File name:

SECURE.ps1

Full analysis: https://app.any.run/tasks/ba6c0071-208f-4f4b-b764-20e9d46f637a
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: March 02, 2026, 15:36:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
snake
keylogger
evasion
telegram
stealer
spyware
netreactor
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF, LF line terminators
MD5:

876DD5F98068D6BF2ED66A30F38D32DB

SHA1:

9B9D3B79E1BBCF3B91F0FF9561450D9B75CA20E3

SHA256:

5D8629C84B9308ABEAF0AE4B3BD27B16D792C40D3C28CE3DAE71AA262C1532F9

SSDEEP:

24576:uoGVZesnZbapudB72+0HdjMpxTgkWkMgngHroyirRMcx67V:mbapurA41gkdn6WMcq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6296)
    • SNAKE has been detected (SURICATA)

      • aspnet_compiler.exe (PID: 2780)
    • Steals credentials from Web Browsers

      • aspnet_compiler.exe (PID: 2780)
    • Actions looks like stealing of personal data

      • aspnet_compiler.exe (PID: 2780)
    • SNAKE has been detected (YARA)

      • aspnet_compiler.exe (PID: 2780)
  • SUSPICIOUS

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6296)
    • The process executes Powershell scripts

      • powershell.exe (PID: 6296)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6296)
    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6296)
    • Possible stealing of messenger data

      • aspnet_compiler.exe (PID: 2780)
    • The process verifies whether the antivirus software is installed

      • aspnet_compiler.exe (PID: 2780)
    • Possible stealing of FTP data

      • aspnet_compiler.exe (PID: 2780)
    • Checks for external IP

      • svchost.exe (PID: 2292)
      • aspnet_compiler.exe (PID: 2780)
    • Possible stealing of email data

      • aspnet_compiler.exe (PID: 2780)
    • Possible stealing from browsers

      • aspnet_compiler.exe (PID: 2780)
  • INFO

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6296)
    • Checks supported languages

      • aspnet_compiler.exe (PID: 2780)
    • Drops script file

      • powershell.exe (PID: 6296)
    • Reads the computer name

      • aspnet_compiler.exe (PID: 2780)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6296)
    • Reads the machine GUID from the registry

      • aspnet_compiler.exe (PID: 2780)
    • Disables trace logs

      • aspnet_compiler.exe (PID: 2780)
    • Checks proxy server information

      • aspnet_compiler.exe (PID: 2780)
    • .NET Reactor protector has been detected

      • powershell.exe (PID: 6296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(2780) aspnet_compiler.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userlogs@htcp.homes
SMTP Password7213575aceACE@@
SMTP Hosthosting2.ro.hostsailor.com
SMTP SendTolog@htcp.homes
SMTP Port587
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs #SNAKE aspnet_compiler.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
SnakeKeylogger
(PID) Process(2780) aspnet_compiler.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userlogs@htcp.homes
SMTP Password7213575aceACE@@
SMTP Hosthosting2.ro.hostsailor.com
SMTP SendTolog@htcp.homes
SMTP Port587
6296"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\SECURE.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
9 172
Read events
9 158
Write events
14
Delete events
0

Modification events

(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2780) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1f37a3.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
6296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AAAIDM4ANVR9UZ069E82.tempbinary
MD5:A82AFBCA2A06606740A39AD6C2875F74
SHA256:364773E8A7CBE3CA686BCBFAD502B0DA45131FF570411B0B3608BF9291F3249B
6296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ib5unrq0.lo2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:A82AFBCA2A06606740A39AD6C2875F74
SHA256:364773E8A7CBE3CA686BCBFAD502B0DA45131FF570411B0B3608BF9291F3249B
6296powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:B01D4BC09B6EF2732439AE5BE07F411B
SHA256:D9F4E3E4D4F5E910D1518E22B3275FB741C495C5C5DC9867D68B51E07296DEAD
6296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2v1xawoh.sb0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
38
DNS requests
25
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
312 b
whitelisted
5516
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5516
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
958 b
whitelisted
GET
304
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
whitelisted
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
US
binary
419 b
whitelisted
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
US
binary
409 b
whitelisted
3292
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
US
binary
401 b
whitelisted
3292
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
US
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
192.168.100.255:137
Not routed
whitelisted
5568
SearchApp.exe
2.16.241.206:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
184.86.251.13:443
th.bing.com
AKAMAI-ASN1
NL
whitelisted
184.86.251.13:443
th.bing.com
AKAMAI-ASN1
NL
whitelisted
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5516
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5516
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 13.89.178.27
  • 13.69.116.107
whitelisted
google.com
  • 142.251.127.101
  • 142.251.127.100
  • 142.251.127.113
  • 142.251.127.139
  • 142.251.127.102
  • 142.251.127.138
whitelisted
www.bing.com
  • 2.16.241.206
  • 2.16.241.200
  • 2.16.241.218
  • 2.16.241.212
  • 2.16.241.222
  • 2.16.241.207
  • 2.16.241.209
  • 2.16.241.219
  • 2.16.241.223
whitelisted
th.bing.com
  • 184.86.251.13
  • 184.86.251.21
  • 184.86.251.24
  • 184.86.251.27
  • 184.86.251.4
  • 184.86.251.14
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.216.77.28
  • 23.216.77.6
  • 23.216.77.42
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2780
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2780
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2292
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2780
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2292
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
2780
aspnet_compiler.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2780
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2780
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2780
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info