File name:

Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.7z

Full analysis: https://app.any.run/tasks/62bd6f50-431e-4338-9d7c-78c95ac50361
Verdict: Malicious activity
Threats:

Cerber is a Ransomware-as-a-Service (RaaS) that appeared in 2016, spread quickly and has been evolving since. It became well-known for its file encryption, offline capabilities, and sophisticated evasion techniques. It primarily targets enterprises, financial institutions, and government entities, encrypting their data and demanding ransom payments in Bitcoin. It also targets everyday users encrypting personal files (photos, documents) with the risk of their permanent loss.

Malware Trends Tracker     >>>
Analysis date: April 24, 2025, 20:41:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
cerber
ransomware
evasion
possible-phishing
phish-url
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

2881EEBAB0227735BD29097B5BC6120A

SHA1:

3F060D5B8EEB7A45A5F1631D5479E605E26CE9EE

SHA256:

481512F901A868DBA038BB76B76C19E40BA3BCD5289A8EAD521D900C55D24A48

SSDEEP:

3072:YOzbJX3v+9HzmU9FJ6m0vJuJCpcvsf2qCpamZz62rXb8xl5ZNJ++eiRlZrHi8qQK:YIvGTRJmDpcvsOnZZN6xzPdpHRQTr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • CERBER mutex has been found

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • The process uses screensaver hijack for persistence

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Create files in the Startup directory

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)

    • Changes the autorun value in the registry

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Starts CMD.EXE for self-deleting

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3332)

    • There is functionality for taking screenshot (YARA)

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3316)

    • Application launched itself

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)

    • The process verifies whether the antivirus software is installed

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Starts itself from another location

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 328)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 328)

    • Checks for external IP

      • svchost.exe (PID: 1080)
      • netbtugc.exe (PID: 3316)

    • Reads security settings of Internet Explorer

      • netbtugc.exe (PID: 3316)

    • Reads the Internet Settings

      • netbtugc.exe (PID: 3316)

    • Possibly a phishing URL contains email has been detected

      • msedge.exe (PID: 2884)
      • msedge.exe (PID: 1196)

    • Start notepad (likely ransomware note)

      • netbtugc.exe (PID: 3316)

    • The process executes via Task Scheduler

      • netbtugc.exe (PID: 3332)

    • The process executes VB scripts

      • netbtugc.exe (PID: 3316)

    • Hides command output

      • cmd.exe (PID: 328)
      • cmd.exe (PID: 1504)

    • Starts CMD.EXE for commands execution

      • netbtugc.exe (PID: 3316)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)

  • INFO

    • Manual execution by a user

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • msedge.exe (PID: 1196)

    • Reads the computer name

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3316)
      • netbtugc.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2060)

    • Create files in a temporary directory

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3316)
      • netbtugc.exe (PID: 3332)

    • Checks supported languages

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 988)
      • netbtugc.exe (PID: 3316)
      • netbtugc.exe (PID: 3332)

    • Creates files or folders in the user directory

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 2912)
      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe (PID: 1648)
      • netbtugc.exe (PID: 3316)

    • Local mutex for internet shortcut management

      • netbtugc.exe (PID: 3316)

    • Checks proxy server information

      • netbtugc.exe (PID: 3316)

    • Application launched itself

      • msedge.exe (PID: 3380)
      • msedge.exe (PID: 2884)
      • msedge.exe (PID: 1196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2016:07:20 14:40:58+00:00
ArchivedFileName: Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
34
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.nsis.agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe #CERBER trojan-ransom.nsis.agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe netbtugc.exe cmd.exe no specs taskkill.exe no specs ping.exe no specs #CERBER netbtugc.exe svchost.exe msedge.exe no specs notepad.exe no specs netbtugc.exe msedge.exe no specs wscript.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs taskkill.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328/d /c taskkill /t /f /im "netbtugc.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\netbtugc.exe" > NULC:\Windows\System32\cmd.exe—netbtugc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
492"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3172 --field-trial-handle=1304,i,1713592887852891387,12055458640007981988,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
676ping -n 1 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
988"C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\netbtugc.exe"C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\netbtugc.exe
Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\{6b977300-2501-f740-f2c0-799d6aca21c2}\netbtugc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1020"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1204,i,719118260420261227,4835076219080340165,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1196"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --enable-features=msMicrosoftRootStoreUsed --flag-switches-end --do-not-de-elevate "C:\Users\admin\Desktop\# DECRYPT MY FILES #.html"C:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1276taskkill /t /f /im "netbtugc.exe" C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1504/d /c taskkill /t /f /im "Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe" > NULC:\Windows\System32\cmd.exe—Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1648"C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe" C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\trojan-ransom.nsis.agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
Total events
9 350
Read events
9 173
Write events
158
Delete events
19

