File name:

!@uncherrr!.zip

Full analysis: https://app.any.run/tasks/dd02cb4e-20cb-4d72-8471-8ad6f7145fb8
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Malware Trends Tracker     >>>
Analysis date: August 09, 2024, 17:45:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
stealc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

9BB52E5C7ED736E4F9A5452C85E08BA9

SHA1:

39CC5DD3CE8597A9B774F85F3F23187341FE658A

SHA256:

7078F23E3D24F2D72E83BDF10212B2C47BA7D5C5DBE057846AC65D4FF5777E61

SSDEEP:

98304:tsdEchxlSFKMZBVzCncxofX8SPGls3YE80Ge4rkFq69z3gzP5FOB/uNmQ2Es8kOF:PDRxTNQuUOGtg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stealers network behavior

      • BitLockerToGo.exe (PID: 6296)

    • STEALC has been detected (SURICATA)

      • BitLockerToGo.exe (PID: 6296)

    • Connects to the CnC server

      • BitLockerToGo.exe (PID: 6296)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7036)

    • Reads security settings of Internet Explorer

      • BitLockerToGo.exe (PID: 6296)

    • Connects to the server without a host name

      • BitLockerToGo.exe (PID: 6296)

    • Windows Defender mutex has been found

      • BitLockerToGo.exe (PID: 6296)

    • Contacting a server suspected of hosting an CnC

      • BitLockerToGo.exe (PID: 6296)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 7036)
      • I@uncherr.exe (PID: 1288)
      • Taskmgr.exe (PID: 2080)
      • Taskmgr.exe (PID: 208)
      • firefox.exe (PID: 1140)

    • Reads the computer name

      • I@uncherr.exe (PID: 1288)
      • BitLockerToGo.exe (PID: 6296)
      • TextInputHost.exe (PID: 4576)

    • Checks supported languages

      • BitLockerToGo.exe (PID: 6296)
      • I@uncherr.exe (PID: 1288)
      • TextInputHost.exe (PID: 4576)

    • Create files in a temporary directory

      • I@uncherr.exe (PID: 1288)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7036)
      • firefox.exe (PID: 7072)

    • Checks proxy server information

      • BitLockerToGo.exe (PID: 6296)

    • Creates files or folders in the user directory

      • BitLockerToGo.exe (PID: 6296)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 208)

    • Application launched itself

      • firefox.exe (PID: 1140)
      • firefox.exe (PID: 7072)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 7072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:08:08 10:46:46
ZipCRC: 0xde55b3aa
ZipCompressedSize: 9161534
ZipUncompressedSize: 9161534
ZipFileName: I@uncherr.rar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
19
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe rundll32.exe no specs i@uncherr.exe no specs #STEALC bitlockertogo.exe taskmgr.exe no specs taskmgr.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\WINDOWS\system32\taskmgr.exe" /0C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
1140"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
1288"C:\Users\admin\Desktop\I@uncherr.exe" C:\Users\admin\Desktop\I@uncherr.exe—explorer.exe
User:
admin
Company:
High Motion Software
Integrity Level:
MEDIUM
Description:
ImBatch (64-bit) Setup
Exit code:
666
Version:
7, 6, 1, 0
Modules
Images
c:\users\admin\desktop\i@uncherr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4620 -childID 2 -isForBrowser -prefsHandle 4616 -prefMapHandle 4612 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1508 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3aee649a-7647-4595-9c06-1d78cf4efb41} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 194e2579a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2080"C:\WINDOWS\system32\taskmgr.exe" /0C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
2464"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 3 -isForBrowser -prefsHandle 5436 -prefMapHandle 5432 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1508 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b5c3ea9-de9f-42dc-a6c2-c05bc23430a0} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 194e39f6690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2580"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4888 -childID 6 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 31242 -prefMapSize 244343 -jsInitHandle 1508 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26382a72-59e0-40ef-85cb-7e4385e6dfb7} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 194e2e97a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3356"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240213221259 -prefsHandle 1844 -prefMapHandle 1824 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f332cc4-0ebb-4200-8bda-2db1fe24fbe1} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 194dbcd6710 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3812"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2968 -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2976 -prefsLen 30953 -prefMapSize 244343 -jsInitHandle 1508 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6326f7d2-8980-4be5-9bfa-ae2c8c2e02bc} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 194e174e150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3916"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3004 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 5332 -prefMapHandle 4804 -prefsLen 34713 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c95dd33a-9134-401e-ae49-320ea51afb25} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 194e4613d10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
28 132
Read events
27 801
Write events
329
Delete events
2

Modification events

(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\!@uncherrr!.zip
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(7036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
15
Suspicious files
152
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
6556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6556.37409\I@uncherr.rar —
MD5:—
SHA256:—
7036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7036.38288\I@uncherr.exe —
MD5:—
SHA256:—
1288I@uncherr.exeC:\Users\Public\Libraries\aikco.scif —
MD5:—
SHA256:—
1288I@uncherr.exeC:\Users\Public\Libraries\ppbab.scif —
MD5:—
SHA256:—
7036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7036.38288\I@uncherr\VBoxHostChannel.dllexecutable
MD5:BF8CF948740F9DBEBED169AB8FA4CBE6
SHA256:B2723D1B22A498A7BD59A807A1B97E6B03C00FBDA53D3A9715C95B224A2BDB3F
7036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7036.38288\I@uncherr\VBoxProxyStub.dllexecutable
MD5:166F9409EC301BD79860933CBB8B6708
SHA256:74DBEA34D5B2C424281719DF754BD1E4A28CC3C03759CC1D38E23B8FC120A7FD
1288I@uncherr.exeC:\Users\admin\AppData\Local\Temp\jsii-runtime.609804816\lib\program.jstext
MD5:BF41580C1454743386E48083EF7CDB9C
SHA256:B4BF248DDDF226E8F1DEFBD12125F5AE683F37C6DF976E31CC4A8B3201EFE80D
7036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7036.38288\I@uncherr\VBoxSupLib.dllexecutable
MD5:9636CD28F536DD3FB438C866F28610A9
SHA256:34E8BD19A7DD241A1275A3CF77A8A59A7DF1FC529F864F92D8548CC7E0429B26
208Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
7036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7036.38288\I@uncherr\VBoxProxyStub-x86.dllexecutable
MD5:6D3C7D2E108CBB7B5389F51FF68BCB9A
SHA256:53ED3512437FBEB4277C24790CE67DB048F81B60C3669765541495EF88056B88
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
87
DNS requests
116
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5924
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7144
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6260
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6296
BitLockerToGo.exe
GET
200
45.152.115.5:80
http://45.152.115.5/
unknown
—
—
unknown
6296
BitLockerToGo.exe
POST
200
45.152.115.5:80
http://45.152.115.5/587ec30955d49a9c.php
unknown
—
—
unknown
7072
firefox.exe
POST
200
184.24.77.67:80
http://r10.o.lencr.org/
unknown
—
—
unknown
7072
firefox.exe
POST
200
184.24.77.67:80
http://r10.o.lencr.org/
unknown
—
—
unknown
7072
firefox.exe
POST
200
184.24.77.67:80
http://r10.o.lencr.org/
unknown
—
—
unknown
7072
firefox.exe
POST
200
142.250.186.99:80
http://o.pki.goog/wr2
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1108
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1420
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5336
SearchApp.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5924
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.177
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.155
  • 104.126.37.130
  • 104.126.37.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.2
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.177
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.155
  • 104.126.37.130
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
  • 20.24.125.47
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted

Threats

PID
Process
Class
Message
6296
BitLockerToGo.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Stealc HTTP POST Request
6296
BitLockerToGo.exe
Malware Command and Control Activity Detected
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
!@uncherrr!.zip