File name:

bomb.exe

Full analysis: https://app.any.run/tasks/f8173040-82ef-496a-9f8d-df9df5362fc6
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: August 31, 2024, 09:34:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
stealer
metastealer
redline
phorpiex
stealc
exfiltration
vidar
payload
keylogger
remcos
rat
netreactor
purehvnc
raccoonclipper
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

55DBA6E7AA4E8CC73415F4E3F9F6BDAE

SHA1:

87C9F29D58F57A5E025061D389BE2655EE879D5D

SHA256:

3CEA805F1396DF15BDBCD4317388A046A41A6079DBA04576A58BA7B2C812338A

SSDEEP:

192:HLmmmmlmtYz0wZick7pDMj4GbCrMz+MCZLa7HhdSbwxz1OLU87glpp/bI6J4yfm4:pmi7k7pMiLLaLhM6OLU870NJqoI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stealers network behavior

      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 3252)
      • Sellers.pif (PID: 1948)

    • METASTEALER has been detected (SURICATA)

      • RegAsm.exe (PID: 3284)

    • Connects to the CnC server

      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3652)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • RegAsm.exe (PID: 3252)

    • PHORPIEX has been detected (SURICATA)

      • svchost.exe (PID: 1060)
      • sysmysldrv.exe (PID: 444)
      • bomb.exe (PID: 2396)

    • REDLINE has been detected (SURICATA)

      • RegAsm.exe (PID: 3284)

    • Changes the autorun value in the registry

      • http185.215.113.66newtpp.exe.exe (PID: 3356)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • startup.exe (PID: 2004)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)

    • Changes Security Center notification settings

      • sysmysldrv.exe (PID: 444)

    • Changes appearance of the Explorer extensions

      • sysmysldrv.exe (PID: 444)

    • Changes the Windows auto-update feature

      • sysmysldrv.exe (PID: 444)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 2220)
      • sysmysldrv.exe (PID: 444)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)

    • STEALC has been detected (SURICATA)

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • RegAsm.exe (PID: 3252)

    • Steals credentials

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • Sellers.pif (PID: 1948)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • Sellers.pif (PID: 1948)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 660)
      • GDBFCGIIIJ.exe (PID: 2744)
      • oobeldr.exe (PID: 3544)

    • Create files in the Startup directory

      • cmd.exe (PID: 348)

    • REDLINE has been detected (YARA)

      • RegAsm.exe (PID: 3284)

    • PHORPIEX has been detected (YARA)

      • sysmysldrv.exe (PID: 444)

    • STEALC has been detected (YARA)

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 3252)

    • VIDAR has been detected (YARA)

      • RegAsm.exe (PID: 580)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)

    • REMCOS has been detected

      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • startup.exe (PID: 2004)
      • startup.exe (PID: 2004)

    • REMCOS has been detected (YARA)

      • startup.exe (PID: 2004)

    • Starts NET.EXE for service management

      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • net.exe (PID: 3292)
      • net.exe (PID: 2580)
      • net.exe (PID: 400)
      • net.exe (PID: 3260)
      • net.exe (PID: 3672)
      • net.exe (PID: 3496)
      • net.exe (PID: 3688)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 2204)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2204)

    • PUREHVNC has been detected (YARA)

      • RegAsm.exe (PID: 1144)

    • RACCOONCLIPPER has been detected (YARA)

      • oobeldr.exe (PID: 3544)

    • VIDAR has been detected (SURICATA)

      • Sellers.pif (PID: 1948)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • bomb.exe (PID: 2396)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)
      • RegAsm.exe (PID: 3252)

    • Reads settings of System Certificates

      • bomb.exe (PID: 2396)
      • RegAsm.exe (PID: 3652)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • Sellers.pif (PID: 1948)

    • Reads the Internet Settings

      • bomb.exe (PID: 2396)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3652)
      • powershell.exe (PID: 2752)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • RegAsm.exe (PID: 3532)
      • RegAsm.exe (PID: 3252)
      • Sellers.pif (PID: 1948)

    • Drops the executable file immediately after the start

      • bomb.exe (PID: 2396)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • http185.215.113.66newtpp.exe.exe (PID: 3356)
      • cmd.exe (PID: 940)
      • Tapes.pif (PID: 1420)
      • RegAsm.exe (PID: 3652)
      • GDBFCGIIIJ.exe (PID: 2744)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • RegAsm.exe (PID: 3004)
      • cmd.exe (PID: 2660)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)

    • Executable content was dropped or overwritten

      • bomb.exe (PID: 2396)
      • http185.215.113.66newtpp.exe.exe (PID: 3356)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • cmd.exe (PID: 940)
      • Tapes.pif (PID: 1420)
      • RegAsm.exe (PID: 3652)
      • GDBFCGIIIJ.exe (PID: 2744)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • RegAsm.exe (PID: 3004)
      • cmd.exe (PID: 2660)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • RegAsm.exe (PID: 2092)

    • Potential Corporate Privacy Violation

      • bomb.exe (PID: 2396)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)

    • Connects to the server without a host name

      • bomb.exe (PID: 2396)
      • RegAsm.exe (PID: 3652)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • RegAsm.exe (PID: 3252)

    • Starts itself from another location

      • http185.215.113.66newtpp.exe.exe (PID: 3356)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)

    • Process requests binary or script from the Internet

      • bomb.exe (PID: 2396)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)

    • Connects to unusual port

      • RegAsm.exe (PID: 3284)
      • bomb.exe (PID: 2396)
      • startup.exe (PID: 2004)
      • RegAsm.exe (PID: 1144)
      • sysmysldrv.exe (PID: 444)

    • Starts CMD.EXE for commands execution

      • sysmysldrv.exe (PID: 444)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • cmd.exe (PID: 940)
      • RegAsm.exe (PID: 3652)
      • cmd.exe (PID: 2660)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • Sellers.pif (PID: 1948)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2220)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 2220)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3220)
      • httphi.admini.website8c64.exe.exe (PID: 1964)

    • Executing commands from a ".bat" file

      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • httphi.admini.website8c64.exe.exe (PID: 1964)

    • Windows Defender mutex has been found

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 3252)

    • Searches for installed software

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2752)

    • Reads browser cookies

      • RegAsm.exe (PID: 3284)

    • Contacting a server suspected of hosting an CnC

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • RegAsm.exe (PID: 3252)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 940)
      • Tapes.pif (PID: 1420)
      • cmd.exe (PID: 2660)

    • Get information on the list of running processes

      • cmd.exe (PID: 940)
      • cmd.exe (PID: 2660)

    • The process connected to a server suspected of theft

      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3652)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 940)
      • cmd.exe (PID: 2660)

    • Application launched itself

      • cmd.exe (PID: 940)
      • cmd.exe (PID: 2660)

    • The executable file from the user directory is run by the CMD process

      • Tapes.pif (PID: 1420)
      • Sellers.pif (PID: 1948)

    • Starts application with an unusual extension

      • cmd.exe (PID: 940)
      • cmd.exe (PID: 2660)

    • The process drops Mozilla's DLL files

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)

    • The process drops C-runtime libraries

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)

    • Process drops legitimate windows executable

      • RegAsm.exe (PID: 3652)
      • bomb.exe (PID: 2396)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • RegAsm.exe (PID: 3004)
      • Tapes.pif (PID: 1420)
      • RegAsm.exe (PID: 2092)

    • Creates file in the systems drive root

      • ntvdm.exe (PID: 1368)

    • Starts a Microsoft application from unusual location

      • http147.45.44.104prog66d1ee505e71e_Build.exe.exe (PID: 2684)
      • http147.45.44.104yuop66d1ee217b021_1202156955.exe#120.exe (PID: 3488)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • RegAsm.exe (PID: 1144)

    • Checks Windows Trust Settings

      • RegAsm.exe (PID: 3652)
      • Sellers.pif (PID: 1948)

    • Adds/modifies Windows certificates

      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)

    • Payload loading activity detected

      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)

    • Writes files like Keylogger logs

      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)

    • The process creates files with name similar to system file names

      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • Tapes.pif (PID: 1420)

    • There is functionality for taking screenshot (YARA)

      • startup.exe (PID: 2004)

    • Hides command output

      • sc.exe (PID: 3264)

    • The process executes VB scripts

      • httphi.admini.website8c64.exe.exe (PID: 1964)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2204)

    • Reads the date of Windows installation

      • httphi.admini.website8c64.exe.exe (PID: 1964)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2420)
      • cmd.exe (PID: 1156)

    • The process executes via Task Scheduler

      • oobeldr.exe (PID: 3544)

  • INFO

    • Checks supported languages

      • bomb.exe (PID: 2396)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • http185.215.113.66newtpp.exe.exe (PID: 3356)
      • http147.45.44.104revada66d2b5c78630c_crypted.exe#1.exe (PID: 2452)
      • RegAsm.exe (PID: 3284)
      • wmpnscfg.exe (PID: 3260)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • sysmysldrv.exe (PID: 444)
      • 191532736.exe (PID: 3120)
      • http147.45.44.104lopsa66d1ec0485e55_stealc_default.exe#kisotr.exe (PID: 2948)
      • RegAsm.exe (PID: 3652)
      • Tapes.pif (PID: 1420)
      • 3261622317.exe (PID: 3812)
      • RegAsm.exe (PID: 3824)
      • http147.45.44.104prog66d1ee505e71e_Build.exe.exe (PID: 2684)
      • http147.45.44.104prog66d1e3d3208e9_vfdw12.exe#d12.exe (PID: 2664)
      • RegAsm.exe (PID: 580)
      • http147.45.44.104prog66d1e3c3c7dc6_vregs.exe#space.exe (PID: 2080)
      • GDBFCGIIIJ.exe (PID: 2744)
      • http147.45.44.104yuop66d1ee217b021_1202156955.exe#120.exe (PID: 3488)
      • RegAsm.exe (PID: 2440)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3004)
      • http147.45.44.104prog66d1e3d63bd13_sbgdwf.exe#space.exe (PID: 3860)
      • http147.45.44.104malesa66d1b7f7f3765_Front.exe.exe (PID: 648)
      • http147.45.44.104yuop66d1eb58f2491_stealc_cry.exe#kiscrypto.exe (PID: 2156)
      • RegAsm.exe (PID: 3252)
      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • startup.exe (PID: 2004)
      • http54.189.150.242302MeMpEng.exe.exe (PID: 1392)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • Sellers.pif (PID: 1948)
      • RegAsm.exe (PID: 1144)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • RegAsm.exe (PID: 2116)
      • EHDHDHIECG.exe (PID: 3404)
      • HJJKJJDHCG.exe (PID: 1980)
      • RegAsm.exe (PID: 3532)
      • oobeldr.exe (PID: 3544)
      • http112.67.250.50779ChromeSetup.exe.exe (PID: 3640)

    • Reads the machine GUID from the registry

      • bomb.exe (PID: 2396)
      • RegAsm.exe (PID: 3284)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • RegAsm.exe (PID: 3652)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • RegAsm.exe (PID: 1144)
      • RegAsm.exe (PID: 3532)
      • RegAsm.exe (PID: 3252)
      • Sellers.pif (PID: 1948)

    • Reads the computer name

      • bomb.exe (PID: 2396)
      • http147.45.44.104revada66d2b5c78630c_crypted.exe#1.exe (PID: 2452)
      • RegAsm.exe (PID: 3284)
      • wmpnscfg.exe (PID: 3260)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3652)
      • http147.45.44.104lopsa66d1ec0485e55_stealc_default.exe#kisotr.exe (PID: 2948)
      • Tapes.pif (PID: 1420)
      • http147.45.44.104prog66d1ee505e71e_Build.exe.exe (PID: 2684)
      • http147.45.44.104prog66d1e3d3208e9_vfdw12.exe#d12.exe (PID: 2664)
      • http147.45.44.104yuop66d1ee217b021_1202156955.exe#120.exe (PID: 3488)
      • http147.45.44.104prog66d1e3c3c7dc6_vregs.exe#space.exe (PID: 2080)
      • http147.45.44.104prog66d1e3d63bd13_sbgdwf.exe#space.exe (PID: 3860)
      • RegAsm.exe (PID: 2092)
      • http147.45.44.104yuop66d1eb58f2491_stealc_cry.exe#kiscrypto.exe (PID: 2156)
      • RegAsm.exe (PID: 3252)
      • RegAsm.exe (PID: 3004)
      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • startup.exe (PID: 2004)
      • Sellers.pif (PID: 1948)
      • RegAsm.exe (PID: 1144)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • EHDHDHIECG.exe (PID: 3404)
      • RegAsm.exe (PID: 3532)
      • HJJKJJDHCG.exe (PID: 1980)

    • Disables trace logs

      • bomb.exe (PID: 2396)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)

    • Reads Environment values

      • bomb.exe (PID: 2396)
      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3004)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • startup.exe (PID: 2004)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)

    • Reads the software policy settings

      • bomb.exe (PID: 2396)
      • RegAsm.exe (PID: 3652)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • Sellers.pif (PID: 1948)

    • The process uses the downloaded file

      • bomb.exe (PID: 2396)
      • http185.215.113.66newtpp.exe.exe (PID: 3356)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • sysmysldrv.exe (PID: 444)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • powershell.exe (PID: 2752)
      • RegAsm.exe (PID: 3652)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • RegAsm.exe (PID: 3004)
      • httphi.admini.website8c64.exe.exe (PID: 1964)
      • httpddl.safone.dev3808735US+ONLY1.exehash=AgADkx.exe (PID: 3132)
      • RegAsm.exe (PID: 2092)
      • Sellers.pif (PID: 1948)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3260)
      • cmd.exe (PID: 348)
      • cmd.exe (PID: 660)
      • RegAsm.exe (PID: 1144)

    • Creates files or folders in the user directory

      • RegAsm.exe (PID: 3284)
      • http185.215.113.66pei.exe.exe (PID: 3352)
      • RegAsm.exe (PID: 3652)
      • sysmysldrv.exe (PID: 444)
      • Tapes.pif (PID: 1420)
      • GDBFCGIIIJ.exe (PID: 2744)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • http91.92.254.178saphiremasrshal.exe.exe (PID: 3500)
      • RegAsm.exe (PID: 3532)
      • RegAsm.exe (PID: 3252)
      • Sellers.pif (PID: 1948)

    • Create files in a temporary directory

      • http185.215.113.66pei.exe.exe (PID: 3352)
      • http147.45.44.104yuop66d1b31955f50_SunshineSolving.exe.exe (PID: 2244)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 580)
      • http107.172.31.21510MeMpEng.exe.exe (PID: 1084)
      • http54.189.150.242302MeMpEng.exe.exe (PID: 1392)
      • http147.45.44.104revada66cef067bb8bb_CoinAccording.exe.exe (PID: 1840)
      • Tapes.pif (PID: 1420)
      • Sellers.pif (PID: 1948)
      • http112.67.250.50779ChromeSetup.exe.exe (PID: 3640)

    • Checks proxy server information

      • http185.215.113.66pei.exe.exe (PID: 3352)
      • RegAsm.exe (PID: 3652)
      • sysmysldrv.exe (PID: 444)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)
      • RegAsm.exe (PID: 3252)

    • Reads product name

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3284)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • startup.exe (PID: 2004)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)

    • Reads CPU info

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 2092)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2752)

    • Creates files in the program directory

      • RegAsm.exe (PID: 3652)
      • RegAsm.exe (PID: 2092)
      • http91.92.254.178xcvjhg.exe.exe (PID: 3044)
      • RegAsm.exe (PID: 3004)
      • RegAsm.exe (PID: 3532)
      • Sellers.pif (PID: 1948)

    • Reads mouse settings

      • Tapes.pif (PID: 1420)
      • http54.189.150.242302MeMpEng.exe.exe (PID: 1392)
      • Sellers.pif (PID: 1948)

    • .NET Reactor protector has been detected

      • RegAsm.exe (PID: 1144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(3284) RegAsm.exe
C2 (1)147.45.47.36:30035
BotnetLogsDiller Cloud (TG: @logsdillabot)
Options
ErrorMessage
Keys
XorServery

Stealc

(PID) Process(3652) RegAsm.exe
C2193.176.190.41
Strings (353)INSERT_KEY_HERE
12
09
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://193.176.190.41
kiskis
|
/2fa883eebd632382.php
/9e7fbd3f0393ef32/
default
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
CloseWindow
wsprintfA
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
wsprintfW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
ShellExecuteExA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrCmpCA
StrStrA
StrCmpCW
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmGetList
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
browser:
profile:
url:
login:
password:
Opera
OperaGX
Network
cookies
.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
autofill
SELECT name, value FROM autofill
history
SELECT url FROM urls LIMIT 1000
cc
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
name:
month:
year:
card:
Cookies
Login Data
Web Data
History
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
plugins
Local Extension Settings
Sync Extension Settings
IndexedDB
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
Local State
profiles.ini
chrome
opera
firefox
wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x32
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
Network Info:
- IP: IP?
- Country: ISO?
System Summary:
- HWID:
- OS:
- Architecture:
- UserName:
- Computer Name:
- Local Time:
- UTC:
- Language:
- Keyboards:
- Laptop:
- Running Path:
- CPU:
- Threads:
- Cores:
- RAM:
- Display Resolution:
- GPU:
User Agents:
Installed Apps:
All Users:
Current User:
Process List:
system_info.txt
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
runas
open
/c start
%DESKTOP%
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DOCUMENTS%
%PROGRAMFILES%
%PROGRAMFILES_86%
%RECENT%
*.lnk
files
\discord\
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
key_datas
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Telegram
Tox
*.tox
*.ini
Password
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
00000001
00000002
00000003
00000004
\Outlook\accounts.txt
Pidgin
\.purple\
accounts.xml
dQw4w9WgXcQ
token:
Software\Valve\Steam
SteamPath
\config\
ssfn*
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
sqlite3.dll
browsers
done
soft
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
https
Content-Type: multipart/form-data; boundary=----
POST
HTTP/1.1
Content-Disposition: form-data; name="
hwid
build
token
file_name
file
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg
(PID) Process(3252) RegAsm.exe
C2193.176.190.41
Strings (353)INSERT_KEY_HERE
12
09
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://193.176.190.41
kiskis
|
/2fa883eebd632382.php
/9e7fbd3f0393ef32/
cry
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
CloseWindow
wsprintfA
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
wsprintfW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
ShellExecuteExA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrCmpCA
StrStrA
StrCmpCW
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmGetList
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
browser:
profile:
url:
login:
password:
Opera
OperaGX
Network
cookies
.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
autofill
SELECT name, value FROM autofill
history
SELECT url FROM urls LIMIT 1000
cc
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
name:
month:
year:
card:
Cookies
Login Data
Web Data
History
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
plugins
Local Extension Settings
Sync Extension Settings
IndexedDB
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
Local State
profiles.ini
chrome
opera
firefox
wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x32
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
Network Info:
- IP: IP?
- Country: ISO?
System Summary:
- HWID:
- OS:
- Architecture:
- UserName:
- Computer Name:
- Local Time:
- UTC:
- Language:
- Keyboards:
- Laptop:
- Running Path:
- CPU:
- Threads:
- Cores:
- RAM:
- Display Resolution:
- GPU:
User Agents:
Installed Apps:
All Users:
Current User:
Process List:
system_info.txt
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
runas
open
/c start
%DESKTOP%
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DOCUMENTS%
%PROGRAMFILES%
%PROGRAMFILES_86%
%RECENT%
*.lnk
files
\discord\
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
key_datas
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Telegram
Tox
*.tox
*.ini
Password
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
00000001
00000002
00000003
00000004
\Outlook\accounts.txt
Pidgin
\.purple\
accounts.xml
dQw4w9WgXcQ
token:
Software\Valve\Steam
SteamPath
\config\
ssfn*
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
sqlite3.dll
browsers
done
soft
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
https
Content-Type: multipart/form-data; boundary=----
POST
HTTP/1.1
Content-Disposition: form-data; name="
hwid
build
token
file_name
file
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg
(PID) Process(3004) RegAsm.exe
C246.8.231.109
Strings (353)INSERT_KEY_HERE
09
09
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://46.8.231.109
george
|
/c4754d4f680ead72.php
/1309cdeb8f4c8736/
default
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
CloseWindow
wsprintfA
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
wsprintfW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
ShellExecuteExA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrCmpCA
StrStrA
StrCmpCW
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmGetList
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
browser:
profile:
url:
login:
password:
Opera
OperaGX
Network
cookies
.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
autofill
SELECT name, value FROM autofill
history
SELECT url FROM urls LIMIT 1000
cc
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
name:
month:
year:
card:
Cookies
Login Data
Web Data
History
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
plugins
Local Extension Settings
Sync Extension Settings
IndexedDB
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
Local State
profiles.ini
chrome
opera
firefox
wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x32
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
Network Info:
- IP: IP?
- Country: ISO?
System Summary:
- HWID:
- OS:
- Architecture:
- UserName:
- Computer Name:
- Local Time:
- UTC:
- Language:
- Keyboards:
- Laptop:
- Running Path:
- CPU:
- Threads:
- Cores:
- RAM:
- Display Resolution:
- GPU:
User Agents:
Installed Apps:
All Users:
Current User:
Process List:
system_info.txt
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
runas
open
/c start
%DESKTOP%
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DOCUMENTS%
%PROGRAMFILES%
%PROGRAMFILES_86%
%RECENT%
*.lnk
files
\discord\
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
key_datas
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Telegram
Tox
*.tox
*.ini
Password
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
00000001
00000002
00000003
00000004
\Outlook\accounts.txt
Pidgin
\.purple\
accounts.xml
dQw4w9WgXcQ
token:
Software\Valve\Steam
SteamPath
\config\
ssfn*
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
sqlite3.dll
browsers
done
soft
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
https
Content-Type: multipart/form-data; boundary=----
POST
HTTP/1.1
Content-Disposition: form-data; name="
hwid
build
token
file_name
file
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg

Vidar

(PID) Process(580) RegAsm.exe
C2https://t.me/iyigunl
URLhttps://steamcommunity.com/profiles/76561199761128941
Strings (239)INSERT_KEY_HERE
lstrcpyA
GetEnvironmentVariableA
GdipSaveImageToStream
History
runas
ssfn*
GetProcAddress
lstrcatA
OpenEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
HeapAlloc
GetComputerNameA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
NtQueryInformationProcess
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
GetFileAttributesA
GlobalLock
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
FindNextFileA
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
SetFilePointer
FindFirstFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMA
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrStrA
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
Soft:
Host:
Login:
Password:
Opera
OperaGX
Network
Cookies
.txt
TRUE
FALSE
SELECT name, value FROM autofill
History
SELECT url FROM urls LIMIT 1000
CC
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Name:
Month:
Year:
Card:
Cookies
Login Data
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
Plugins
Local Extension Settings
Sync Extension Settings
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
profiles.ini
chrome
opera
firefox
Wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayVersion
msvcp140.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
open
%LOCALAPPDATA%
%USERPROFILE%
%PROGRAMFILES%
%PROGRAMFILES_86%
*.lnk
Files
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Tox
*.tox
*.ini
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
\Outlook\accounts.txt
Pidgin
accounts.xml
token:
Software\Valve\Steam
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
build
token
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg
(PID) Process(2092) RegAsm.exe
C2https://t.me/iyigunl
URLhttps://steamcommunity.com/profiles/76561199761128941
Strings (239)INSERT_KEY_HERE
lstrcpyA
GetEnvironmentVariableA
GdipSaveImageToStream
History
runas
ssfn*
GetProcAddress
lstrcatA
OpenEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
HeapAlloc
GetComputerNameA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
NtQueryInformationProcess
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
GetFileAttributesA
GlobalLock
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
FindNextFileA
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
SetFilePointer
FindFirstFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMA
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrStrA
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
Soft:
Host:
Login:
Password:
Opera
OperaGX
Network
Cookies
.txt
TRUE
FALSE
SELECT name, value FROM autofill
History
SELECT url FROM urls LIMIT 1000
CC
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Name:
Month:
Year:
Card:
Cookies
Login Data
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
Plugins
Local Extension Settings
Sync Extension Settings
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
profiles.ini
chrome
opera
firefox
Wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayVersion
msvcp140.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
open
%LOCALAPPDATA%
%USERPROFILE%
%PROGRAMFILES%
%PROGRAMFILES_86%
*.lnk
Files
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Tox
*.tox
*.ini
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
\Outlook\accounts.txt
Pidgin
accounts.xml
token:
Software\Valve\Steam
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
build
token
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg
(PID) Process(3532) RegAsm.exe
C2https://t.me/iyigunl
URLhttps://steamcommunity.com/profiles/76561199761128941
Strings (239)INSERT_KEY_HERE
lstrcpyA
GetEnvironmentVariableA
GdipSaveImageToStream
History
runas
ssfn*
GetProcAddress
lstrcatA
OpenEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
HeapAlloc
GetComputerNameA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
NtQueryInformationProcess
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
GetFileAttributesA
GlobalLock
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
FindNextFileA
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
SetFilePointer
FindFirstFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMA
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrStrA
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
Soft:
Host:
Login:
Password:
Opera
OperaGX
Network
Cookies
.txt
TRUE
FALSE
SELECT name, value FROM autofill
History
SELECT url FROM urls LIMIT 1000
CC
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Name:
Month:
Year:
Card:
Cookies
Login Data
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
Plugins
Local Extension Settings
Sync Extension Settings
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
profiles.ini
chrome
opera
firefox
Wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayVersion
msvcp140.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
open
%LOCALAPPDATA%
%USERPROFILE%
%PROGRAMFILES%
%PROGRAMFILES_86%
*.lnk
Files
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Tox
*.tox
*.ini
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
\Outlook\accounts.txt
Pidgin
accounts.xml
token:
Software\Valve\Steam
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
build
token
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg

Remcos

(PID) Process(2004) startup.exe
C2 (1)147.124.209.163:7719
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_filestartup.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-X0705N
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirusers
Keylog_dirremcos

RaccoonClipper

(PID) Process(3544) oobeldr.exe
Wallets (21)ronin:7dd689b469effa35084b690b72c9e8b56535a0ee
8387rcPNz8SRX6pYXgdxCZg3VMLFwtdJB3Z9LeX8Ge2n
THob3fXbiKVHQgtYDkU1TzFbRfLET7SgGU
0x398F9a102Fd5ebEc7cc10389D974A0cEd5d8849F
bnb1yjequl3q4j30w6xjqh2ny7p72t3r4qu5vqr5wl
BNVTORWZ4FKK2PXHJ7VX34WF24UE43UUULRGYKPQKBZ2JYWQEEQBCFYJ5Y
cosmos1vhjg2ru7f4rj0f2ufeks2rkzjnxxtjpu7w8j80
LNpwdvdBjv5aHWGcz6myLZHRFMRsLY6b45
156UGALjatSQnY7wy4LruP6CEE5VoczdZE
ltc1q3lga9nvsq082z0nymtv6ta5zaa7f5hc9gqt4wh
t1YyT26xv4ZAHWTxqqHUoWcW9NhZ7SQoYMj
r4qZSfz3su9M9i3vCjkyekgkrn9nDPVUWs
Ae2tdPwUPEYyW788tJcg85Ki7GLaaccd8a1pntDWTuYwXJ3aH5STciRSi4B
RKVrxLdwd96dYWWDiSPWgxFFMptKWk3hJC
44y2ostLsCHhZumgg5gWsAjAs7YXqrfUL9ZNnnF2eDTpXF3ePniVsh84XV8L3opvhtM5c7qCVKuNcQU6sJDdVnVuJo8iMDo
XodDVk8GrQasJmGovaBDtC9k6Zd8uM4h8U
t1aqpmg1REJ9VxjqJfh85MZEAxyjuPHn4mM
addr1qyt44dydvv3nv0mq4wyvfuraau7tegxcpcsnlla9nl6tx4qht26g6cerxclkp2ugcnc8mmeuhjsdsr3p8ll6t8l5kd2q9qm0nj
AR5fY8jPcDfJUo354vs9xBDhUY34DGd273
DDR9LzezMwV5Ew7ZD1Dwm6EQqeM4ZYR6ux
bc1qcv6mdq9yqp6nxnattluvun429jaq2qztwrgfjv
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2048:07:19 19:03:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 9728
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x457a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: bomb.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: bomb.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
216
Monitored processes
114
Malicious processes
33
Suspicious processes
4

Behavior graph

Click at the process to see the details
start #PHORPIEX bomb.exe http185.215.113.66pei.exe.exe #PHORPIEX svchost.exe http185.215.113.66newtpp.exe.exe http147.45.44.104revada66d2b5c78630c_crypted.exe#1.exe no specs #REDLINE regasm.exe wmpnscfg.exe no specs #PHORPIEX sysmysldrv.exe 191532736.exe no specs http147.45.44.104yuop66d1b31955f50_sunshinesolving.exe.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs sc.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs http147.45.44.104lopsa66d1ec0485e55_stealc_default.exe#kisotr.exe no specs #STEALC regasm.exe regasm.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs tapes.pif choice.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe 3261622317.exe no specs ntvdm.exe no specs http147.45.44.104prog66d1ee505e71e_build.exe.exe no specs regasm.exe http147.45.44.104prog66d1e3d3208e9_vfdw12.exe#d12.exe no specs #VIDAR regasm.exe no specs ntvdm.exe no specs http147.45.44.104malesa66d1b7f7f3765_front.exe.exe no specs cmd.exe no specs gdbfcgiiij.exe http147.45.44.104yuop66d1ee217b021_1202156955.exe#120.exe no specs regasm.exe http147.45.44.104prog66d1e3c3c7dc6_vregs.exe#space.exe no specs #VIDAR regasm.exe schtasks.exe no specs http147.45.44.104prog66d1e3d63bd13_sbgdwf.exe#space.exe no specs #STEALC regasm.exe http147.45.44.104yuop66d1eb58f2491_stealc_cry.exe#kiscrypto.exe no specs #STEALC regasm.exe ntvdm.exe http107.172.31.21510mempeng.exe.exe httpddl.safone.dev3808735us+only1.exehash=agadkx.exe no specs httpddl.safone.dev3808735us+only1.exehash=agadkx.exe http91.92.254.178saphiremasrshal.exe.exe http91.92.254.178xcvjhg.exe.exe #REMCOS startup.exe http54.189.150.242302mempeng.exe.exe no specs svchost.exe no specs http147.45.44.104revada66cef067bb8bb_coinaccording.exe.exe no specs cmd.exe tasklist.exe no specs findstr.exe no specs findstr.exe no specs tasklist.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #VIDAR sellers.pif choice.exe no specs THREAT regasm.exe httphi.admini.website8c64.exe.exe no specs net.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs sc.exe no specs sc.exe no specs net.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs cmd.exe no specs cmd.exe no specs wscript.exe no specs ehdhdhiecg.exe no specs regasm.exe hjjkjjdhcg.exe no specs #VIDAR regasm.exe cmd.exe no specs timeout.exe no specs #RACCOONCLIPPER oobeldr.exe no specs schtasks.exe no specs cmd.exe no specs timeout.exe no specs http112.67.250.50779chromesetup.exe.exe no specs 7z.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
184cmd /c copy /b ..\Rt + ..\Core + ..\Created + ..\Reg + ..\Aa + ..\Toe + ..\Interested + ..\Opera + ..\Instant + ..\Findings + ..\Gave + ..\Hk + ..\Pollution m C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
348cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EduVistaR.url" & echo URL="C:\Users\admin\AppData\Local\LearnTech Vista Co\EduVistaR.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EduVistaR.url" & exitC:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
400net stop WmiAppSrvC:\Windows\System32\net.exe—httphi.admini.website8c64.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
444C:\Users\admin\sysmysldrv.exeC:\Users\admin\sysmysldrv.exe
http185.215.113.66newtpp.exe.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\sysmysldrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
448"C:\Users\admin\Desktop\http54.189.150.242302MeMpEng.exe.exe" C:\Windows\System32\svchost.exe—http54.189.150.242302MeMpEng.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
580"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
http147.45.44.104prog66d1e3d3208e9_vfdw12.exe#d12.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
Vidar
(PID) Process(580) RegAsm.exe
C2https://t.me/iyigunl
URLhttps://steamcommunity.com/profiles/76561199761128941
Strings (239)INSERT_KEY_HERE
lstrcpyA
GetEnvironmentVariableA
GdipSaveImageToStream
History
runas
ssfn*
GetProcAddress
lstrcatA
OpenEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
HeapAlloc
GetComputerNameA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
NtQueryInformationProcess
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
GetFileAttributesA
GlobalLock
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
FindNextFileA
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
SetFilePointer
FindFirstFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMA
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrStrA
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
Soft:
Host:
Login:
Password:
Opera
OperaGX
Network
Cookies
.txt
TRUE
FALSE
SELECT name, value FROM autofill
History
SELECT url FROM urls LIMIT 1000
CC
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Name:
Month:
Year:
Card:
Cookies
Login Data
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
Plugins
Local Extension Settings
Sync Extension Settings
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
profiles.ini
chrome
opera
firefox
Wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayVersion
msvcp140.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
open
%LOCALAPPDATA%
%USERPROFILE%
%PROGRAMFILES%
%PROGRAMFILES_86%
*.lnk
Files
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Tox
*.tox
*.ini
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
\Outlook\accounts.txt
Pidgin
accounts.xml
token:
Software\Valve\Steam
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
build
token
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg
648"C:\Users\admin\Desktop\http147.45.44.104malesa66d1b7f7f3765_Front.exe.exe" C:\Users\admin\Desktop\http147.45.44.104malesa66d1b7f7f3765_Front.exe.exe—bomb.exe
User:
admin
Company:
Shenzhen Aidapu Network Technology Co.,Ltd.
Integrity Level:
MEDIUM
Description:
FrontSketch 1.4
Exit code:
2
Version:
3.15.002.0
Modules
Images
c:\users\admin\desktop\http147.45.44.104malesa66d1b7f7f3765_front.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
660cmd /c schtasks.exe /create /tn "Pharmaceutical" /tr "wscript //B 'C:\Users\admin\AppData\Local\LearnTech Vista Co\EduVistaR.js'" /sc minute /mo 5 /FC:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"C:\Windows\System32\schtasks.exe—GDBFCGIIIJ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
828findstr /I "wrsa opssvc" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
51 402
Read events
50 591
Write events
736
Delete events
75

Modification events

(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2396) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
55
Suspicious files
122
Text files
151
Unknown types
1

Dropped files

PID
Process
Filename
Type
2396bomb.exeC:\Users\admin\Desktop\http8.134.12.90feishu_update.exe.exeexecutable
MD5:1B8F93F22F2AEE44C16F9886B44549B8
SHA256:25333E6A6F1AD7C3AEE8B2D61919176542A8FD0050F72DC7D411448C8C3426F3
2396bomb.exeC:\Users\admin\Desktop\http185.215.113.66pei.exe.exeexecutable
MD5:8D8E6C7952A9DC7C0C73911C4DBC5518
SHA256:FEB4C3AE4566F0ACBB9E0F55417B61FEFD89DC50A4E684DF780813FB01D61278
1060svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab68D7.tmpcompressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2396bomb.exeC:\Users\admin\Desktop\http147.45.44.104revada66d2b5c78630c_crypted.exe#1.exeexecutable
MD5:AE9DE1093D87672C550524299E8DF649
SHA256:37F45ABE9970C5962B441635AB1DF0395DE570AA7ADE2617FB18BED6A0F0C138
3284RegAsm.exeC:\Users\admin\AppData\Local\Temp\Tmp66D1.tmpder
MD5:1420D30F964EAC2C85B2CCFE968EEBCE
SHA256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
3356http185.215.113.66newtpp.exe.exeC:\Users\admin\sysmysldrv.exeexecutable
MD5:BE9388B42333B3D4E163B0ACE699897B
SHA256:D281E0A0F1E1073F2D290A7EB1F77BED4C210DBF83A0F4F4E22073F50FAA843F
1060svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tar68D8.tmpbinary
MD5:78785956AB4E54D6116D673C3491EDFF
SHA256:C514DBDBB13632CBB378C59086C1EBB0BC9B25FFB0A349F2B052B065C0D913E6
3284RegAsm.exeC:\Users\admin\AppData\Local\Temp\Tmp66E2.tmpder
MD5:1420D30F964EAC2C85B2CCFE968EEBCE
SHA256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
3284RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\76b53b3ec448f7ccdda2063b15d2bfc3_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:BBC8DA7D36DF3F91C460984C2ABE8419
SHA256:0399CCF5E780949A63400736A46CCE7D1879903D0F45C6B7D194C960BA4DDDC2
2396bomb.exeC:\Users\admin\Desktop\http185.215.113.66newtpp.exe.exeexecutable
MD5:BE9388B42333B3D4E163B0ACE699897B
SHA256:D281E0A0F1E1073F2D290A7EB1F77BED4C210DBF83A0F4F4E22073F50FAA843F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
146
TCP/UDP connections
473
DNS requests
27
Threats
239

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
bomb.exe
GET
200
147.45.44.104:80
http://147.45.44.104/revada/66d2b5c78630c_crypted.exe
unknown
—
—
suspicious
2396
bomb.exe
GET
200
185.215.113.66:80
http://185.215.113.66/newtpp.exe
unknown
—
—
unknown
2396
bomb.exe
GET
—
185.215.113.66:80
http://185.215.113.66/pei.exe
unknown
—
—
unknown
2396
bomb.exe
GET
200
8.134.12.90:80
http://8.134.12.90/feishu_update.exe
unknown
—
—
unknown
2396
bomb.exe
GET
404
8.134.12.90:80
http://8.134.12.90/%E6%94%BE%E5%81%87%E5%80%BC%E7%8F%AD%E5%AE%89%E6%8E%92.exe%0D
unknown
—
—
unknown
2396
bomb.exe
GET
—
147.45.44.104:80
http://147.45.44.104/malesa/66d1b7f7f3765_Front.exe
unknown
—
—
suspicious
2396
bomb.exe
GET
200
124.220.48.147:80
http://124.220.48.147/Kas.exe
unknown
—
—
unknown
2396
bomb.exe
GET
200
124.220.48.147:80
http://124.220.48.147/Kasp.exe
unknown
—
—
unknown
2396
bomb.exe
GET
404
154.216.17.178:80
http://154.216.17.178/edge/msconfig32.exe
unknown
—
—
unknown
1372
svchost.exe
GET
304
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:3702
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2396
bomb.exe
151.101.130.49:443
urlhaus.abuse.ch
FASTLY
US
whitelisted
2396
bomb.exe
185.215.113.66:80
twizt.net
1337team Limited
SC
unknown
2396
bomb.exe
147.45.44.104:80
—
OOO FREEnet Group
RU
malicious
2396
bomb.exe
5.9.166.97:443
appload.icu
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
urlhaus.abuse.ch
  • 151.101.130.49
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.194.49
whitelisted
www.clikapps.icu
  • 178.63.237.127
unknown
appload.icu
  • 5.9.166.97
unknown
www.appload.icu
  • 5.9.166.97
unknown
clikapps.icu
  • 178.63.237.127
unknown
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.216
  • 23.50.131.200
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
2396
bomb.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2396
bomb.exe
A Network Trojan was detected
ET HUNTING Download Request Containing Suspicious Filename - Crypted
2396
bomb.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.icu) in TLS SNI
2396
bomb.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2396
bomb.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2396
bomb.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
2396
bomb.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 23
2396
bomb.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2396
bomb.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.icu)
12 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bomb.exe