File name:

purchase.doc

Full analysis: https://app.any.run/tasks/59678ba8-4f31-40e5-a110-44e6bce1b3bb
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 14:53:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
cve-2017-11882
trojan
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

8842B7217B824D86A4455E5F16F61489

SHA1:

0D0A14765B7B3992208F8E35038497AAE6978EA7

SHA256:

363F1E2D56C50BAFED197BC2E4542E2E41AD54A65A919AB5C8E78AFA5351724D

SSDEEP:

24576:VR1dSNls4SD8l3S8YBsSuumTetrkSM8E4DlOHzZ1zsKdOBNrZ8rz/4xv9OwXYSkV:E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2916)

    • Application was dropped or rewritten from another process

      • A.R (PID: 2496)
      • A.R (PID: 3644)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3424)

    • AZORULT was detected

      • A.R (PID: 3644)

    • Connects to CnC server

      • A.R (PID: 3644)

    • Actions looks like stealing of personal data

      • A.R (PID: 3644)

    • Loads dropped or rewritten executable

      • A.R (PID: 3644)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2916)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3424)

    • Starts application with an unusual extension

      • CmD.exe (PID: 4092)
      • A.R (PID: 2496)

    • Application launched itself

      • A.R (PID: 2496)
      • rundll32.exe (PID: 3032)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 3032)
      • WINWORD.EXE (PID: 2916)

    • Executable content was dropped or overwritten

      • A.R (PID: 3644)

    • Reads the cookies of Mozilla Firefox

      • A.R (PID: 3644)

    • Reads the cookies of Google Chrome

      • A.R (PID: 3644)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2916)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3424)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2916)
      • firefox.exe (PID: 2296)

    • Changes settings of System certificates

      • pingsender.exe (PID: 2396)
      • pingsender.exe (PID: 3512)

    • Application launched itself

      • firefox.exe (PID: 2296)

    • Reads CPU info

      • firefox.exe (PID: 2296)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 2396)
      • pingsender.exe (PID: 3512)

    • Reads settings of System Certificates

      • pingsender.exe (PID: 3512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Author: wuyan
LastModifiedBy: wuyan
CreateDate: 2019:01:03 16:14:00
ModifyDate: 2019:01:03 16:34:00
RevisionNumber: 3
TotalEditTime: 1 minute
Pages: 1
Words: 4
Characters: 24
CharactersWithSpaces: 27
InternalVersionNumber: 57435
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
16
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe eqnedt32.exe cmd.exe no specs a.r no specs rundll32.exe no specs #AZORULT a.r rundll32.exe no specs mctadmin.exe no specs rundll32.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe pingsender.exe pingsender.exe

Process information

PID
CMD
Path
Indicators
Parent process
1668"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2296.0.85498190\899927277" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 2296 "\\.\pipe\gecko-crash-server-pipe.2296" 1120 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2296"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2396"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/27833ea0-44d2-4529-84dc-858e74624328/health/Firefox/65.0.2/release/20190225143501?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\27833ea0-44d2-4529-84dc-858e74624328C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2420C:\Windows\system32\mctadmin.exeC:\Windows\system32\mctadmin.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MCTAdmin
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mctadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2496C:\Users\admin\AppData\Local\Temp\A.RC:\Users\admin\AppData\Local\Temp\A.R—CmD.exe
User:
admin
Company:
APOSTO2
Integrity Level:
MEDIUM
Description:
Chinanta
Exit code:
0
Version:
1.05.0007
Modules
Images
c:\users\admin\appdata\local\temp\a.r
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2916"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\purchase.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3032"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\intl.cplC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3424"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3512"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/7259e26b-f243-48e5-ba84-9bcfbf69d226/main/Firefox/65.0.2/release/20190225143501?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\7259e26b-f243-48e5-ba84-9bcfbf69d226C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3516"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\A.RC:\Windows\system32\rundll32.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
2 648
Read events
1 307
Write events
1 328
Delete events
13

Modification events

(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:/f>
Value:
2F663E00640B0000010000000000000000000000
(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2916) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1318649886
(PID) Process:(2916) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1318650008
(PID) Process:(2916) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1318650009
(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
640B0000960906AD76FBD40100000000
(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:)g>
Value:
29673E00640B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:)g>
Value:
29673E00640B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2916) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
49
Suspicious files
34
Text files
17
Unknown types
31

Dropped files

PID
Process
Filename
Type
2916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRFE0F.tmp.cvr —
MD5:—
SHA256:—
2916WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
2916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase.doc.rtfpgc
MD5:—
SHA256:—
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-libraryloader-l1-1-0.dllexecutable
MD5:D0873E21721D04E20B6FFB038ACCF2F1
SHA256:BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:D97A1CB141C6806F0101A5ED2673A63D
SHA256:DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
2916WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9E51F443.emfemf
MD5:F7961E44FE51CEEE06391905162E18E0
SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:CB978304B79EF53962408C611DFB20F5
SHA256:90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:6D778E83F74A4C7FE4C077DC279F6867
SHA256:A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:E2F648AE40D234A3892E1455B4DBBE05
SHA256:C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:502263C56F931DF8440D7FD2FA7B7C00
SHA256:94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
15
DNS requests
51
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2296
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2296
firefox.exe
POST
200
216.58.207.67:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
2296
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3644
A.R
POST
200
194.87.239.100:80
http://uzoeze.online/index.php
RU
binary
4.27 Mb
malicious
2296
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3644
A.R
POST
200
194.87.239.100:80
http://uzoeze.online/index.php
RU
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3644
A.R
194.87.239.100:80
uzoeze.online
JSC Mediasoft ekspert
RU
malicious
2296
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
2296
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2296
firefox.exe
52.27.229.90:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3512
pingsender.exe
52.89.38.17:443
incoming.telemetry.mozilla.org
Amazon.com, Inc.
US
unknown
2396
pingsender.exe
52.34.248.21:443
incoming.telemetry.mozilla.org
Amazon.com, Inc.
US
unknown
2296
firefox.exe
52.42.232.148:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2296
firefox.exe
54.230.93.172:443
tracking-protection.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
2296
firefox.exe
52.85.184.119:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
2296
firefox.exe
34.223.207.155:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
uzoeze.online
  • 194.87.239.100
malicious
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 52.27.229.90
  • 54.200.51.65
  • 52.10.42.204
whitelisted
search.r53-2.services.mozilla.com
  • 52.10.42.204
  • 54.200.51.65
  • 52.27.229.90
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
tiles.services.mozilla.com
  • 52.42.232.148
  • 52.34.132.219
  • 52.43.40.243
  • 52.35.250.5
  • 35.166.92.58
  • 52.26.103.165
  • 52.43.91.152
  • 52.88.59.160
whitelisted
tiles.r53-2.services.mozilla.com
  • 52.88.59.160
  • 52.43.91.152
  • 52.26.103.165
  • 35.166.92.58
  • 52.35.250.5
  • 52.43.40.243
  • 52.34.132.219
  • 52.42.232.148
whitelisted
snippets.cdn.mozilla.net
  • 52.85.184.119
whitelisted

Threats

PID
Process
Class
Message
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Response
3644
A.R
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3644
A.R
A Network Trojan was detected
ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
purchase.doc