File name:

Telegram Desktop.exe

Full analysis: https://app.any.run/tasks/2151d2bc-c158-4cd0-8ab7-941803442479
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: November 24, 2023, 07:05:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
PhoenixStealer
AlfonsoStealer
HunterStealer
evasion
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1D156EA00258D8C5ED190AB425B6BF67

SHA1:

92014A052C4654A167E933702D8B12B13CA6A90D

SHA256:

96890D1D86AAD9940FD54604EF09DD7E2DCF5CC084EEAF63A1062B4FBEAD91AE

SSDEEP:

98304:iFgMEhr3Or19KXlcw1CdU2uP318hXjETV:uzGrO4n2uP3iwV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Telegram Desktop.exe (PID: 3020)
      • RussiaHack.exe (PID: 2668)
      • CHEAT and Bypass Matrix.exe (PID: 776)
      • msSurrogateHost.exe (PID: 2272)
      • MatrixHackByFilard.exe (PID: 2088)

    • Steals credentials from Web Browsers

      • Matrix Bypass.exe (PID: 1580)
      • RussiaHack.exe (PID: 2668)
      • Matrix Bypass.exe (PID: 2072)
      • MatrixHackByFilard.exe (PID: 2088)

    • Connects to the CnC server

      • Matrix Bypass.exe (PID: 1580)

    • PHOENIXSTEALER has been detected (SURICATA)

      • Matrix Bypass.exe (PID: 1580)

    • Steals credentials

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 2088)

    • Actions looks like stealing of personal data

      • Matrix Bypass.exe (PID: 1580)
      • RussiaHack.exe (PID: 2668)
      • Matrix Bypass.exe (PID: 2072)
      • MatrixHackByFilard.exe (PID: 2088)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1816)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • Telegram Desktop.exe (PID: 3020)

    • Reads the Internet Settings

      • Telegram Desktop.exe (PID: 3020)
      • RussiaHack.exe (PID: 2668)
      • CHEAT and Bypass Matrix.exe (PID: 776)
      • wscript.exe (PID: 1816)
      • msSurrogateHost.exe (PID: 2272)
      • MatrixHackByFilard.exe (PID: 2088)

    • Reads Internet Explorer settings

      • Telegram Desktop.exe (PID: 3020)

    • Loads DLL from Mozilla Firefox

      • Matrix Bypass.exe (PID: 1580)
      • RussiaHack.exe (PID: 2668)
      • Matrix Bypass.exe (PID: 2072)
      • MatrixHackByFilard.exe (PID: 2088)

    • Reads browser cookies

      • Matrix Bypass.exe (PID: 1580)
      • Matrix Bypass.exe (PID: 2072)

    • Reads Mozilla Firefox installation path

      • Matrix Bypass.exe (PID: 1580)
      • Matrix Bypass.exe (PID: 2072)

    • Connects to unusual port

      • Matrix Bypass.exe (PID: 1580)
      • Matrix Bypass.exe (PID: 2072)

    • Checks for external IP

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 2088)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 2088)

    • Accesses Microsoft Outlook profiles

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 2088)

    • Starts CMD.EXE for commands execution

      • RussiaHack.exe (PID: 2668)
      • wscript.exe (PID: 1816)
      • msSurrogateHost.exe (PID: 2272)
      • MatrixHackByFilard.exe (PID: 2088)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 2532)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2744)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 1212)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 2920)

    • Reads settings of System Certificates

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 2088)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 2744)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 2796)

    • Executing commands from a ".bat" file

      • RussiaHack.exe (PID: 2668)
      • wscript.exe (PID: 1816)
      • msSurrogateHost.exe (PID: 2272)
      • MatrixHackByFilard.exe (PID: 2088)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1212)
      • cmd.exe (PID: 2920)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1212)
      • cmd.exe (PID: 2920)

    • The process creates files with name similar to system file names

      • CHEAT and Bypass Matrix.exe (PID: 776)
      • msSurrogateHost.exe (PID: 2272)

    • The process executes VB scripts

      • CHEAT and Bypass Matrix.exe (PID: 776)

