| File name: | bomb.exe |
| Full analysis: | https://app.any.run/tasks/43391bba-c010-40e7-a8f4-6b0bc77d4141 |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | April 19, 2025, 04:25:04 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 0E2AD53C884E25F969B3A575F4BB90BB |
| SHA1: | 81E774FE109DDC9185AD3FB68995A069CE9045E0 |
| SHA256: | 990D1FF1AB883A9BACBBB6ABCF975139D9AB359B74FFBA16F1FA7A66A30E935D |
| SSDEEP: | 192:OJa0tZMoQszhl4AKd+QHzdPbwPz1OLU87glpp/bI6J4YlTtoIw:OLJQjd+qzZ0OLU870NJDoI |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2057:01:07 19:44:57+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 9216 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x43be |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | - |
| FileVersion: | 1.0.0.0 |
| InternalName: | bomb.exe |
| LegalCopyright: | - |
| LegalTrademarks: | - |
| OriginalFileName: | bomb.exe |
| ProductName: | - |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 616 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | http176.65.134.79HOSTCZXCVTD.exe.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 1 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 1096 | "C:\Users\admin\Desktop\Guard-Endpoint\HeimdallGuard.exe" --watchdog | C:\Users\admin\Desktop\Guard-Endpoint\HeimdallGuard.exe | — | HeimdallGuard.exe | |||||||||||
User: admin Integrity Level: HIGH Description: HeimdallGuard Version: 1.0.0.0 Modules
| |||||||||||||||
| 1184 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | HeimdallGuard.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1660 | "C:\Users\admin\Desktop\httpsgithub.comvinhuptodaytestbnrawrefsheadsmainbrbotnet.exe.exe" | C:\Users\admin\Desktop\httpsgithub.comvinhuptodaytestbnrawrefsheadsmainbrbotnet.exe.exe | — | bomb.exe | |||||||||||
User: admin Company: i Integrity Level: MEDIUM Description: WindowsSharp Version: 1.09.9879.0 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2284 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4608 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | HeimdallGuard.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4892 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | — | http176.65.134.79HOSTCZXCVTD.exe.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 4294967295 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 4976 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4980 | "C:\Users\admin\Desktop\bomb.exe" | C:\Users\admin\Desktop\bomb.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Version: 1.0.0.0 Modules
| |||||||||||||||
| (PID) Process: | (5892) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (5892) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (5892) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (5892) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4980) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4980) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (4980) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4980) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4980) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (4980) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5892 | WinRAR.exe | C:\Users\admin\Desktop\Guard-Endpoint\HeimdallGuard.exe | executable | |
MD5:EB82D42A6C6CE9794AEB165FE857C7CF | SHA256:A9FD7CAC0FF0B2FE0C4DCA174049DF06C0CC697770365CFE4507EF0453F8B220 | |||
| 4980 | bomb.exe | C:\Users\admin\Desktop\httpsgithub.comvinhuptodaytestbnrawrefsheadsmainbrbotnet.exe.exe | executable | |
MD5:4C753F7A2AF14B8DC43F2D169EA61752 | SHA256:A951BB26B99601F732F9333D11DFA5028E78D90EF80287DC7E82A2C37DE61993 | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\checkbox.png | image | |
MD5:7C24A95DF573051C42420C5C5B3F3F8A | SHA256:52323F1C1F9855D097FDBE3089260162D27E4C6D250E1C68689579782B4D6596 | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\browse.png | image | |
MD5:65592078608C290F649D4AC20D6DF655 | SHA256:5114C3C5C8FF355E6930AA1A163D01E909D687E789467DAB1A19DB5198F77A03 | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\slogan.png | image | |
MD5:6DF4EAE215A8DF422C57DBFB29A4F1A0 | SHA256:EAF36E8460B7721DBFCEDE56FFC4171CD486926EDC97B37D923AF2A31BE84915 | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\custom.png | image | |
MD5:0EE064E810440E76B36C64AC7CB4438D | SHA256:B263880F6893899F16CC6A8AA1AE9D5DFA1830D67892F552D2C2BFDC020BB69D | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\full_bg.png | image | |
MD5:B69BEADCFE42254D22366BA3829C981C | SHA256:7CC31AA707C81D7E09F680923864E8373E1D3C599FD2CA7CE05B153477A28249 | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\empty_bg.png | image | |
MD5:580EC3E3BAD21F36E42245222301B665 | SHA256:BF977B73C5C3E2BF4B5CDA35806E7BE1DEE360BEDF01B6DCBB32EDAD9E8A6491 | |||
| 7804 | http176.65.134.79HOSTFoxmailSetup_7.2.25.375.exe.exe | C:\Users\admin\AppData\Local\Temp\nsp7405.tmp\pic\strongbtn.png | image | |
MD5:778740651ED84FA80761AB369A807537 | SHA256:888B93397451DC4B51F5D4D3A732C24E013113CE9FF624959D6AF213FF691D26 | |||
| 1660 | httpsgithub.comvinhuptodaytestbnrawrefsheadsmainbrbotnet.exe.exe | C:\Users\admin\AppData\Local\Temp\brnettt_pYBgAmcYt7 | binary | |
MD5:29A644B1F0D96166A05602FE27B3F4AD | SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4980 | bomb.exe | GET | 200 | 176.65.134.79:80 | http://176.65.134.79/HOST/FoxmailSetup_7.2.25.375.exe | unknown | — | — | malicious |
4980 | bomb.exe | GET | 200 | 112.74.184.37:7777 | http://112.74.184.37:7777/02.08.2022.exe | unknown | — | — | unknown |
6564 | http176.65.134.79HOSTCZXCVTD.exe.exe | GET | 200 | 176.65.134.79:80 | http://176.65.134.79/HOST/NEWDEVVV.txt | unknown | — | — | malicious |
4980 | bomb.exe | GET | 200 | 176.65.134.79:80 | http://176.65.134.79/HOST/CZXCVTD.exe | unknown | — | — | malicious |
4980 | bomb.exe | GET | 200 | 114.96.89.69:8088 | http://114.96.89.69:8088/02.08.2022.exe | unknown | — | — | unknown |
616 | RegAsm.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | whitelisted |
4980 | bomb.exe | GET | 200 | 23.95.193.207:9178 | http://23.95.193.207:9178/02.08.2022.exe | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.65:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
4980 | bomb.exe | 188.114.97.3:443 | maper.info | CLOUDFLARENET | NL | malicious |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
maper.info |
| malicious |
www.google.com |
| whitelisted |
urlhaus.abuse.ch |
| whitelisted |
github.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
4980 | bomb.exe | Potential Corporate Privacy Violation | ET INFO IP Logger Redirect Domain in SNI |
4980 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
4980 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
4980 | bomb.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
4980 | bomb.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
2196 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |
4980 | bomb.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
4980 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
4980 | bomb.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
4980 | bomb.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |