| File name: | CyberGhost VPN Checker by xRisky.exe |
| Full analysis: | https://app.any.run/tasks/4b5c3255-723e-402d-a820-f6e354f6fbec |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | August 05, 2024, 17:44:38 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | C7E4D5B46B0F99CBF31648C40A8B637B |
| SHA1: | 466D84A802BBE2D1FB417B727504EB964F48CDC8 |
| SHA256: | 3DCA14E4E79017B9E684A751D4F59E04E9300352ECC669D7892E5A0EF241B4D5 |
| SSDEEP: | 98304:cOXVGRZrhrbrSD5hNHFI5t/OdvGdUe6mye0+JuTKexA5rTXZRSYwz9sGPa/4JJyj:awq |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:08:05 08:24:30+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 2549248 |
| InitializedDataSize: | 116224 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2705be |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | CyberGhost VPN Checker by xRisky |
| CompanyName: | CyberGhost VPN Checker by xRisky |
| FileDescription: | CyberGhost VPN Checker by xRisky |
| FileVersion: | 1.0.0.0 |
| InternalName: | output.exe |
| LegalCopyright: | Copyright © 2019 |
| LegalTrademarks: | CyberGhost VPN Checker by xRisky |
| OriginalFileName: | output.exe |
| ProductName: | CyberGhost VPN Checker by xRisky |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 208 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 208 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 208 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 304 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 304 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 368 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 368 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 460 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 460 | "C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\CyberGhost VPN Checker by xRisky.exe | — | CyberGhost VPN Checker by xRisky.exe | |||||||||||
User: admin Company: CyberGhost VPN Checker by xRisky Integrity Level: MEDIUM Description: CyberGhost VPN Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| (PID) Process: | (6292) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6292) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6292) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6292) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6404) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6404) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6404) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6404) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6472) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6472) CyberGhost VPN Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6660 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:97CE45635F2007C1C6999777613CC266 | SHA256:5D316A56D56B9BCA80D8CC16AA1E5498550C6C294277FC4A8668A90328372CD5 | |||
| 6372 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpEEE5.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6292 | CyberGhost VPN Checker by xRisky.exe | C:\Users\admin\AppData\Local\Temp\MetroSuite 2.0.dll | executable | |
MD5:0D30A398CEC0FF006B6EA2B52D11E744 | SHA256:8604BF2A1FE2E94DC1EA1FBD0CF54E77303493B93994DF48479DC683580AA654 | |||
| 6292 | CyberGhost VPN Checker by xRisky.exe | C:\Users\admin\AppData\Local\Temp\Leaf.xNet.dll | executable | |
MD5:42CF916DF4EA1D300201EC9559B7BEF3 | SHA256:939C8980BCB9BD9A2279714F6086714229E7AF194EC4E32677C5A4ED96DB5EDD | |||
| 6292 | CyberGhost VPN Checker by xRisky.exe | C:\Users\admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe | executable | |
MD5:DC6F230A993249CBE632AEA3EDBBD63E | SHA256:A6C001E47FD68B6C97FA484C5C98F918EED5D231BD8F1A4E4AD65AF20788118B | |||
| 6660 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pmglcnhk.iul.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6660 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sm54yuyt.5ol.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6384 | Ultimate-Crack-Pack.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe | executable | |
MD5:DC6F230A993249CBE632AEA3EDBBD63E | SHA256:A6C001E47FD68B6C97FA484C5C98F918EED5D231BD8F1A4E4AD65AF20788118B | |||
| 6372 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpEEC1.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6372 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpEED2.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6372 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | FR | text | 212 b | unknown |
3900 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | binary | 471 b | whitelisted |
2960 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | US | binary | 471 b | whitelisted |
6372 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | FR | text | 4.90 Kb | unknown |
6372 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | FR | text | 147 b | unknown |
6372 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | FR | text | 261 b | unknown |
2476 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | US | binary | 471 b | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | US | binary | 313 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3972 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2152 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5336 | SearchApp.exe | 104.126.37.179:443 | www.bing.com | Akamai International B.V. | DE | unknown |
3900 | svchost.exe | 40.126.32.134:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
th.bing.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6372 | RegAsm.exe | Malware Command and Control Activity Detected | ET MALWARE RedLine Stealer - CheckConnect Response |
6372 | RegAsm.exe | A Network Trojan was detected | AV TROJAN RedLine Stealer Config Download |
6372 | RegAsm.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
6372 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |