File name:

wextract.exe

Full analysis: https://app.any.run/tasks/7fac0fd3-97cb-40d8-b910-2126c5e1a996
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: October 25, 2023, 03:35:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
amadey
botnet
stealer
opendir
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

12360AD1A9FFE1F1C07744583F2016B6

SHA1:

06D2D98DB8D34BA4D8B40D8D9CC5ECD2B69A2797

SHA256:

8798DA5A24295167486322D338E43EFDFC5D5797F510AB3F2C499F30FC207349

SSDEEP:

24576:Nybnhdv9IbdErNTnvj1N0PbA6QSkKg4A2Tzq2hdczR/k5CBITPTIVsojcjwrVr:otzIbqBvj1qT9QJGTzqcu/JaDTIVCwZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wextract.exe (PID: 3412)
      • AU7ID21.exe (PID: 1804)
      • GK4HW36.exe (PID: 2252)
      • oo5Tp46.exe (PID: 4036)
      • Gj9sD46.exe (PID: 2900)
      • 6JM6Su2.exe (PID: 1888)
      • explothe.exe (PID: 1408)

    • Application was dropped or rewritten from another process

      • oo5Tp46.exe (PID: 4036)
      • AU7ID21.exe (PID: 1804)
      • 5jj7ek9.exe (PID: 1860)
      • Gj9sD46.exe (PID: 2900)
      • GK4HW36.exe (PID: 2252)
      • 3aZ99Ql.exe (PID: 520)
      • 4nw904IQ.exe (PID: 1792)
      • 6JM6Su2.exe (PID: 1888)
      • explothe.exe (PID: 1408)
      • explothe.exe (PID: 3860)
      • explothe.exe (PID: 3228)

    • Changes the autorun value in the registry

      • explothe.exe (PID: 1408)

    • Uses Task Scheduler to run other applications

      • explothe.exe (PID: 1408)

    • Connects to the CnC server

      • explothe.exe (PID: 1408)

    • AMADEY was detected

      • explothe.exe (PID: 1408)

    • AMADEY has been detected (YARA)

      • explothe.exe (PID: 1408)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3112)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • wextract.exe (PID: 3412)
      • AU7ID21.exe (PID: 1804)
      • GK4HW36.exe (PID: 2252)
      • oo5Tp46.exe (PID: 4036)

    • Reads the Internet Settings

      • explothe.exe (PID: 1408)
      • 6JM6Su2.exe (PID: 1888)

    • Starts CMD.EXE for commands execution

      • explothe.exe (PID: 1408)
      • cmd.exe (PID: 2380)

    • Application launched itself

      • cmd.exe (PID: 2380)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2380)

    • Connects to unusual port

      • AppLaunch.exe (PID: 2440)

    • Starts itself from another location

      • 6JM6Su2.exe (PID: 1888)

    • Connects to the server without a host name

      • explothe.exe (PID: 1408)

    • The process executes via Task Scheduler

      • explothe.exe (PID: 3860)
      • explothe.exe (PID: 3228)

    • Uses RUNDLL32.EXE to load library

      • explothe.exe (PID: 1408)

    • Process requests binary or script from the Internet

      • explothe.exe (PID: 1408)

  • INFO

    • Checks supported languages

      • wextract.exe (PID: 3412)
      • oo5Tp46.exe (PID: 4036)
      • AU7ID21.exe (PID: 1804)
      • GK4HW36.exe (PID: 2252)
      • Gj9sD46.exe (PID: 2900)
      • 3aZ99Ql.exe (PID: 520)
      • AppLaunch.exe (PID: 3172)
      • 4nw904IQ.exe (PID: 1792)
      • 5jj7ek9.exe (PID: 1860)
      • AppLaunch.exe (PID: 568)
      • 6JM6Su2.exe (PID: 1888)
      • AppLaunch.exe (PID: 2440)
      • explothe.exe (PID: 1408)
      • explothe.exe (PID: 3860)
      • explothe.exe (PID: 3228)

    • Create files in a temporary directory

      • wextract.exe (PID: 3412)
      • AU7ID21.exe (PID: 1804)
      • GK4HW36.exe (PID: 2252)
      • oo5Tp46.exe (PID: 4036)
      • Gj9sD46.exe (PID: 2900)
      • 6JM6Su2.exe (PID: 1888)

    • Reads the computer name

      • AppLaunch.exe (PID: 3172)
      • AppLaunch.exe (PID: 2440)
      • 6JM6Su2.exe (PID: 1888)
      • explothe.exe (PID: 1408)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 2440)
      • explothe.exe (PID: 1408)

    • Checks proxy server information

      • explothe.exe (PID: 1408)

    • Creates files or folders in the user directory

      • explothe.exe (PID: 1408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(1408) explothe.exe
C2 (1)http://77.91.124.1
Version3.89
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (120)-%lu
fefffe8cea
explothe.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
shutdown -s -t 0
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 11.00.17763.1
ProductName: Internet Explorer
OriginalFileName: WEXTRACT.EXE .MUI
LegalCopyright: © Microsoft Corporation. All rights reserved.
InternalName: Wextract
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
FileDescription: Win32 Cabinet Self-Extractor
CompanyName: Microsoft Corporation
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 11.0.17763.1
FileVersionNumber: 11.0.17763.1
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: 10
OSVersion: 10
EntryPoint: 0x6a60
UninitializedDataSize: -
InitializedDataSize: 1673728
CodeSize: 25600
LinkerVersion: 14.13
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2022:05:24 22:49:06+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
24
Malicious processes
7
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start wextract.exe no specs au7id21.exe no specs gk4hw36.exe no specs oo5tp46.exe no specs gj9sd46.exe no specs 3az99ql.exe no specs applaunch.exe no specs 4nw904iq.exe no specs applaunch.exe no specs 5jj7ek9.exe no specs applaunch.exe 6jm6su2.exe no specs #AMADEY explothe.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs explothe.exe no specs rundll32.exe no specs explothe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
520C:\Users\admin\AppData\Local\Temp\IXP003.TMP\3aZ99Ql.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\3aZ99Ql.exe—oo5Tp46.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\ixp003.tmp\3az99ql.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
568"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—4nw904IQ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
1408"C:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exe" C:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exe
6JM6Su2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fefffe8cea\explothe.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Amadey
(PID) Process(1408) explothe.exe
C2 (1)http://77.91.124.1
Version3.89
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (120)-%lu
fefffe8cea
explothe.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
shutdown -s -t 0
1628CACLS "..\fefffe8cea" /P "admin:N"C:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
1740C:\Windows\system32\cmd.exe /S /D /c" echo Y"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
1764"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /FC:\Windows\System32\schtasks.exe—explothe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1792C:\Users\admin\AppData\Local\Temp\IXP002.TMP\4nw904IQ.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\4nw904IQ.exe—GK4HW36.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\ixp002.tmp\4nw904iq.exe
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
1804C:\Users\admin\AppData\Local\Temp\IXP000.TMP\AU7ID21.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AU7ID21.exe—wextract.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\au7id21.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1860C:\Users\admin\AppData\Local\Temp\IXP001.TMP\5jj7ek9.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\5jj7ek9.exe—AU7ID21.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\5jj7ek9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1888C:\Users\admin\AppData\Local\Temp\IXP000.TMP\6JM6Su2.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\6JM6Su2.exe—wextract.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\ixp000.tmp\6jm6su2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
Total events
1 512
Read events
1 491
Write events
21
Delete events
0

Modification events

(PID) Process:(1888) 6JM6Su2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1888) 6JM6Su2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1888) 6JM6Su2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1888) 6JM6Su2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1408) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
(PID) Process:(1408) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1408) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1408) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1408) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1408) explothe.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
13
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1804AU7ID21.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\GK4HW36.exeexecutable
MD5:AEDAF5A8916582AC0F20F7ECC954FE84
SHA256:D4951F0C42803775229286CC910EFF2AB126A38A72A7A509E3821897BA90012E
3412wextract.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AU7ID21.exeexecutable
MD5:737824E8001798CA71D4B015D863B736
SHA256:034B08FB001028275861BF064AB77BECD68F1EF6652B5250CC1D8CCDA785A7CF
2252GK4HW36.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\4nw904IQ.exeexecutable
MD5:79585A4C76548A7B765DAC6BCB212BED
SHA256:BE9E8E9CD566EFD28583F4CEDB77F2451F23A6535521CCE361B943F57A0BBC0F
1408explothe.exeC:\Users\admin\AppData\Roaming\006700e5a2ab05\cred.dllhtml
MD5:A5B509A3FB95CC3C8D89CD39FC2A30FB
SHA256:5F3C80056C7B1104C15D6FEE49DAC07E665C6FFD0795AD486803641ED619C529
3412wextract.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\6JM6Su2.exeexecutable
MD5:4BD59A6B3207F99FC3435BAF3C22BC4E
SHA256:08E33DB08288DA47BBBE3A8D65A59E8536B05C464BA91DC66E08F9ABD245E236
4036oo5Tp46.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\3aZ99Ql.exeexecutable
MD5:0F321A1CA9679B9CE7206484913CBA79
SHA256:5EC1D358AA29AE5977BC38E2AF231D75D56B116FCDFF80B692B68F9D92BEB3D3
2252GK4HW36.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\oo5Tp46.exeexecutable
MD5:42871CE31AE6B457EA7A835E26F74661
SHA256:21C8FC4B8655C377DE1B28CE70489A6D28E794AD4B48124D0AB42A9A34458D99
18886JM6Su2.exeC:\Users\admin\AppData\Local\Temp\fefffe8cea\explothe.exeexecutable
MD5:4BD59A6B3207F99FC3435BAF3C22BC4E
SHA256:08E33DB08288DA47BBBE3A8D65A59E8536B05C464BA91DC66E08F9ABD245E236
2900Gj9sD46.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\1Jb99mb3.exeexecutable
MD5:15FE972BCFD9189D826083838645B850
SHA256:EC739F26F487BCC65718BB8C28A5E3ADF817A18E01952BD888F618A57C1E61D4
2900Gj9sD46.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\2yA7352.exeexecutable
MD5:53E28E07671D832A65FBFE3AA38B6678
SHA256:5C59DB3277AEFB761D4B814AAF5F5ACD1FD1A0EA154DC565C78B082A3DF4566E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
0
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1408
explothe.exe
GET
200
77.91.124.1:80
http://77.91.124.1/theme/Plugins/clip.dll
unknown
executable
89.0 Kb
unknown
1408
explothe.exe
GET
404
77.91.124.1:80
http://77.91.124.1/theme/Plugins/cred.dll
unknown
html
273 b
unknown
1408
explothe.exe
POST
200
77.91.124.1:80
http://77.91.124.1/theme/index.php
unknown
text
6 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2440
AppLaunch.exe
109.107.182.133:19084
—
Cloud assets LLC
RU
malicious
1408
explothe.exe
77.91.124.1:80
—
Foton Telecom CJSC
RU
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

PID
Process
Class
Message
1408
explothe.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
1408
explothe.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
1408
explothe.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
1408
explothe.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1408
explothe.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Payload Request (GET) M2
1408
explothe.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1408
explothe.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1408
explothe.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1408
explothe.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Payload Request (GET) M1
1408
explothe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wextract.exe