File name:

2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/812eba06-be22-4d2f-9fe8-02fd9b78d96c
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 01:31:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
birele
neconyd
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

D8C541DE06A58771561166F27D7CCA9E

SHA1:

0E53A3CE084C0B0F6FF375C5D64263FB0397301D

SHA256:

43F87D960F507B03BFDA8BA82A79FE69ED2A8A034443E665C2E793ED6ACF53BC

SSDEEP:

3072:wR65qaR6CRp/5y03CwJ3/HxMqMdA33M5tC1isyPFCALzv4mlkVVXV9daR:wmqaRRRZ/MnA3cQYFCOzv3AVXVa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

    • BIRELE has been detected (SURICATA)

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

    • Neconyd has been detected

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

  • SUSPICIOUS

    • Application launched itself

      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7508)
      • omsecor.exe (PID: 7556)
      • omsecor.exe (PID: 5344)
      • omsecor.exe (PID: 7628)

    • Executable content was dropped or overwritten

      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7528)

    • Executes application which crashes

      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7508)
      • omsecor.exe (PID: 7556)
      • omsecor.exe (PID: 5344)

    • Reads security settings of Internet Explorer

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

    • Contacting a server suspected of hosting an CnC

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

  • INFO

    • The sample compiled with english language support

      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7508)

    • Creates files or folders in the user directory

      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7528)
      • WerFault.exe (PID: 7740)
      • WerFault.exe (PID: 7720)
      • WerFault.exe (PID: 5800)

    • Checks supported languages

      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7508)
      • omsecor.exe (PID: 7556)
      • omsecor.exe (PID: 7628)
      • 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7528)
      • omsecor.exe (PID: 5344)
      • omsecor.exe (PID: 3140)

    • Reads the computer name

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

    • Checks proxy server information

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)
      • slui.exe (PID: 5428)

    • Failed to create an executable file in Windows directory

      • omsecor.exe (PID: 7628)
      • omsecor.exe (PID: 3140)

    • Reads the software policy settings

      • slui.exe (PID: 5428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:23 10:34:53+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 8
CodeSize: 28672
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x18b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Comments
FileVersion: 0, 1, 2, 0
InternalName: CompanyName
LegalCopyright: LegalTrademarks
OriginalFileName: Build private
ProductName: Movie name
ProductVersion: 0, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe 2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs werfault.exe no specs slui.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3140C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5344C:\Users\admin\AppData\Roaming\omsecor.exe /nomoveC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5428C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5800C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5344 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7508"C:\Users\admin\Desktop\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7528C:\Users\admin\Desktop\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\Desktop\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7556C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7628C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7720C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7508 -s 332C:\Windows\SysWOW64\WerFault.exe—2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
9 217
Read events
9 211
Write events
6
Delete events
0

Modification events

(PID) Process:(7628) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7628) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7628) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3140) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3140) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3140) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7720WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-05-18_d8c54_5b81207986ae42feabe148fc47e38f6b6b673f31_4a59df4b_fdb6dba8-6bb8-4c37-a09f-da31002cbac9\Report.wer —
MD5:—
SHA256:—
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_b42dcdb31034871f535757577ce765c45303e4a_f2a0e9fa_bedc7038-7788-49b0-90fb-3244d014eb7f\Report.wer —
MD5:—
SHA256:—
5800WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_b42dcdb31034871f535757577ce765c45303e4a_f2a0e9fa_c9f9f7c3-67c8-499d-90d0-c3eda6ae0748\Report.wer —
MD5:—
SHA256:—
75282025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Roaming\omsecor.exeexecutable
MD5:820E19F0635847394F80865ECADDAA15
SHA256:8A4E5D5340891C72A5EB0EEC5FB472B25AEEB5E6901F771D1E94602E5FEF4268
7720WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC1BB.tmp.dmpbinary
MD5:598DCE7D23AC291CE3CCBC1FF81323C0
SHA256:2A01D7F583CE331CB61CE9655B4D7DB5F287A90049022D1E1BDA98108F798A01
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC22A.tmp.dmpbinary
MD5:DCA6438720182C4E88CD1EA90436AEC7
SHA256:69BD971ED8804FB48A957003FAF7679A72C296D1729182FF3A329C81FFB3C19A
5800WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1F2A.tmp.WERInternalMetadata.xmlbinary
MD5:6336576FB39A24557AD76F8B8C2677B9
SHA256:BAB990CED7520E176FB2CBDA58AE216FBA3456DE18293CF2F02950A73E373A50
7720WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader.exe.7508.dmpbinary
MD5:33F36C9C5840D06EECDD6A05D70CBC4E
SHA256:0AA5D3E8F199BE75CEEB7E705015873B78DBE1358E8886AB53DA8597CF9DEFEF
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC269.tmp.WERInternalMetadata.xmlbinary
MD5:548272D816936AFE1DACF62B56D2ED59
SHA256:EBAAF783DBE73FEB8C50642CBFB6A585A93F7EC7D83D6C53C7A03272E4BA330C
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC28A.tmp.xmlxml
MD5:6DEF3E1556957D3BDCE50218FE54C066
SHA256:896AD0F1BCC64DBC21E6F224F388A4C75F0897A57B3C0850AFF73637637D351F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
56
DNS requests
18
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5216
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5216
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7628
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/165/313.html
unknown
—
—
malicious
7628
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/636/434.html
unknown
—
—
malicious
8112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7628
omsecor.exe
GET
403
75.2.18.233:80
http://mkkuei4kdsz.com/819/728.html
unknown
—
—
malicious
8112
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
8112
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
8112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
5216
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7628
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5216
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5216
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
8112
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 172.217.18.14
whitelisted
lousta.net
  • 193.166.255.171
malicious
client.wns.windows.com
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
mkkuei4kdsz.com
  • 75.2.18.233
malicious
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
ow5dirasuek.com
  • 44.247.155.67
malicious

Threats

PID
Process
Class
Message
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7628
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
3140
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
3140
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-18_d8c541de06a58771561166f27d7cca9e_amadey_elex_rhadamanthys_smoke-loader