File name:

gooning guide.zip

Full analysis: https://app.any.run/tasks/ee6d3e48-b627-4d44-81e5-9bb489c75537
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 03:01:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
andromeda
botnet
gamarue
susp-powershell
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

1559DB72A0A5BA6889CA7AA762F1751F

SHA1:

383DD9C1EDA3C1172E7FA2C2A8656193D546A1F6

SHA256:

694A6F26BD8BCA64738C70752CB34B4517A83D9AD49562FA46DCE20D2C02FFD3

SSDEEP:

6:5jfSgXgllcgEmvMyx5saWG/ZSdxfSgXgllcysvB+l7n:5jKPllV7vMyx5sH+SGPllevBa7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Gets information about running processes via WMI (SCRIPT)

      • wscript.exe (PID: 4880)

    • May hide the program window using WMI (SCRIPT)

      • wscript.exe (PID: 4880)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5588)

    • ANDROMEDA mutex has been found

      • powershell.exe (PID: 5588)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 5588)

  • SUSPICIOUS

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 4880)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 4880)

    • Creates an object to access WMI (SCRIPT)

      • wscript.exe (PID: 4880)

    • Executed via WMI

      • powershell.exe (PID: 5588)

    • Connects to the server without a host name

      • wscript.exe (PID: 4880)
      • powershell.exe (PID: 5588)

    • Reverses array data (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Converts a string into array of characters (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 5588)

    • The process hides Powershell's copyright startup banner

      • powershell.exe (PID: 5588)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 5588)

    • Application launched itself

      • powershell.exe (PID: 5588)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6824)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6824)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 5588)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 4880)
      • powershell.exe (PID: 5588)
      • slui.exe (PID: 2244)

    • Manual execution by a user

      • wscript.exe (PID: 4880)
      • notepad++.exe (PID: 2320)

    • Creates files in the program directory

      • wscript.exe (PID: 4880)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5588)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6824)

    • Checks supported languages

      • csc.exe (PID: 6824)
      • cvtres.exe (PID: 1280)

    • Create files in a temporary directory

      • csc.exe (PID: 6824)
      • cvtres.exe (PID: 1280)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 5984)
      • powershell.exe (PID: 5588)

    • Reads the software policy settings

      • slui.exe (PID: 6048)
      • slui.exe (PID: 2244)

    • Disables trace logs

      • powershell.exe (PID: 5588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:04 10:58:54
ZipCRC: 0x6c71af97
ZipCompressedSize: 69
ZipUncompressedSize: 91
ZipFileName: FULL DOCUMENT.js
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe wscript.exe #ANDROMEDA powershell.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs slui.exe notepad++.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES801A.tmp" "c:\Users\admin\AppData\Local\Temp\CSC90EE55B8F60E4781A6A1E4549068AC68.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2244C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2320"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\FULL DOCUMENT.js"C:\Program Files\Notepad++\notepad++.exe—explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\gdi32.dll
3176C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4880"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\FULL DOCUMENT.js" C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5588powershell.exe -ep bypass -file "C:\ProgramData\of.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5984"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfileC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6048"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
14 133
Read events
14 105
Write events
15
Delete events
13

Modification events

(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\gooning guide.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
1
Suspicious files
3
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
7152WinRAR.exeC:\Users\admin\Desktop\FULL DOCUMENT.jstext
MD5:87BAE35195A39C45C204EC60112D21E9
SHA256:368B1FB562D913222A06B6C4EC5C9AA060B1C223A8ACBFD747167C75856B16B0
1280cvtres.exeC:\Users\admin\AppData\Local\Temp\RES801A.tmpbinary
MD5:C0DA48B88D2FA17EEDAFB1E10BE7ECC4
SHA256:716B9B6ADB65EBFAF0A7D4AC5404EE1978A6AD5E3D5E7A9CBEC1DAE6DBA25057
6824csc.exeC:\Users\admin\AppData\Local\Temp\CSC90EE55B8F60E4781A6A1E4549068AC68.TMPbinary
MD5:ECCF70234056AE531CBE1BDAB700ACA7
SHA256:6C1A1D2AD121A91A5F73DDA90D0FC33055562E70AC81FE9036E8937B7AF47613
6824csc.exeC:\Users\admin\AppData\Local\Temp\wd3522j3.dllexecutable
MD5:C1747BEE5AFCF85466DCF9B298E3CE70
SHA256:DB9F513DBCD63C9182E7F002B6615DA9871AC1EED95149A3472C82084842A7FA
2320notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:FE22EC5755BC98988F9656F73B2E6FB8
SHA256:F972C425CE176E960F6347F1CA2F64A8CE2B95A375C33A03E57538052BA0624D
5984powershell.exeC:\Users\admin\AppData\Local\Temp\wd3522j3.0.cstext
MD5:6C161CFA88ACEE4E558632F3093AFEB2
SHA256:D5ECDEA0F70D994AD880D4EF4E10B9452B19597BE697834D8BBE84ABE5C4AC61
6824csc.exeC:\Users\admin\AppData\Local\Temp\wd3522j3.outtext
MD5:0D83D23189BFCC78EF93CF459AC8BF92
SHA256:26FEC627F19D917071F7DD2694749CBB47439826D405B8CE4FBC5BF2171E374C
5588powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:77AB86320529E2AD069AFB5ACD64789D
SHA256:5F75F7A8868BAC50BBF7F3BCA209E67895DC836F3EFD177B87C7AF8297B11933
5984powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1sbpt2pz.l22.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2320notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\stylers.xmlxml
MD5:312281C4126FA897EF21A7E8CCB8D495
SHA256:53B4BE3ED1CFD712E53542B30CFE30C5DB35CC48BE7C57727DFEC26C9E882E90
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1168
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1168
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5588
powershell.exe
GET
200
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
unknown
4880
wscript.exe
GET
200
181.174.164.2:80
http://181.174.164.2/sdvpqcm
unknown
—
—
unknown
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714?k=Module:%20keylog;%20Status:%20ok,%20Message:%20keylog%20started
unknown
—
—
unknown
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
unknown
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
unknown
5588
powershell.exe
GET
404
181.174.164.2:80
http://181.174.164.2/649566714
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1168
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.131
  • 40.126.31.128
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.128
  • 40.126.31.73
  • 20.190.159.129
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gooning guide.zip