    • Executed via WMI

      • schtasks.exe (PID: 2364)
      • schtasks.exe (PID: 2340)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 2348)
      • schtasks.exe (PID: 2616)
      • schtasks.exe (PID: 2388)
      • schtasks.exe (PID: 2504)
      • schtasks.exe (PID: 2408)
      • schtasks.exe (PID: 2568)
      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 2448)
      • schtasks.exe (PID: 2456)
      • schtasks.exe (PID: 2496)
      • schtasks.exe (PID: 2520)
      • schtasks.exe (PID: 2544)
      • schtasks.exe (PID: 2556)
      • schtasks.exe (PID: 2604)
      • schtasks.exe (PID: 2580)
      • schtasks.exe (PID: 2652)
      • schtasks.exe (PID: 2664)
      • schtasks.exe (PID: 2728)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 2764)
      • schtasks.exe (PID: 2780)
      • schtasks.exe (PID: 2804)
      • schtasks.exe (PID: 2864)
      • schtasks.exe (PID: 2816)
      • schtasks.exe (PID: 2828)
      • schtasks.exe (PID: 2852)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 2972)
      • schtasks.exe (PID: 2892)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 2912)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 2676)
      • schtasks.exe (PID: 2700)
      • schtasks.exe (PID: 2712)
      • schtasks.exe (PID: 2980)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1816)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2232)

  • INFO

    • Checks supported languages

      • Telegram Desktop.exe (PID: 3020)
      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 1632)
      • Matrix Bypass.exe (PID: 1580)
      • VapeInstaller.exe (PID: 2120)
      • chcp.com (PID: 2852)
      • msiexec.exe (PID: 1092)
      • chcp.com (PID: 2320)
      • chcp.com (PID: 1436)
      • IMEKLMG.EXE (PID: 1460)
      • IMEKLMG.EXE (PID: 1288)
      • IMEKLMG.EXE (PID: 1224)
      • CHEAT and Bypass Matrix.exe (PID: 776)
      • Matrix Bypass.exe (PID: 2072)
      • IMEKLMG.EXE (PID: 2012)
      • MatrixHackByFilard.exe (PID: 2088)
      • VapeInstaller.exe (PID: 2196)
      • msSurrogateHost.exe (PID: 2272)
      • chcp.com (PID: 2568)
      • chcp.com (PID: 2800)
      • chcp.com (PID: 3008)

    • Reads the computer name

      • Telegram Desktop.exe (PID: 3020)
      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 1632)
      • Matrix Bypass.exe (PID: 1580)
      • msiexec.exe (PID: 1092)
      • IMEKLMG.EXE (PID: 1460)
      • IMEKLMG.EXE (PID: 1288)
      • IMEKLMG.EXE (PID: 1224)
      • IMEKLMG.EXE (PID: 2012)
      • CHEAT and Bypass Matrix.exe (PID: 776)
      • Matrix Bypass.exe (PID: 2072)
      • MatrixHackByFilard.exe (PID: 2088)
      • msSurrogateHost.exe (PID: 2272)

    • Checks proxy server information

      • Telegram Desktop.exe (PID: 3020)

    • Reads the machine GUID from the registry

      • Telegram Desktop.exe (PID: 3020)
      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 1632)
      • msiexec.exe (PID: 1092)
      • MatrixHackByFilard.exe (PID: 2088)
      • msSurrogateHost.exe (PID: 2272)

    • Manual execution by a user

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 1632)
      • Matrix Bypass.exe (PID: 1580)
      • VapeInstaller.exe (PID: 2120)
      • notepad.exe (PID: 1764)
      • IMEKLMG.EXE (PID: 1460)
      • IMEKLMG.EXE (PID: 1288)
      • IMEKLMG.EXE (PID: 2012)
      • CHEAT and Bypass Matrix.exe (PID: 776)
      • IMEKLMG.EXE (PID: 1224)
      • Matrix Bypass.exe (PID: 2072)
      • MatrixHackByFilard.exe (PID: 2088)
      • VapeInstaller.exe (PID: 2196)
      • schtasks.exe (PID: 1812)
      • schtasks.exe (PID: 3032)
      • schtasks.exe (PID: 3056)
      • schtasks.exe (PID: 1968)
      • schtasks.exe (PID: 1800)
      • schtasks.exe (PID: 1308)
      • schtasks.exe (PID: 1836)
      • schtasks.exe (PID: 780)
      • schtasks.exe (PID: 2212)
      • schtasks.exe (PID: 2196)
      • schtasks.exe (PID: 3044)

