We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
22 April 2026, 12:31
Analysis environment:
Windows 10 Pro, build 19044, x64
bnyu.r
MD5:
A490AB0373F922D842891125441DD896
SHA1:
CBD86DB11499512F4894F0ED2FBC7ABF3BD513BD
SHA256:
9D0CE7A84E62E3458B82D682C7C3F97D095CB2FBA8CAA0263EE8929994990254
Analysis result
Threat level:
Malicious activity
Tags:
stealer
susp-powershell
donutloader
loader
Full analysis:
Analysis bnyu.r (MD5: A490AB0373F922D842891125441DD896) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
DONUTLOADER has been detected (YARA)
powershell.exe (PID: 204)
Run PowerShell with an invisible window
powershell.exe (PID: 204)
Dynamically loads an assembly (POWERSHELL)
powershell.exe (PID: 204)
Steals credentials from Web Browsers
powershell.exe (PID: 204)
Actions looks like stealing of personal data
powershell.exe (PID: 204)
SUSPICIOUS
The process bypasses the loading of PowerShell profile settings
powershell.exe (PID: 7608)
Uses base64 encoding (POWERSHELL)
powershell.exe (PID: 204)
powershell.exe (PID: 7608)
Starts POWERSHELL.EXE for commands execution
powershell.exe (PID: 7608)
Bypass execution policy to execute commands
powershell.exe (PID: 7608)
Possible stealing from browsers
powershell.exe (PID: 204)
Possible stealing from crypto wallets
powershell.exe (PID: 204)
Possible stealing of email data
powershell.exe (PID: 204)
Possible stealing of messenger data
powershell.exe (PID: 204)
Possible stealing of FTP data
powershell.exe (PID: 204)
Possible stealing of VPN data
powershell.exe (PID: 204)
Possible stealing from password managers
powershell.exe (PID: 204)
Possible stealing from 2fa
powershell.exe (PID: 204)
Multiple wallet extension IDs have been found
powershell.exe (PID: 204)
INFO
Checks whether the specified file exists (POWERSHELL)
powershell.exe (PID: 7608)
Creates a byte array (POWERSHELL)
powershell.exe (PID: 7608)
Converts byte array into Unicode string (POWERSHELL)
powershell.exe (PID: 7608)
Gets data length (POWERSHELL)
powershell.exe (PID: 204)
Threats
PID
Process
Class
Message
2232
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
204
powershell.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.icu) in TLS SNI