File name:

Hider.exe

Full analysis: https://app.any.run/tasks/a10448bd-6475-40df-803b-3dea0204be1d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 21:26:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
discord
github
stealer
python
pyinstaller
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

50F8FA0D40C34BC05FA2C761E77DA5AA

SHA1:

A0EA97C3F2B290270749FDFFFCF55A0211E4D789

SHA256:

6AC7946F47C3DA13A0BF58F8E762487105AB3B18C72C59E9F51F18F97D3B4FD6

SSDEEP:

98304:8jskwnzPnvEAEZGPBzJx7WQizOMAu8PHieEM1SBkyZiJYfpx7AHHWWmOOei8yRSK:jOjhvzPuP6ERaqXPaB+y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Hider.exe (PID: 6724)

    • Steals credentials from Web Browsers

      • Hider.exe (PID: 6724)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Hider.exe (PID: 6456)

    • Process drops python dynamic module

      • Hider.exe (PID: 6456)

    • The process drops C-runtime libraries

      • Hider.exe (PID: 6456)

    • Application launched itself

      • Hider.exe (PID: 6456)

    • Process drops legitimate windows executable

      • Hider.exe (PID: 6456)

    • Loads Python modules

      • Hider.exe (PID: 6724)

    • Starts CMD.EXE for commands execution

      • Hider.exe (PID: 6724)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6728)
      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 3180)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 5504)
      • WMIC.exe (PID: 6640)
      • WMIC.exe (PID: 1532)

    • There is functionality for taking screenshot (YARA)

      • Hider.exe (PID: 6456)

  • INFO

    • Reads the computer name

      • Hider.exe (PID: 6456)
      • Hider.exe (PID: 6724)

    • Checks supported languages

      • Hider.exe (PID: 6456)
      • Hider.exe (PID: 6724)

    • The sample compiled with english language support

      • Hider.exe (PID: 6456)

    • Create files in a temporary directory

      • Hider.exe (PID: 6456)
      • Hider.exe (PID: 6724)

    • Reads the machine GUID from the registry

      • Hider.exe (PID: 6724)

    • Checks operating system version

      • Hider.exe (PID: 6724)

    • Checks proxy server information

      • Hider.exe (PID: 6724)
      • slui.exe (PID: 856)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1672)
      • WMIC.exe (PID: 6640)
      • WMIC.exe (PID: 1532)
      • notepad.exe (PID: 5756)
      • WMIC.exe (PID: 5504)

    • PyInstaller has been detected (YARA)

      • Hider.exe (PID: 6456)

    • Manual execution by a user

      • notepad.exe (PID: 1672)
      • notepad.exe (PID: 5756)

    • Reads the software policy settings

      • slui.exe (PID: 856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:22 16:28:14+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.32
CodeSize: 165888
InitializedDataSize: 154112
UninitializedDataSize: -
EntryPoint: 0xafa0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hider.exe hider.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs notepad.exe no specs notepad.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1532C:\Windows\System32\wbem\WMIC.exe csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1672"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\web_history.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3180C:\WINDOWS\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"C:\Windows\System32\cmd.exe—Hider.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5380C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—Hider.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
5504C:\Windows\System32\wbem\WMIC.exe csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
5756"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\cookies.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
7 486
Read events
7 486
Write events
0
Delete events
0

Modification events

No data
Executable files
90
Suspicious files
15
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_Salsa20.pydexecutable
MD5:E3AE69E44C4C82D83082BBB8C25AA8DD
SHA256:4229235814BBEE62311E3623C07898B03D3B22281CD4E5F1A87B86450B1B740F
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_raw_cast.pydexecutable
MD5:243E336DEC71A28E7F61548A2425A2E1
SHA256:BF53063304119CF151F22809356B5B4E44799131BBAB5319736D0321F3012238
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_raw_arc2.pydexecutable
MD5:3F5FD606893B3DE6116D4A185E713CA3
SHA256:0898CDE5FCCFA86E2423CDF627A3745B1F59BB30DFEF0DD9423926D4167F9F82
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_chacha20.pydexecutable
MD5:ED1BBDC7CC945DA2D1F5A914987EB885
SHA256:1EECE2F714DC1F520D0608F9F71E692F5B269930603F8AFC330118EA38F16005
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_pkcs1_decode.pydexecutable
MD5:3EFFD59CD95B6706C1F2DD661AA943FC
SHA256:4C29950A9EDEDBBC24A813F8178723F049A529605EF6D35F16C7955768AACE9E
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_ARC4.pydexecutable
MD5:D9F2264898AAAA9EF6152A1414883D0F
SHA256:836CBA3B83B00427430FE6E1C4E45790616BC85C57DBD6E6D5B6930A9745B715
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_raw_blowfish.pydexecutable
MD5:418CEC0CC45B20EE8165E86CAC35963C
SHA256:694BF801227B26DADAF9DDFF373647AB551D7A0B9CFF6DE1B42747F04EFC510E
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_raw_aes.pydexecutable
MD5:671100B821EB357CEB5A4C5FF86BC31A
SHA256:803E46354CDAB4AF6FF289E98DE9C56B5B08E3E9AD5F235D5A282005FA9F2D50
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_raw_aesni.pydexecutable
MD5:DCD2F68680E2FB83E9FEFA18C7B4B3E0
SHA256:D63F63985356B7D2E0E61E7968720FB72DC6B57D73BED4F337E372918078F946
6456Hider.exeC:\Users\admin\AppData\Local\Temp\_MEI64562\Crypto\Cipher\_raw_des.pydexecutable
MD5:B0EEF5CEAE8BA5E2A04C17B2B6AE87B5
SHA256:C9BBA124BE36ADA4549276D984BB3812EE2207C7DBF646EC6DF9A968E83205FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
12
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
104.124.11.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
104.124.11.58:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.67.69.226:443
ipapi.co
CLOUDFLARENET
US
shared
6724
Hider.exe
162.159.128.233:443
discord.com
CLOUDFLARENET
—
whitelisted
6724
Hider.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 104.124.11.58
  • 104.124.11.17
whitelisted
ipapi.co
  • 172.67.69.226
  • 104.26.8.44
  • 104.26.9.44
shared
discord.com
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.138.232
  • 162.159.135.232
  • 162.159.137.232
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
whitelisted
www.cloudflare.com
  • 104.16.124.96
  • 104.16.123.96
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
6724
Hider.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (ipapi .co in DNS lookup)
6724
Hider.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Hider.exe