File name:

Planetside.Software.Terragen.v.keygen.by.aaocg.exe

Full analysis: https://app.any.run/tasks/6117369e-a46e-4498-a156-c0f430424b1c
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: December 10, 2023, 22:56:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
azorult
fareit
pony
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

08C8A95F2CA7645BE11AC026B080CBDC

SHA1:

C48DD78A881153C50E9E141BCAD4375AA29DF0D5

SHA256:

52005C26C0D83105673B3C44C957D9EA7F906C1288FBEE10B06C6C468AD44C55

SSDEEP:

98304:Oyi35Lr+tBrZlaII8Q4vWMvzSjmnLLunftB4ODrOnE8tUjXM3Tn18VIGZhl9Nphe:8m9vfBTL+G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • keygen-pj.exe (PID: 3676)

    • Steals credentials from Web Browsers

      • key.exe (PID: 1936)

    • AZORULT has been detected (SURICATA)

      • keygen-step-1.exe (PID: 2908)

    • Connects to the CnC server

      • keygen-step-1.exe (PID: 2908)
      • key.exe (PID: 1936)

    • PONY has been detected (SURICATA)

      • key.exe (PID: 1936)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 2532)

    • Actions looks like stealing of personal data

      • key.exe (PID: 1936)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)

    • Starts CMD.EXE for commands execution

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • key.exe (PID: 1936)
      • keygen-step-3.exe (PID: 2532)

    • Executing commands from a ".bat" file

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • key.exe (PID: 1936)

    • Reads the Internet Settings

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • keygen-step-1.exe (PID: 2908)
      • cmd.exe (PID: 1116)
      • control.exe (PID: 2424)
      • keygen-pj.exe (PID: 3676)
      • keygen-step-3.exe (PID: 2532)
      • key.exe (PID: 1936)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2424)

    • Searches for installed software

      • key.exe (PID: 1936)

    • Checks Windows Trust Settings

      • keygen-step-3.exe (PID: 2532)

    • Accesses Microsoft Outlook profiles

      • key.exe (PID: 1936)

    • Reads security settings of Internet Explorer

      • keygen-step-3.exe (PID: 2532)

    • Reads settings of System Certificates

      • keygen-step-3.exe (PID: 2532)

  • INFO

    • Reads the computer name

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • keygen-pj.exe (PID: 3676)
      • keygen-step-1.exe (PID: 2908)
      • keygen-step-3.exe (PID: 2532)
      • key.exe (PID: 1936)
      • wmpnscfg.exe (PID: 3084)

    • Checks supported languages

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • keygen-pj.exe (PID: 3676)
      • keygen-step-1.exe (PID: 2908)
      • keygen-step-3.exe (PID: 2532)
      • key.exe (PID: 1936)
      • wmpnscfg.exe (PID: 3084)

    • Create files in a temporary directory

      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)
      • keygen-pj.exe (PID: 3676)
      • key.exe (PID: 1936)

    • The executable file from the user directory is run by the CMD process

      • keygen-pj.exe (PID: 3676)
      • keygen-step-1.exe (PID: 2908)
      • keygen-step-3.exe (PID: 2532)

    • Reads the machine GUID from the registry

      • keygen-step-1.exe (PID: 2908)
      • keygen-step-3.exe (PID: 2532)
      • Planetside.Software.Terragen.v.keygen.by.aaocg.exe (PID: 1864)

    • Reads Environment values

      • keygen-step-1.exe (PID: 2908)

    • Reads product name

      • keygen-step-1.exe (PID: 2908)

    • Checks proxy server information

      • keygen-step-1.exe (PID: 2908)
      • keygen-step-3.exe (PID: 2532)

    • Creates files or folders in the user directory

      • keygen-step-3.exe (PID: 2532)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 14:15:57+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start planetside.software.terragen.v.keygen.by.aaocg.exe no specs cmd.exe no specs keygen-pj.exe no specs #AZORULT keygen-step-1.exe control.exe no specs keygen-step-3.exe rundll32.exe no specs #PONY key.exe wmpnscfg.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1116C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\System32\cmd.exe—Planetside.Software.Terragen.v.keygen.by.aaocg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1864"C:\Users\admin\AppData\Local\Temp\Planetside.Software.Terragen.v.keygen.by.aaocg.exe" C:\Users\admin\AppData\Local\Temp\Planetside.Software.Terragen.v.keygen.by.aaocg.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\planetside.software.terragen.v.keygen.by.aaocg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1936"C:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe
keygen-pj.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\key.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2424"C:\Windows\System32\control.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl", C:\Windows\System32\control.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2532keygen-step-3.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
cmd.exe
User:
admin
Company:
wht
Integrity Level:
MEDIUM
Description:
wht
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2868"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2908keygen-step-1.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3084"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3588"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe" >> NULC:\Windows\System32\cmd.exe—keygen-step-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3676keygen-pj.exe -pFseuY0dpSCC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-pj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
10 276
Read events
10 094
Write events
182
Delete events
0

Modification events

(PID) Process:(1864) Planetside.Software.Terragen.v.keygen.by.aaocg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1864) Planetside.Software.Terragen.v.keygen.by.aaocg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1864) Planetside.Software.Terragen.v.keygen.by.aaocg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1864) Planetside.Software.Terragen.v.keygen.by.aaocg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2908) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2908) keygen-step-1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1116) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1116) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1116) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1116) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
5
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1864Planetside.Software.Terragen.v.keygen.by.aaocg.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:4F8CC92BD220656D0D33D83D7E6C1352
SHA256:7BB8BCE3DF116BA96404C0F084D0333D8F0BEFD9FDF59667B98C8955F69DBB32
1864Planetside.Software.Terragen.v.keygen.by.aaocg.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exeexecutable
MD5:FD7DBEAC1F7CA63CCE4E5A67B5BAB984
SHA256:B87550150CD0E3ECF8E8A7B62B90CFDDFA4D6414F271B02349E3BB6D3BEB2A14
2532keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_34D61B4A2A4AE0D3DDAB879224BCA77Bbinary
MD5:67D0E05F9950DC9263F01AD5D79BA6C1
SHA256:6510203F20F33662852265B44009F7BC01AC301A1AF07E432B7662820DCA3401
3676keygen-pj.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exeexecutable
MD5:AA48FA678A65A000FD139EDB33F46565
SHA256:3497EC8D3717BF385A651855082D4A93805296ABC5189A0A81BF51CD80D46D1E
1864Planetside.Software.Terragen.v.keygen.by.aaocg.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:A3A78FC361CA97368EE77A406FF39DB1
SHA256:4833C439DC79F191A30C89A601CA428F0EF156ADD0ED2BD33BB0D93C2DA1E516
1864Planetside.Software.Terragen.v.keygen.by.aaocg.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cplexecutable
MD5:158C422213E1CED4EB3E10701A78CBF9
SHA256:F5EF10ADF240F88ABCAF901452BC229312964068B4E682FF29C700BE2FB78119
2532keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:B3E886F0A26B67C1234B30C755341758
SHA256:808B71EA8048EF6E5014FBD1DEDBD496516BF963107C8DFF13A53D807C60686F
2532keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:95E5F86AC6ACA663D02BB792351A5A5B
SHA256:5C85619862F6367914DDE4344C421B37E5E90A406529D535FCC29CA3C38A7C62
1936key.exeC:\Users\admin\AppData\Local\Temp\2190671.battext
MD5:3880EEB1C736D853EB13B44898B718AB
SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7
2532keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
11
DNS requests
9
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2908
keygen-step-1.exe
POST
200
185.173.37.179:80
http://gigaload.info/1210776429.php
unknown
text
4 b
unknown
2532
keygen-step-3.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4eca5b14b2c3e3a3
unknown
compressed
4.66 Kb
unknown
2532
keygen-step-3.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
2532
keygen-step-3.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEGxVq9vQB5LHnQcM2BGe1r8%3D
unknown
binary
2.18 Kb
unknown
1936
key.exe
POST
—
188.114.97.3:80
http://top.thisispw.com/keys7369921/gate.php
unknown
—
—
unknown
1080
svchost.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e0032a321da2bdc4
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
95.101.148.135:80
armmf.adobe.com
Akamai International B.V.
NL
unknown
2532
keygen-step-3.exe
62.72.28.104:443
www.connectingkeralam.com
PTGi International Carrier Services, Inc.
US
unknown
2908
keygen-step-1.exe
185.173.37.179:80
gigaload.info
Cloud assets LLC
RU
unknown
2532
keygen-step-3.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
2532
keygen-step-3.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
2532
keygen-step-3.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
4
System
192.168.100.255:137
—
—
—
whitelisted
1936
key.exe
188.114.97.3:80
top.thisispw.com
CLOUDFLARENET
NL
unknown
1080
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 95.101.148.135
whitelisted
gigaload.info
  • 185.173.37.179
unknown
www.connectingkeralam.com
  • 62.72.28.104
unknown
ctldl.windowsupdate.com
  • 87.248.204.0
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
top.thisispw.com
  • 188.114.97.3
  • 188.114.96.3
malicious

Threats

PID
Process
Class
Message
2532
keygen-step-3.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
2908
keygen-step-1.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M2
1936
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
1936
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
1936
key.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Planetside.Software.Terragen.v.keygen.by.aaocg.exe