File name:

2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer

Full analysis: https://app.any.run/tasks/e3f8d3fa-bd47-4410-8da6-0e4ac307842d
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: May 19, 2025, 04:21:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
sainbox
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

ABB429DC92ED40998EB339FEAE2199D7

SHA1:

842A71862629A5073C4A9E2D800AED0F6B976BDE

SHA256:

48934B392BB60B689BD3E998D3CB10E5ED39C5EF564CE038E8AF75F56E0C398E

SSDEEP:

98304:kX+7SjHU5frt1G46/YRtHUTiBd1kg1L/bNQvVi3LIFVNB6DU8Bak4tGDKhq4EzjM:hUkqX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY mutex has been found

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
    • SAINBOX has been detected

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
    • SALITY has been detected

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
  • INFO

    • The sample compiled with chinese language support

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
    • Checks supported languages

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
    • Reads the computer name

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
    • Create files in a temporary directory

      • 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 5124)
    • Checks proxy server information

      • slui.exe (PID: 5164)
    • Reads the software policy settings

      • slui.exe (PID: 5164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:17 09:46:57+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1867776
InitializedDataSize: 1985024
UninitializedDataSize: -
EntryPoint: 0x17fc12
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.2223.1.522
ProductVersionNumber: 1.2223.1.522
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: TODO: <公司名>
FileDescription: 凡商云购 -- 收银端
FileVersion: 1.2223.1.522
InternalName: fs_shop_.exe
LegalCopyright: Copyright (C) 2022
OriginalFileName: fs_shop_.exe
ProductName: TODO: <产品名>
ProductVersion: 1.2223.1.522
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5124"C:\Users\admin\Desktop\2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe" C:\Users\admin\Desktop\2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
explorer.exe
User:
admin
Company:
TODO: <公司名>
Integrity Level:
MEDIUM
Description:
凡商云购 -- 收银端
Exit code:
1
Version:
1.2223.1.522
Modules
Images
c:\users\admin\desktop\2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5164C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 542
Read events
3 526
Write events
16
Delete events
0

Modification events

(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_0
Value:
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a2_0
Value:
5517
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a3_0
Value:
17001001
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a4_0
Value:
0
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a1_1
Value:
659249672
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a2_1
Value:
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a3_1
Value:
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl
Operation:writeName:a4_1
Value:
(PID) Process:(5124) 2025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tvidl\-227342143
Operation:writeName:1768776801
Value:
10
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
51242025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\Users\admin\Desktop\fslog\shop_bar_20250519_0.logtext
MD5:293554C1A0F2D941FEA224398B57C116
SHA256:BEA08F730A4FD595E40A6C64FE035C9FA58E4844A2EFC9C04A0E2D9A1B70F9EB
51242025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\Users\admin\AppData\Local\Temp\winwpdw.exeexecutable
MD5:B360FA63134A63F9ACFE046D2DFE10D9
SHA256:03E0C6C4CA8A24F961477887763397045E67862E059F7494014AEFC21891D40E
51242025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\Users\admin\Desktop\db\cache.db-journalbinary
MD5:957C376751CBFFB38419977CF2838E6A
SHA256:38D824C0677EE53CBDCD9AF52C8E47416114A56E99CDE64029A24BEF5586AFD1
51242025-05-19_abb429dc92ed40998eb339feae2199d7_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\Users\admin\Desktop\db\cache.dbbinary
MD5:7A29D2F2D6B96711378FAE3C7D8770B3
SHA256:01D43C93E8F2FEBB2985A5ABA5581252EFD180B771DF04B43B13B25A20EB1B2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
23
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
6476
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5164
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.174
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info