File name:

Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.7z

Full analysis: https://app.any.run/tasks/62bd6f50-431e-4338-9d7c-78c95ac50361
Verdict: Malicious activity
Threats:

Cerber is a Ransomware-as-a-Service (RaaS) that appeared in 2016, spread quickly and has been evolving since. It became well-known for its file encryption, offline capabilities, and sophisticated evasion techniques. It primarily targets enterprises, financial institutions, and government entities, encrypting their data and demanding ransom payments in Bitcoin. It also targets everyday users encrypting personal files (photos, documents) with the risk of their permanent loss.

Malware Trends Tracker     >>>
Analysis date: April 24, 2025, 20:41:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
cerber
ransomware
evasion
possible-phishing
phish-url
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

2881EEBAB0227735BD29097B5BC6120A

SHA1:

3F060D5B8EEB7A45A5F1631D5479E605E26CE9EE

SHA256:

481512F901A868DBA038BB76B76C19E40BA3BCD5289A8EAD521D900C55D24A48

SSDEEP:

3072:YOzbJX3v+9HzmU9FJ6m0vJuJCpcvsf2qCpamZz62rXb8xl5ZNJ++eiRlZrHi8qQK:YIvGTRJmDpcvsOnZZN6xzPdpHRQTr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for self-deleting

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Create files in the Startup directory

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)

    • CERBER mutex has been found

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Changes the autorun value in the registry

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • The process uses screensaver hijack for persistence

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)

    • There is functionality for taking screenshot (YARA)

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)
      • netbtugc.exe (PID: 988)

    • Application launched itself

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)

    • The process verifies whether the antivirus software is installed

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Starts itself from another location

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Hides command output

      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 328)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 328)

    • Reads security settings of Internet Explorer

      • netbtugc.exe (PID: 3316)

    • Reads the Internet Settings

      • netbtugc.exe (PID: 3316)

    • Checks for external IP

      • svchost.exe (PID: 1080)
      • netbtugc.exe (PID: 3316)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 328)

    • Start notepad (likely ransomware note)

      • netbtugc.exe (PID: 3316)

    • Possibly a phishing URL contains email has been detected

      • msedge.exe (PID: 2884)
      • msedge.exe (PID: 1196)

    • The process executes via Task Scheduler

      • netbtugc.exe (PID: 3332)

    • The process executes VB scripts

      • netbtugc.exe (PID: 3316)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2060)

    • Checks supported languages

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3316)
      • netbtugc.exe (PID: 3332)

    • Reads the computer name

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3316)
      • netbtugc.exe (PID: 3332)

    • Create files in a temporary directory

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)
      • netbtugc.exe (PID: 3316)

    • Manual execution by a user

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • msedge.exe (PID: 1196)

    • Creates files or folders in the user directory

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Checks proxy server information

      • netbtugc.exe (PID: 3316)

    • Local mutex for internet shortcut management

      • netbtugc.exe (PID: 3316)

    • Application launched itself

      • msedge.exe (PID: 3380)
      • msedge.exe (PID: 2884)
      • msedge.exe (PID: 1196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2016:07:20 14:40:58+00:00
ArchivedFileName: Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
34
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.nsis.agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe #CERBER trojan-ransom.nsis.agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe netbtugc.exe cmd.exe no specs taskkill.exe no specs ping.exe no specs #CERBER netbtugc.exe svchost.exe msedge.exe no specs notepad.exe no specs netbtugc.exe msedge.exe no specs wscript.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs taskkill.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328/d /c taskkill /t /f /im "netbtugc.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\netbtugc.exe" > NULC:\Windows\System32\cmd.exe—netbtugc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
492"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3172 --field-trial-handle=1304,i,1713592887852891387,12055458640007981988,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
676ping -n 1 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
988"C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\netbtugc.exe"C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\netbtugc.exe
Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\{6b977300-2501-f740-f2c0-799d6aca21c2}\netbtugc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1020"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1204,i,719118260420261227,4835076219080340165,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1196"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --enable-features=msMicrosoftRootStoreUsed --flag-switches-end --do-not-de-elevate "C:\Users\admin\Desktop\# DECRYPT MY FILES #.html"C:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1276taskkill /t /f /im "netbtugc.exe" C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1504/d /c taskkill /t /f /im "Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe" > NULC:\Windows\System32\cmd.exe—Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1648"C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe" C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\trojan-ransom.nsis.agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
Total events
9 350
Read events
9 173
Write events
158
Delete events
19

Modification events

(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.7z
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
10
Suspicious files
1 201
Text files
680
Unknown types
1

Dropped files

PID
Process
Filename
Type
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Local\Temp\nsv411D.tmp\System.dllexecutable
MD5:CA332BB753B0775D5E806E236DDCEC55
SHA256:DF5AE79FA558DC7AF244EC6E53939563B966E7DBD8867E114E928678DBD56E5D
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\EngineLoggerConfig.xmltext
MD5:3C776D54E30C91AB5003DB046C369C05
SHA256:B346158E5F2F3F9AE59F06D6129034F71740DC2482187A73BFE857FE8A093002
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\BitFrequency.mmtext
MD5:C593BC1CA9F04F16EA5EEF58BAEBAC50
SHA256:78748624D055829446B9A963BF3B19B3DB2428EAC192ACFA2027C1C80FB3F774
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\3BSYBS1_DCSA_Errlog.txtcsv
MD5:E008CBBD3EF1585FC0E6EA8B01126924
SHA256:4FF0ECC55968FEFA043BCCA0553A419FDAC4492C0B0C04828132DEC7DAB9F1D8
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\Bibliomania.fh5binary
MD5:87A1BE58CBDD87C3FBE6AEF78C458EF4
SHA256:97C282799F83F5D4D1825F4E87BC07861100D0D8AA330F1B9D99D7C168462168
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\EUC-Vbinary
MD5:2AE28D03E6F74FC3C034E3610CAA5280
SHA256:DF632351D3735A6305DC56D28BFC361F5C028F6B366EBB887480DF32421201DC
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\checkbox_normal.pngimage
MD5:B25853C16A4BF4DB03E508BDC1896B9A
SHA256:C8D93865DF049859558B85A320CFA80D84240DAFC4C35D96306A6CE13036BCB7
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\Cayennebinary
MD5:F1BD84EC59B93938F701F9A9070D1BC8
SHA256:A574F938DB008029983D67222319D8A65C6B859019853730FA662C90EEC8466D
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\but-next.pngimage
MD5:505F381EBC020405DE2F29DFB0FC2218
SHA256:78D2571AAD9E004F9FB31672C8195492722BCD42D88EC8ADD5D81A4F8AED8DEA
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\default.table.frame.xmlhtml
MD5:11131B301360CB35DD6F0F6B9B837239
SHA256:A92EA20DCE28D0175239282B5D2C440A778C98956D08BCE52CB3E4FC15CAB16B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6 157
DNS requests
10
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3316
netbtugc.exe
GET
200
34.117.59.81:80
http://ipinfo.io/json
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3316
netbtugc.exe
31.184.232.2:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.1:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.0:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.3:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.6:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.7:6892
—
—
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
ipinfo.io
  • 34.117.59.81
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
www.bing.com
  • 2.16.110.137
  • 2.16.110.177
  • 2.16.110.122
whitelisted

Threats

PID
Process
Class
Message
3316
netbtugc.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.7z