Modification events

(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.7z
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
10
Suspicious files
1 201
Text files
680
Unknown types
1

Dropped files

PID
Process
Filename
Type
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\EngineLoggerConfig.xmltext
MD5:3C776D54E30C91AB5003DB046C369C05
SHA256:B346158E5F2F3F9AE59F06D6129034F71740DC2482187A73BFE857FE8A093002
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\EUC-Vbinary
MD5:2AE28D03E6F74FC3C034E3610CAA5280
SHA256:DF632351D3735A6305DC56D28BFC361F5C028F6B366EBB887480DF32421201DC
2060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2060.8335\Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeexecutable
MD5:E980725D25BA54D2712B1A78C95B03AC
SHA256:E31B0FAC00D2520BE4FC094E2BBE3CA8D0537EAE97A87FD38C2EF1346F3E2BFE
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Local\Temp\nsv411D.tmp\System.dllexecutable
MD5:CA332BB753B0775D5E806E236DDCEC55
SHA256:DF5AE79FA558DC7AF244EC6E53939563B966E7DBD8867E114E928678DBD56E5D
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\Bibliomania.fh5binary
MD5:87A1BE58CBDD87C3FBE6AEF78C458EF4
SHA256:97C282799F83F5D4D1825F4E87BC07861100D0D8AA330F1B9D99D7C168462168
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\1047_576black.pngimage
MD5:FBDB5D3BF5606F2D20EC11DFC0523542
SHA256:B39F7C1B861A0AEA80CA0626E0922B030123828EF4930DA43D424B578459C784
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\checkbox_normal.pngimage
MD5:B25853C16A4BF4DB03E508BDC1896B9A
SHA256:C8D93865DF049859558B85A320CFA80D84240DAFC4C35D96306A6CE13036BCB7
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\but-next.pngimage
MD5:505F381EBC020405DE2F29DFB0FC2218
SHA256:78D2571AAD9E004F9FB31672C8195492722BCD42D88EC8ADD5D81A4F8AED8DEA
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\BitFrequency.mmtext
MD5:C593BC1CA9F04F16EA5EEF58BAEBAC50
SHA256:78748624D055829446B9A963BF3B19B3DB2428EAC192ACFA2027C1C80FB3F774
2912Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.exeC:\Users\admin\AppData\Roaming\CommonMessages_fr.xmlxml
MD5:B734C3F8BD71D9A7BDC6B95BEF93CE90
SHA256:89DEF78B70F8D8B07F1FC794CAF8F6BCF92FFC58893EE1DAF099A574B50D346D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6 157
DNS requests
10
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3316
netbtugc.exe
GET
200
34.117.59.81:80
http://ipinfo.io/json
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3316
netbtugc.exe
31.184.232.2:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.1:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.0:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.3:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.6:6892
—
—
—
unknown
3316
netbtugc.exe
31.184.232.7:6892
—
—
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
ipinfo.io
  • 34.117.59.81
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
www.bing.com
  • 2.16.110.137
  • 2.16.110.177
  • 2.16.110.122
whitelisted

Threats

PID
Process
Class
Message
3316
netbtugc.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.NSIS.Agent.i-e31b0fac00d2520be4fc094e2bbe3ca8d0537eae97a87fd38c2ef1346f3e2bfe.7z