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.19.122.46:443
—
Akamai International B.V.
DE
unknown
1176
svchost.exe
40.126.31.129:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1076
svchost.exe
2.18.97.227:443
go.microsoft.com
Akamai International B.V.
FR
whitelisted
1176
svchost.exe
20.190.159.129:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1176
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6688
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted
6688
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 2.18.97.227
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
github.com
  • 140.82.121.3
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
ipwho.is
  • 195.201.57.90
malicious
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
3820
Client.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
2192
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
3820
Client.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (GCM_SHA384)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win64.MalwareX-gen.15932.4492