URL:

https://www.mediafire.com/file/c75i9epyym0zzx6/Ödeme+onaylama.tgz/file

Full analysis: https://app.any.run/tasks/71102462-f003-41b8-b08c-1ba2b3efa8e1
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: April 19, 2024, 10:53:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exfiltration
stealer
agenttesla
ransomware
Indicators:
MD5:

92396AA76245EEA7594A9A3FEA4B4211

SHA1:

D229B5EA2A599C48990862A0B1CD20A3C6808674

SHA256:

35F24A5704DBC766E38CD1EE779F8A87587D8A76F2E047CAD40020087E7F1C42

SSDEEP:

3:N8DSLw3eGUoFwV5dUtAOKwxMO:2OLw3eGKV56IwKO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • Actions looks like stealing of personal data

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • AGENTTESLA has been detected (YARA)

      • Ödeme onaylama.exe (PID: 864)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2868)
      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 2364)

    • Reads the Internet Settings

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)

    • Application launched itself

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 2364)

    • Accesses Microsoft Outlook profiles

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads settings of System Certificates

      • Ödeme onaylama.exe (PID: 864)

    • Non-standard symbols in registry

      • WINWORD.EXE (PID: 332)
      • WINWORD.EXE (PID: 2964)
      • WINWORD.EXE (PID: 2044)
      • WINWORD.EXE (PID: 1484)
      • WINWORD.EXE (PID: 1696)
      • WINWORD.EXE (PID: 3948)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Ödeme onaylama.exe (PID: 864)

    • Creates files like ransomware instruction

      • WINWORD.EXE (PID: 3948)

  • INFO

    • The process uses the downloaded file

      • iexplore.exe (PID: 668)
      • WinRAR.exe (PID: 2868)

    • Application launched itself

      • iexplore.exe (PID: 668)

    • Checks supported languages

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads the computer name

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads the machine GUID from the registry

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)
      • Ödeme onaylama.exe (PID: 2112)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 668)

    • Reads Environment values

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads the software policy settings

      • Ödeme onaylama.exe (PID: 864)

    • Manual execution by a user

      • WINWORD.EXE (PID: 332)
      • WINWORD.EXE (PID: 2044)
      • WINWORD.EXE (PID: 1484)
      • WINWORD.EXE (PID: 1696)
      • WINWORD.EXE (PID: 3948)
      • WINWORD.EXE (PID: 2964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
14
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs ödeme onaylama.exe no specs #AGENTTESLA ödeme onaylama.exe winword.exe no specs winword.exe no specs PhotoViewer.dll no specs winword.exe no specs winword.exe no specs winword.exe no specs ödeme onaylama.exe no specs winword.exe no specs ödeme onaylama.exe

Process information

PID
CMD
Path
Indicators
Parent process
332"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\structurehtml.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
668"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.mediafire.com/file/c75i9epyym0zzx6/Ödeme+onaylama.tgz/file"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
864"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.34437\Ödeme onaylama.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.34437\Ödeme onaylama.exe
Ödeme onaylama.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Sync Settings
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2868.34437\ödeme onaylama.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1484"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\osterms.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
1696"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\incsources.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2044"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\structurehtml.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2112"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe
Ödeme onaylama.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Sync Settings
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2868.42727\ödeme onaylama.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2364"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe—WinRAR.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Sync Settings
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2868.42727\ödeme onaylama.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2868"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Ödeme onaylama.tgz"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2964"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\eventstue.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
62 840
Read events
59 750
Write events
1 171
Delete events
1 919

Modification events

(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31101511
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31101511
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
0
Suspicious files
43
Text files
3
Unknown types
9

Dropped files

PID
Process
Filename
Type
2868WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2868.34437\Ödeme onaylama.exe —
MD5:—
SHA256:—
332WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR79BB.tmp.cvr —
MD5:—
SHA256:—
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_8FD6BB79A5EEF06F3F8595CB48A9AB04binary
MD5:9977BDC6828C08C58C659E11E666EA98
SHA256:3FF2CE11DB70EAB96043A9B4945A55B0627A7A11B32567CD8FD5A14E0B3E5569
3248iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8XDQC3Y6.txttext
MD5:39F5FA256FCEF7114A687876039809C8
SHA256:0E8F4673FFAECEBA3792103F3476A7109ADD0B239829B1F9387B7564A6D98501
668iexplore.exeC:\Users\admin\Downloads\Ödeme onaylama.tgzcompressed
MD5:E83AD8CDAE12A385672E032FAD69D623
SHA256:3ED897E773CFEF30959AE2B604CDD182E84E85E0133640213DBF414600542DFB
668iexplore.exeC:\Users\admin\Downloads\Ödeme onaylama.tgz.n5u61sk.partial:Zone.Identifier —
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_8FD6BB79A5EEF06F3F8595CB48A9AB04der
MD5:1869ADCED201BBBCD218E3736B8993DE
SHA256:C04C31EA578D111886F9D344140595E9B68F7DFEB929F4BCD042111A9832451C
3248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Ödeme onaylama[1].tgzcompressed
MD5:DCF1A9EFF30FE4DC312F00B8507E7599
SHA256:5121EC4776A97A15CC1422587BBE34F1A57979AAA811C3B47D27E753FC2DA9AE
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:A48C32D0C42E5A529B61053D6463E19F
SHA256:922843F7C72C1410C4A630F7EBD974B4A92C5F30A1205A8A584093301EFAC1F4
2044WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRB33A.tmp.cvr —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3248
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7f68a02ba6df2d36
unknown
—
—
unknown
3248
iexplore.exe
GET
304
173.222.108.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?501143bdbf2f2bd6
unknown
—
—
unknown
3248
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
unknown
—
—
unknown
3248
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
unknown
3248
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCED%2B0KeRQ8NP60VP53TIby3A%3D
unknown
—
—
unknown
668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1080
svchost.exe
GET
304
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3296167e77a9461d
unknown
—
—
unknown
1080
svchost.exe
GET
200
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2c6b76ad7be093c1
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3248
iexplore.exe
104.16.114.74:443
www.mediafire.com
CLOUDFLARENET
—
unknown
3248
iexplore.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3248
iexplore.exe
173.222.108.210:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3248
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3248
iexplore.exe
199.91.155.176:443
download2435.mediafire.com
MEDIAFIRE
US
unknown
1080
svchost.exe
2.16.100.168:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.16.114.74
  • 104.16.113.74
shared
ctldl.windowsupdate.com
  • 173.222.108.226
  • 173.222.108.210
  • 2.16.100.168
  • 88.221.110.91
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
download2435.mediafire.com
  • 199.91.155.176
unknown
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
api.telegram.org
  • 149.154.167.220
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
1080
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
864
Ödeme onaylama.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
864
Ödeme onaylama.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/c75i9epyym0zzx6/Ödeme+onaylama.tgz/file