File name:

ref=RFQ confirmation 5-MT.doc

Full analysis: https://app.any.run/tasks/fc0fef33-8dc0-4696-87ad-d8fb49883cb0
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: January 23, 2019, 10:49:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
loader
trojan
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

C7AB6D4D0B932768E3FC2AE9535E7A70

SHA1:

81EA1AD7CE1B2341E3FAB511B33EEFD484DD1876

SHA256:

678EC65887C4F3F536DECF2F30B6B3D4ACBB62ABECE77542901EDF7355F9FF38

SSDEEP:

1536:qs5pRDTsNVxJcZMCkDTANiZJ1lMKVDTdNxsJYcMkBDTU7NztJrxMuUisxYtK:qS3DT4FDT8CDTXyDTUhj1UYU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 3824)
      • EXCEL.EXE (PID: 2804)
      • EXCEL.EXE (PID: 2500)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 3824)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3824)
      • EXCEL.EXE (PID: 3156)
      • EXCEL.EXE (PID: 2500)
      • EXCEL.EXE (PID: 2804)

    • Application was dropped or rewritten from another process

      • adobepdf.exe (PID: 4060)
      • adobepdf.exe (PID: 2348)
      • adobepdf.exe (PID: 3956)
      • server.exe (PID: 3960)
      • server.exe (PID: 2396)
      • server.exe (PID: 2152)
      • server.exe (PID: 3652)
      • server.exe (PID: 3576)
      • server.exe (PID: 1076)
      • server.exe (PID: 2680)
      • server.exe (PID: 3524)
      • server.exe (PID: 2712)
      • adobepdf.exe (PID: 2228)
      • server.exe (PID: 3492)
      • server.exe (PID: 3368)
      • adobepdf.exe (PID: 3908)
      • adobepdf.exe (PID: 3392)
      • server.exe (PID: 3280)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)
      • server.exe (PID: 2872)

    • Known privilege escalation attack

      • adobepdf.exe (PID: 4060)
      • server.exe (PID: 2396)
      • server.exe (PID: 1076)
      • server.exe (PID: 2680)
      • server.exe (PID: 3492)
      • server.exe (PID: 3280)

    • Actions looks like stealing of personal data

      • adobepdf.exe (PID: 2348)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

    • AZORULT was detected

      • adobepdf.exe (PID: 2348)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

    • Connects to CnC server

      • adobepdf.exe (PID: 2348)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

    • Loads dropped or rewritten executable

      • adobepdf.exe (PID: 2348)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

    • Uses Task Scheduler to run other applications

      • adobepdf.exe (PID: 3908)
      • server.exe (PID: 3960)
      • server.exe (PID: 3652)
      • server.exe (PID: 3524)
      • server.exe (PID: 3368)
      • server.exe (PID: 2872)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 2740)
      • schtasks.exe (PID: 1916)
      • schtasks.exe (PID: 1348)
      • schtasks.exe (PID: 2740)
      • schtasks.exe (PID: 2528)

  • SUSPICIOUS

    • Unusual connect from Microsoft Office

      • EXCEL.EXE (PID: 3824)
      • EXCEL.EXE (PID: 2500)
      • EXCEL.EXE (PID: 2804)

    • Modifies the open verb of a shell class

      • adobepdf.exe (PID: 4060)
      • server.exe (PID: 2396)
      • server.exe (PID: 1076)
      • server.exe (PID: 2680)
      • server.exe (PID: 3492)
      • server.exe (PID: 3280)

    • Application launched itself

      • adobepdf.exe (PID: 3908)
      • server.exe (PID: 3960)
      • server.exe (PID: 3652)
      • server.exe (PID: 3524)
      • server.exe (PID: 3368)
      • server.exe (PID: 2872)

    • Reads the cookies of Google Chrome

      • adobepdf.exe (PID: 2348)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

    • Creates files in the user directory

      • adobepdf.exe (PID: 3908)

    • Executable content was dropped or overwritten

      • adobepdf.exe (PID: 2348)
      • adobepdf.exe (PID: 3908)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

    • Reads the cookies of Mozilla Firefox

      • adobepdf.exe (PID: 2348)
      • server.exe (PID: 2152)
      • server.exe (PID: 3576)
      • server.exe (PID: 2712)
      • server.exe (PID: 3840)
      • server.exe (PID: 3676)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2992)
      • EXCEL.EXE (PID: 3824)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2992)
      • EXCEL.EXE (PID: 3824)
      • EXCEL.EXE (PID: 3156)
      • EXCEL.EXE (PID: 2804)
      • excelcnv.exe (PID: 2052)
      • EXCEL.EXE (PID: 2500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

LastModifiedBy: BINGHERO
CreateDate: 2019:01:23 08:24:00
ModifyDate: 2019:01:23 08:24:00
RevisionNumber: 1
TotalEditTime: -
Pages: 1
Words: 15
Characters: 90
CharactersWithSpaces: 104
InternalVersionNumber: 57433
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
101
Monitored processes
45
Malicious processes
28
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs excel.exe adobepdf.exe no specs excel.exe no specs eventvwr.exe no specs adobepdf.exe no specs excel.exe eventvwr.exe adobepdf.exe adobepdf.exe no specs excel.exe #AZORULT adobepdf.exe adobepdf.exe no specs excelcnv.exe no specs schtasks.exe no specs server.exe no specs eventvwr.exe no specs eventvwr.exe server.exe no specs #AZORULT server.exe schtasks.exe no specs server.exe no specs eventvwr.exe no specs eventvwr.exe server.exe no specs #AZORULT server.exe schtasks.exe no specs server.exe no specs eventvwr.exe no specs eventvwr.exe server.exe no specs #AZORULT server.exe schtasks.exe no specs server.exe no specs eventvwr.exe no specs eventvwr.exe server.exe no specs #AZORULT server.exe schtasks.exe no specs server.exe no specs eventvwr.exe no specs eventvwr.exe server.exe no specs #AZORULT server.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\systemroot\system32\ntdll.dll
1076C:\Users\admin\AppData\Roaming\fileNS\server.exe C:\Users\admin\AppData\Roaming\fileNS\server.exe—taskeng.exe
User:
admin
Company:
Xvid Solutions
Integrity Level:
MEDIUM
Description:
Xvid MiniConvert for Windows
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\appdata\roaming\filens\server.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1348"C:\Windows\System32\schtasks.exe" /create /tn adobe /tr "C:\Users\admin\AppData\Roaming\fileNS\server.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1916"C:\Windows\System32\schtasks.exe" /create /tn adobe /tr "C:\Users\admin\AppData\Roaming\fileNS\server.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2052"C:\Program Files\Microsoft Office\Office14\excelcnv.exe" -EmbeddingC:\Program Files\Microsoft Office\Office14\excelcnv.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excelcnv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2064"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—adobepdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\systemroot\system32\ntdll.dll
2152"C:\Users\admin\AppData\Roaming\fileNS\server.exe"C:\Users\admin\AppData\Roaming\fileNS\server.exe
server.exe
User:
admin
Company:
Xvid Solutions
Integrity Level:
HIGH
Description:
Xvid MiniConvert for Windows
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\appdata\roaming\filens\server.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2204"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
adobepdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\eventvwr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2228"C:\Users\admin\AppData\Local\Temp\adobepdf.exe" C:\Users\admin\AppData\Local\Temp\adobepdf.exe—EXCEL.EXE
User:
admin
Company:
Xvid Solutions
Integrity Level:
MEDIUM
Description:
Xvid MiniConvert for Windows
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\appdata\local\temp\adobepdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
2348"C:\Users\admin\AppData\Local\Temp\adobepdf.exe"C:\Users\admin\AppData\Local\Temp\adobepdf.exe
adobepdf.exe
User:
admin
Company:
Xvid Solutions
Integrity Level:
HIGH
Description:
Xvid MiniConvert for Windows
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\appdata\local\temp\adobepdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
5 168
Read events
4 324
Write events
819
Delete events
25

Modification events

(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:q<,
Value:
713C2C00B00B0000010000000000000000000000
(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2992) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1312227351
(PID) Process:(2992) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1312227472
(PID) Process:(2992) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1312227473
(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
B00B000092BC394E09B3D40100000000
(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:j=,
Value:
6A3D2C00B00B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:j=,
Value:
6A3D2C00B00B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2992) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
291
Suspicious files
0
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
2992WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE851.tmp.cvr —
MD5:—
SHA256:—
3824EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRF04F.tmp.cvr —
MD5:—
SHA256:—
3156EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRFE69.tmp.cvr —
MD5:—
SHA256:—
2804EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR35A.tmp.cvr —
MD5:—
SHA256:—
2500EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR9E2.tmp.cvr —
MD5:—
SHA256:—
2052excelcnv.exeC:\Users\admin\AppData\Local\Temp\CVRF41.tmp.cvr —
MD5:—
SHA256:—
2052excelcnv.exeC:\Users\admin\AppData\Local\Temp\~DF3872FEE29EC543D2.TMP —
MD5:—
SHA256:—
2992WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFB659805FC53D1A62.TMP —
MD5:—
SHA256:—
2052excelcnv.exeC:\Users\admin\AppData\Local\Temp\~DF29C87965DEE5D812.TMP —
MD5:—
SHA256:—
2992WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFF0A441620DC8970E.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
10
DNS requests
2
Threats
46

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2804
EXCEL.EXE
GET
304
193.56.28.105:80
http://uploader.sx/uploads/2019/adobepdf_exe.exe
unknown
—
—
suspicious
2500
EXCEL.EXE
GET
304
193.56.28.105:80
http://uploader.sx/uploads/2019/adobepdf_exe.exe
unknown
—
—
suspicious
3576
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
text
2 b
malicious
3576
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
binary
4.27 Mb
malicious
2152
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
text
2 b
malicious
2348
adobepdf.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
binary
4.27 Mb
malicious
2152
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
binary
4.27 Mb
malicious
2712
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
text
2 b
malicious
2712
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
binary
4.27 Mb
malicious
3840
server.exe
POST
200
111.90.150.170:80
http://dboyusa.online/index.php
unknown
binary
4.27 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3824
EXCEL.EXE
193.56.28.105:80
uploader.sx
—
—
suspicious
2804
EXCEL.EXE
193.56.28.105:80
uploader.sx
—
—
suspicious
2348
adobepdf.exe
111.90.150.170:80
dboyusa.online
Shinjiru Technology Sdn Bhd
—
malicious
2500
EXCEL.EXE
193.56.28.105:80
uploader.sx
—
—
suspicious
2152
server.exe
111.90.150.170:80
dboyusa.online
Shinjiru Technology Sdn Bhd
—
malicious
3576
server.exe
111.90.150.170:80
dboyusa.online
Shinjiru Technology Sdn Bhd
—
malicious
3840
server.exe
111.90.150.170:80
dboyusa.online
Shinjiru Technology Sdn Bhd
—
malicious
2712
server.exe
111.90.150.170:80
dboyusa.online
Shinjiru Technology Sdn Bhd
—
malicious
3676
server.exe
111.90.150.170:80
dboyusa.online
Shinjiru Technology Sdn Bhd
—
malicious

DNS requests

Domain
IP
Reputation
uploader.sx
  • 193.56.28.105
suspicious
dboyusa.online
  • 111.90.150.170
malicious

Threats

PID
Process
Class
Message
3824
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2348
adobepdf.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2348
adobepdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
2348
adobepdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2348
adobepdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2348
adobepdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
2152
server.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2152
server.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
2152
server.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2152
server.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
12 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ref=RFQ confirmation 5-MT.doc