File name:

gang.rar

Full analysis: https://app.any.run/tasks/88368af1-1a61-423b-b0a4-366e8d313020
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: February 09, 2024, 14:24:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7FB619AE8D729D8E32F6FEAD3411410A

SHA1:

F7A1E05A911A0DE25E263025A1B3ECEC56E11119

SHA256:

6B26A5943E0FF55C2C30F655007CC939AE2DA15FB96CA3DFD7CEFAFB4245BC31

SSDEEP:

24576:6cLkkXLrKnazLLQEtuarmruXtd0LbelGwFu1UZWDGGkisd:6EkkXLrKazLLQEtuarmruXtd0LbelGwz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3672)
      • sniif.Scr (PID: 2636)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • bTsx.exe (PID: 2444)
      • 1234.exe (PID: 2120)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • NjRAT is detected

      • bTsx.exe (PID: 2444)
      • 1234.exe (PID: 2120)
      • LocalYKPQgNOuaI.exe (PID: 2420)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • sa.exe (PID: 2756)
      • server.exe (PID: 2432)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • Create files in the Startup directory

      • LocalYKPQgNOuaI.exe (PID: 2420)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • Changes the autorun value in the registry

      • sa.exe (PID: 2756)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • server.exe (PID: 2432)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • NJRAT has been detected (YARA)

      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • sa.exe (PID: 2756)
      • LocalYKPQgNOuaI.exe (PID: 2420)
      • server.exe (PID: 2432)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • sniif.Scr (PID: 2636)
      • 1234.exe (PID: 2120)
      • bTsx.exe (PID: 2444)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • Reads security settings of Internet Explorer

      • sniif.Scr (PID: 2636)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • 1234.exe (PID: 2120)
      • bTsx.exe (PID: 2444)

    • Reads the Internet Settings

      • sniif.Scr (PID: 2636)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • 1234.exe (PID: 2120)
      • bTsx.exe (PID: 2444)

    • Starts itself from another location

      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • bTsx.exe (PID: 2444)

    • Uses RUNDLL32.EXE to load library

      • sniif.Scr (PID: 2636)
      • 1234.exe (PID: 2120)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • sa.exe (PID: 2756)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)
      • server.exe (PID: 2432)

    • Connects to unusual port

      • LocalYKPQgNOuaI.exe (PID: 2420)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • server.exe (PID: 2432)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 2852)
      • bTsx.exe (PID: 2444)
      • sniif.Scr (PID: 2636)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • 1234.exe (PID: 2120)

    • Checks supported languages

      • bTsx.exe (PID: 2444)
      • sniif.Scr (PID: 2636)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)
      • 1234.exe (PID: 2120)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • LocalYKPQgNOuaI.exe (PID: 2420)
      • sa.exe (PID: 2756)
      • server.exe (PID: 2432)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2852)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2852)

    • Reads the computer name

      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • sniif.Scr (PID: 2636)
      • LocalYKPQgNOuaI.exe (PID: 2420)
      • bTsx.exe (PID: 2444)
      • sa.exe (PID: 2756)
      • 1234.exe (PID: 2120)
      • server.exe (PID: 2432)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • Reads the machine GUID from the registry

      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)
      • 8f3920e55d779299907047e8fff6d4ca.exe (PID: 4060)
      • LocalYKPQgNOuaI.exe (PID: 2420)
      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • 1234.exe (PID: 2120)
      • sa.exe (PID: 2756)
      • bTsx.exe (PID: 2444)
      • server.exe (PID: 2432)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)

    • Creates files or folders in the user directory

      • sniif.Scr (PID: 2636)
      • 1234.exe (PID: 2120)
      • LocalYKPQgNOuaI.exe (PID: 2420)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)

    • Create files in a temporary directory

      • 813c19f44186dba5adbb97d67a5556f7.exe (PID: 3500)
      • bTsx.exe (PID: 2444)
      • sa.exe (PID: 2756)

    • Reads Environment values

      • LocalYKPQgNOuaI.exe (PID: 2420)
      • server.exe (PID: 2432)
      • 7d9c3ac18392b467e24e34fece6b8e6d.exe (PID: 3428)
      • 775f6b72ee7013102146312dce7157ab.exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(4060) 8f3920e55d779299907047e8fff6d4ca.exe
C2yonok4100.kro.kr
Ports3000
Botnet순좀 퓨이
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\487246bb2abf00d5c4c35d1bc81e2d15
Splitter|'|'|
Versionim523
(PID) Process(2756) sa.exe
C2devilhackerboyt1201.ddns.net
Ports1177
BotnetHacked By Devil Boy
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\b00bcc1238637f2c38892eba30ad1638
Splitter|'|'|
Version0.6.4
(PID) Process(2432) server.exe
C2191.233.28.7
Ports1024
BotnetHotel
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\240a11a4369c749c42e89558b6a85116
Splitter|'|'|
Version0.7d
(PID) Process(2420) LocalYKPQgNOuaI.exe
C217.ip.gl.ply.gg
Ports46398
BotnetHacKed By RqEb ;)
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows
Splitter|-F-|
Versionnull
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
18
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe #NJRAT btsx.exe sniif.scr #NJRAT 7d9c3ac18392b467e24e34fece6b8e6d.exe #NJRAT 8f3920e55d779299907047e8fff6d4ca.exe #NJRAT 775f6b72ee7013102146312dce7157ab.exe #NJRAT 1234.exe 813c19f44186dba5adbb97d67a5556f7.exe #NJRAT localykpqgnouai.exe #NJRAT sa.exe rundll32.exe no specs netsh.exe no specs #NJRAT server.exe rundll32.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Users\admin\Desktop\775f6b72ee7013102146312dce7157ab.exe" C:\Users\admin\Desktop\775f6b72ee7013102146312dce7157ab.exe
explorer.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
MEDIUM
Description:
Resources Windows
Exit code:
0
Version:
6.0.43.11
Modules
Images
c:\users\admin\desktop\775f6b72ee7013102146312dce7157ab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1768"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Roaming\SvhostC:\Windows\System32\rundll32.exe—1234.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1844netsh firewall add allowedprogram "C:\Users\admin\Desktop\8f3920e55d779299907047e8fff6d4ca.exe" "8f3920e55d779299907047e8fff6d4ca.exe" ENABLEC:\Windows\System32\netsh.exe—8f3920e55d779299907047e8fff6d4ca.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1976netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\sa.exe" "sa.exe" ENABLEC:\Windows\System32\netsh.exe—sa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2120"C:\Users\admin\Desktop\1234.exe" C:\Users\admin\Desktop\1234.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\1234.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2168"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\LocaldKtLNBbYIU.snifC:\Windows\System32\rundll32.exe—sniif.Scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2420"C:\Users\admin\AppData\LocalYKPQgNOuaI.exe" C:\Users\admin\AppData\LocalYKPQgNOuaI.exe
sniif.Scr
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\localykpqgnouai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2420) LocalYKPQgNOuaI.exe
C217.ip.gl.ply.gg
Ports46398
BotnetHacKed By RqEb ;)
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows
Splitter|-F-|
Versionnull
2432"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
bTsx.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2432) server.exe
C2191.233.28.7
Ports1024
BotnetHotel
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\240a11a4369c749c42e89558b6a85116
Splitter|'|'|
Version0.7d
2444"C:\Users\admin\Desktop\bTsx.exe" C:\Users\admin\Desktop\bTsx.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\btsx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2636"C:\Users\admin\Desktop\sniif.Scr" C:\Users\admin\Desktop\sniif.Scr
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\sniif.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
20 698
Read events
20 185
Write events
513
Delete events
0

Modification events

(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3672) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\gang.rar
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3672) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
13
Suspicious files
9
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3672.15273\HOTEL.zipcompressed
MD5:63353ACC72D16F592BF068B7D40ED6A8
SHA256:70B27EC0F8259930DC173C2C6967D4810E388C79A370B4835A34CD552C1D0B1A
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3672.15273\DEVILBOY.zipcompressed
MD5:75E2087E95576200B2C174205B146141
SHA256:B01FB0DC0B7F34565EF4A360F5D7994B6F32B2518C846762D803B35DCA5743F1
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3672.15273\RQEB.zipcompressed
MD5:11E84E6AB5C5E28B50AAF2FB71B3A03A
SHA256:F1F9F25B68CA6A74D128A195C6D9566DE85AADBFFBCA32A4F50E3394B0F51D78
2852WinRAR.exeC:\Users\admin\Desktop\775f6b72ee7013102146312dce7157abexecutable
MD5:775F6B72EE7013102146312DCE7157AB
SHA256:B5C8DC7F6A57B3214C4990FA150FF93777E7D2FACB10D0CB6249D4209007A95C
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3672.15273\SHS.zipcompressed
MD5:CFD55A4F021C57C211F41FB3B81F5367
SHA256:1C97336202C3D9C2659E36AC644B935819D68D380DCAC8B7F791DC6D415EA0FC
2852WinRAR.exeC:\Users\admin\Desktop\8f3920e55d779299907047e8fff6d4caexecutable
MD5:8F3920E55D779299907047E8FFF6D4CA
SHA256:3B6C52376C301E9AA6070F5DA190C0EC6CDAA342FC8289572520AD35B2506B91
2852WinRAR.exeC:\Users\admin\Desktop\bTsx.exeexecutable
MD5:1B8C2A6753FDC3FDDC2C6EEC9F6F6609
SHA256:5839B984AAA69C0DF2E7803897DD293F8B3499A30ECEE0734369B823C26472EE
2852WinRAR.exeC:\Users\admin\Desktop\sniif.Screxecutable
MD5:307E9F20E28312DC72FCEF348272B97D
SHA256:94BC5F862A6A4B71BA591C3AB18BB08EA68907CD28667659E107D9C8C8E41B28
2852WinRAR.exeC:\Users\admin\Desktop\1234.exeexecutable
MD5:C9337DB1A94A267FEE15BA2F0AC6A61F
SHA256:CA30DBEB6E25BF59FCB21FBA30A737F92E9D1AAC117DA013F5583AB4984815C3
3672WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3672.15273\SCHOOL.zipcompressed
MD5:4DD43624E17444B3E91CC9F02D03AC22
SHA256:4FCDEEE61D8C8BB67B946D5EECA3F49E894616D5B5A4BDB7A792F99BB7A07987
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
16
DNS requests
7
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4060
8f3920e55d779299907047e8fff6d4ca.exe
115.136.213.151:3000
yonok4100.kro.kr
LG POWERCOMM
KR
unknown
2420
LocalYKPQgNOuaI.exe
147.185.221.17:46398
17.ip.gl.ply.gg
PLAYIT-GG
US
unknown
2432
server.exe
191.233.28.7:1024
—
MICROSOFT-CORP-MSN-AS-BLOCK
BR
unknown
3428
7d9c3ac18392b467e24e34fece6b8e6d.exe
149.248.52.61:89
—
AS-CHOOPA
CA
unknown

DNS requests

Domain
IP
Reputation
yonok4100.kro.kr
  • 115.136.213.151
unknown
devilhackerboyt1201.ddns.net
  • —
unknown
17.ip.gl.ply.gg
  • 147.185.221.17
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown
tiger-new21.servemp3.com
  • 0.0.0.0
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.servemp3 .com
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.servemp3 .com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
gang.rar