    • Create files in a temporary directory

      • Matrix Bypass.exe (PID: 1580)
      • RussiaHack.exe (PID: 2668)
      • Matrix Bypass.exe (PID: 2072)
      • msSurrogateHost.exe (PID: 2272)
      • MatrixHackByFilard.exe (PID: 2088)

    • Reads Environment values

      • RussiaHack.exe (PID: 2668)
      • Matrix Bypass.exe (PID: 1580)
      • MatrixHackByFilard.exe (PID: 1632)
      • Matrix Bypass.exe (PID: 2072)
      • MatrixHackByFilard.exe (PID: 2088)
      • msSurrogateHost.exe (PID: 2272)

    • Reads Windows Product ID

      • Matrix Bypass.exe (PID: 1580)
      • Matrix Bypass.exe (PID: 2072)

    • Reads product name

      • Matrix Bypass.exe (PID: 1580)
      • Matrix Bypass.exe (PID: 2072)

    • Creates files or folders in the user directory

      • RussiaHack.exe (PID: 2668)
      • CHEAT and Bypass Matrix.exe (PID: 776)
      • msSurrogateHost.exe (PID: 2272)
      • MatrixHackByFilard.exe (PID: 2088)

    • Reads CPU info

      • RussiaHack.exe (PID: 2668)
      • MatrixHackByFilard.exe (PID: 2088)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1460)
      • IMEKLMG.EXE (PID: 1288)

    • The executable file from the user directory is run by the CMD process

      • msSurrogateHost.exe (PID: 2272)

    • Creates files in the program directory

      • msSurrogateHost.exe (PID: 2272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:01:17 17:23:53+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 208384
InitializedDataSize: 117760
UninitializedDataSize: -
EntryPoint: 0x20600
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
179
Monitored processes
94
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start start telegram desktop.exe no specs russiahack.exe matrixhackbyfilard.exe no specs #PHOENIXSTEALER matrix bypass.exe vapeinstaller.exe no specs notepad.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs msiexec.exe no specs cmd.exe no specs netsh.exe no specs chcp.com no specs cmd.exe no specs chcp.com no specs taskkill.exe no specs timeout.exe no specs imeklmg.exe no specs imeklmg.exe no specs imeklmg.exe no specs imeklmg.exe no specs cheat and bypass matrix.exe no specs wscript.exe no specs wscript.exe no specs matrix bypass.exe matrixhackbyfilard.exe vapeinstaller.exe no specs cmd.exe no specs mssurrogatehost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs cmd.exe no specs chcp.com no specs netsh.exe no specs cmd.exe no specs chcp.com no specs taskkill.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124netsh wlan show profile C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
712Timeout /T 2 /NobreakC:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
776TaskKill /F /IM 2668C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
776"C:\Users\admin\Desktop\CHEAT and Bypass Matrix.exe" C:\Users\admin\Desktop\CHEAT and Bypass Matrix.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\cheat and bypass matrix.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
780schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\admin\PrintHood\wininit.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1092C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1176netsh wlan show networks mode=bssidC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1212findstr AllC:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1212"C:\Windows\System32\cmd.exe" /C C:\Users\admin\AppData\Local\Temp\tmp5321.tmp.batC:\Windows\System32\cmd.exe—RussiaHack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1224"C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
0
Version:
14.0.4734.1000
Modules
Images
c:\program files (x86)\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
10 209
Read events
9 942
Write events
267
Delete events
0

Modification events

(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(3020) Telegram Desktop.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(2668) RussiaHack.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
25
Suspicious files
64
Text files
106
Unknown types
0

