File name:

gooning guide.zip

Full analysis: https://app.any.run/tasks/ee6d3e48-b627-4d44-81e5-9bb489c75537
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 03:01:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
andromeda
botnet
gamarue
susp-powershell
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

1559DB72A0A5BA6889CA7AA762F1751F

SHA1:

383DD9C1EDA3C1172E7FA2C2A8656193D546A1F6

SHA256:

694A6F26BD8BCA64738C70752CB34B4517A83D9AD49562FA46DCE20D2C02FFD3

SSDEEP:

6:5jfSgXgllcgEmvMyx5saWG/ZSdxfSgXgllcysvB+l7n:5jKPllV7vMyx5sH+SGPllevBa7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • May hide the program window using WMI (SCRIPT)

      • wscript.exe (PID: 4880)

    • Gets information about running processes via WMI (SCRIPT)

      • wscript.exe (PID: 4880)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5588)

    • ANDROMEDA mutex has been found

      • powershell.exe (PID: 5588)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 5588)

  • SUSPICIOUS

    • Creates an object to access WMI (SCRIPT)

      • wscript.exe (PID: 4880)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 4880)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 4880)

    • Executed via WMI

      • powershell.exe (PID: 5588)

    • Connects to the server without a host name

      • wscript.exe (PID: 4880)
      • powershell.exe (PID: 5588)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Converts a string into array of characters (POWERSHELL)

      • powershell.exe (PID: 5588)

    • The process hides Powershell's copyright startup banner

      • powershell.exe (PID: 5588)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6824)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6824)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 5588)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 5588)

    • Application launched itself

      • powershell.exe (PID: 5588)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 5588)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 4880)
      • notepad++.exe (PID: 2320)

    • Creates files in the program directory

      • wscript.exe (PID: 4880)

    • Checks proxy server information

      • wscript.exe (PID: 4880)
      • slui.exe (PID: 2244)
      • powershell.exe (PID: 5588)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Disables trace logs

      • powershell.exe (PID: 5588)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 5984)
      • powershell.exe (PID: 5588)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6824)

    • Create files in a temporary directory

      • csc.exe (PID: 6824)
      • cvtres.exe (PID: 1280)

    • Checks supported languages

      • csc.exe (PID: 6824)
      • cvtres.exe (PID: 1280)

    • Reads the software policy settings

      • slui.exe (PID: 6048)
      • slui.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:04 10:58:54
ZipCRC: 0x6c71af97
ZipCompressedSize: 69
ZipUncompressedSize: 91
ZipFileName: FULL DOCUMENT.js
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe wscript.exe #ANDROMEDA powershell.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs slui.exe notepad++.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES801A.tmp" "c:\Users\admin\AppData\Local\Temp\CSC90EE55B8F60E4781A6A1E4549068AC68.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2244C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2320"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\FULL DOCUMENT.js"C:\Program Files\Notepad++\notepad++.exe—explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\gdi32.dll
3176C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4880"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\FULL DOCUMENT.js" C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5588powershell.exe -ep bypass -file "C:\ProgramData\of.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5984"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6048"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
14 133
Read events
14 105
Write events
15
Delete events
13

Modification events

(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\gooning guide.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
1
Suspicious files
3
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
4880wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\sdvpqcm[1].htmhtml
MD5:35CDDFB167D6120E1D511724027402AA
SHA256:1BD2101021161F39987C08FDC508859AD05F3E8F63BB857057A09D4EC68B026E
5588powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_edwpzeom.gdt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4880wscript.exeC:\ProgramData\of.ps1text
MD5:0732D0ECC974D89631B46A30F1742B97
SHA256:09BE209C20934BAA279BD28CDB0A5BCDE776E68C43E1A37ABEA1301DBFD0172F
5984powershell.exeC:\Users\admin\AppData\Local\Temp\wd3522j3.0.cstext
MD5:6C161CFA88ACEE4E558632F3093AFEB2
SHA256:D5ECDEA0F70D994AD880D4EF4E10B9452B19597BE697834D8BBE84ABE5C4AC61
5588powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:77AB86320529E2AD069AFB5ACD64789D
SHA256:5F75F7A8868BAC50BBF7F3BCA209E67895DC836F3EFD177B87C7AF8297B11933
6824csc.exeC:\Users\admin\AppData\Local\Temp\CSC90EE55B8F60E4781A6A1E4549068AC68.TMPbinary
MD5:ECCF70234056AE531CBE1BDAB700ACA7
SHA256:6C1A1D2AD121A91A5F73DDA90D0FC33055562E70AC81FE9036E8937B7AF47613
2320notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:FE22EC5755BC98988F9656F73B2E6FB8
SHA256:F972C425CE176E960F6347F1CA2F64A8CE2B95A375C33A03E57538052BA0624D
7152WinRAR.exeC:\Users\admin\Desktop\FULL DOCUMENT.jstext
MD5:87BAE35195A39C45C204EC60112D21E9
SHA256:368B1FB562D913222A06B6C4EC5C9AA060B1C223A8ACBFD747167C75856B16B0
6824csc.exeC:\Users\admin\AppData\Local\Temp\wd3522j3.dllexecutable
MD5:C1747BEE5AFCF85466DCF9B298E3CE70
SHA256:DB9F513DBCD63C9182E7F002B6615DA9871AC1EED95149A3472C82084842A7FA
5984powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_azuiudmi.luh.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1168
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1168
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5588
powershell.exe
GET
200
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
—
4880
wscript.exe
GET
200
181.174.164.2:80
http://181.174.164.2/sdvpqcm
unknown
—
—
—
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714?k=Module:%20keylog;%20Status:%20ok,%20Message:%20keylog%20started
unknown
—
—
—
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
—
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
—
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1168
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.131
  • 40.126.31.128
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.128
  • 40.126.31.73
  • 20.190.159.129
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
gooning guide.zip