Dropped files

PID
Process
Filename
Type
3020Telegram Desktop.exeC:\Users\admin\Desktop\VapeInstaller.exeexecutable
MD5:9238BE200DBF0DBE0466EBFF4DB56301
SHA256:0758146425C10208D3C8000B444E5F3D1EF203918E1B60A9F9F01214564FB9C5
3020Telegram Desktop.exeC:\Users\admin\Desktop\MatrixHackByFilard.exeexecutable
MD5:05C3624435FDA6BDDFD80B5D337EB2A4
SHA256:96A14D1422DC0F5889CDB4D2E110B5DAC6C638167509DDF728B9C84F3AF40AAE
3020Telegram Desktop.exeC:\Users\admin\Desktop\RussiaHack.exeexecutable
MD5:65FADDAB9784289F8BA392F328871227
SHA256:F250BC5734FFAD4A59E2CB017F85E495FC8070056C01C5002470567B7179F62D
3020Telegram Desktop.exeC:\Users\admin\Desktop\Matrix Bypass.exeexecutable
MD5:9238BE200DBF0DBE0466EBFF4DB56301
SHA256:0758146425C10208D3C8000B444E5F3D1EF203918E1B60A9F9F01214564FB9C5
2668RussiaHack.exeC:\Users\admin\AppData\Local\37a9952135d8c9fb12ba8336c392013e\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Pictures\seniorbuilt.pngimage
MD5:515BF30291C0105CEAC71DEDDEBA7F14
SHA256:2F1924A1EF200FC12049DE11DCAF20C53FFB3CF6CCF7EF26ECCED24DEBEBC831
2668RussiaHack.exeC:\Users\admin\AppData\Local\Temp\tmp679.tmp.dat —
MD5:—
SHA256:—
2668RussiaHack.exeC:\Users\admin\AppData\Local\37a9952135d8c9fb12ba8336c392013e\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\policiesroyal.rtftext
MD5:5A48A1C552409747B5E1F3912501B886
SHA256:96F21349A70EBDC3DBBE3B759C28F0E3FDC0281FBE97ADBFD955B4FBC360AB09
2668RussiaHack.exeC:\Users\admin\AppData\Local\37a9952135d8c9fb12ba8336c392013e\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\mapaustralia.pngimage
MD5:C57347272AE612794D3F73F3E9D0EA22
SHA256:A1CAF0C148086F3D1ABB79580F88E1AA14D882CAD5CB9B9993E2209EB77A59AC
2668RussiaHack.exeC:\Users\admin\AppData\Local\37a9952135d8c9fb12ba8336c392013e\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\doform.rtftext
MD5:2E200EA1657F05B7AD37B5049B3D4181
SHA256:46A3014BFA9F7977E019B954317187ACE6C2B80B44E2058664232BD92C0F19B7
2668RussiaHack.exeC:\Users\admin\Desktop\DotNetZip.dllexecutable
MD5:6D1C62EC1C2EF722F49B2D8DD4A4DF16
SHA256:00DA1597D92235D3F84DA979E2FA5DBF049BAFB52C33BD6FC8EE7B29570C124C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
22
DNS requests
14
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
RussiaHack.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
2668
RussiaHack.exe
GET
200
104.18.114.97:80
http://icanhazip.com/
unknown
text
13 b
unknown
2668
RussiaHack.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
2668
RussiaHack.exe
GET
200
104.18.114.97:80
http://icanhazip.com/
unknown
text
13 b
unknown
2668
RussiaHack.exe
GET
200
104.18.114.97:80
http://icanhazip.com/
unknown
text
13 b
unknown
2668
RussiaHack.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
2668
RussiaHack.exe
GET
200
23.216.77.47:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5204047a655e388f
unknown
compressed
61.6 Kb
unknown
2088
MatrixHackByFilard.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
2088
MatrixHackByFilard.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
2088
MatrixHackByFilard.exe
GET
200
104.18.115.97:80
http://icanhazip.com/
unknown
text
13 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1580
Matrix Bypass.exe
194.87.248.102:3000
—
JSC Mediasoft ekspert
RU
unknown
2668
RussiaHack.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
2668
RussiaHack.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
unknown
2668
RussiaHack.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown
2668
RussiaHack.exe
104.18.114.97:80
icanhazip.com
CLOUDFLARENET
—
unknown
2668
RussiaHack.exe
172.67.196.114:443
api.mylnikov.org
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
api.telegram.org
  • 149.154.167.220
shared
icanhazip.com
  • 104.18.114.97
  • 104.18.115.97
shared
api.anonfiles.com
  • —
unknown
api.mylnikov.org
  • 172.67.196.114
  • 104.21.44.66
unknown
ctldl.windowsupdate.com
  • 23.216.77.47
  • 23.216.77.83
  • 23.216.77.77
  • 23.216.77.48
  • 23.216.77.66
  • 23.216.77.46
  • 23.216.77.72
whitelisted
teredo.ipv6.microsoft.com
  • —
unknown

Threats

PID
Process
Class
Message
1580
Matrix Bypass.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil
2668
RussiaHack.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2668
RussiaHack.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2668
RussiaHack.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
324
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
2668
RussiaHack.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
2668
RussiaHack.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
2668
RussiaHack.exe
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2668
RussiaHack.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
2668
RussiaHack.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Telegram Desktop.exe