File name:

Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0

Full analysis: https://app.any.run/tasks/3a33a515-5dad-4ee2-a727-24deef8e96e6
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 16:55:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
remcos
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

42EBE056179491F4E967F537A03DFF96

SHA1:

A92FF6D7DCBAADD4820BCBE634B9482C0D79780D

SHA256:

9E3CE6488F70A8CDDB11C36DC9DC9CDD9CFFFABD699D56237843377DF8AFA5C0

SSDEEP:

49152:g64esEFCUl/yvtG5D6NhRUmZE73at0bF0/rn66pSYKMk7xRDpKcHjx5rhZYAzlXJ:DpsbUwvtGW03CaWr6oVKMqxRDjHjnrhx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS mutex has been found

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • Uses Task Scheduler to run other applications

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • REMCOS has been detected

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)
      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • REMCOS has been detected (SURICATA)

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • REMCOS has been detected (YARA)

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • Application launched itself

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • Reads security settings of Internet Explorer

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • Contacting a server suspected of hosting an CnC

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • Connects to unusual port

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • There is functionality for taking screenshot (YARA)

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

  • INFO

    • Reads the computer name

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)
      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • Checks supported languages

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)
      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • Creates files or folders in the user directory

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • Reads the machine GUID from the registry

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)
      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • Process checks computer location settings

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • Create files in a temporary directory

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 5772)

    • Creates files in the program directory

      • Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe (PID: 6964)

    • Checks proxy server information

      • slui.exe (PID: 3300)

    • Reads the software policy settings

      • slui.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(6964) Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
C2 (1)swertyhgvcfrdewsquiplkjmnb.ydns.eu:2554
Botnetobi
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_namechrome-85RCMN
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirchrome
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2041:08:05 11:57:40+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 1018368
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0xf9942
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.7.145.8
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Advanced network client with secure connectivity, data synchronization and distributed computing capabilities
CompanyName: Nebula Horizon Technologies
FileDescription: RoyNES Nexus
FileVersion: 3.7.145.8
InternalName: YWVd.exe
LegalCopyright: © Nebula Horizon Technologies • All Rights Reserved • 2025
LegalTrademarks: RoyNES™ • NHT Quantum Series
OriginalFileName: YWVd.exe
ProductName: RoyNES Nexus
ProductVersion: Quantum.2025.Spring
AssemblyVersion: 3.7.145.8
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe schtasks.exe no specs conhost.exe no specs sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe no specs #REMCOS sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QFEHcx" /XML "C:\Users\admin\AppData\Local\Temp\tmp220.tmp"C:\Windows\SysWOW64\schtasks.exe—Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
672"C:\Users\admin\Desktop\Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe"C:\Users\admin\Desktop\Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe—Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
User:
admin
Company:
Nebula Horizon Technologies
Integrity Level:
MEDIUM
Description:
RoyNES Nexus
Exit code:
4294967295
Version:
3.7.145.8
Modules
Images
c:\users\admin\desktop\sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3300C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5408\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5772"C:\Users\admin\Desktop\Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe" C:\Users\admin\Desktop\Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
explorer.exe
User:
admin
Company:
Nebula Horizon Technologies
Integrity Level:
MEDIUM
Description:
RoyNES Nexus
Exit code:
0
Version:
3.7.145.8
Modules
Images
c:\users\admin\desktop\sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6964"C:\Users\admin\Desktop\Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe"C:\Users\admin\Desktop\Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
User:
admin
Company:
Nebula Horizon Technologies
Integrity Level:
MEDIUM
Description:
RoyNES Nexus
Version:
3.7.145.8
Modules
Images
c:\users\admin\desktop\sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(6964) Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
C2 (1)swertyhgvcfrdewsquiplkjmnb.ydns.eu:2554
Botnetobi
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_namechrome-85RCMN
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirchrome
Keylog_dirremcos
Total events
5 897
Read events
5 893
Write events
4
Delete events
0

Modification events

(PID) Process:(6964) Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeKey:HKEY_CURRENT_USER\SOFTWARE\chrome-85RCMN
Operation:writeName:time
Value:
(PID) Process:(6964) Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeKey:HKEY_CURRENT_USER\SOFTWARE\chrome-85RCMN
Operation:writeName:UID
Value:
(PID) Process:(6964) Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeKey:HKEY_CURRENT_USER\SOFTWARE\chrome-85RCMN
Operation:writeName:exepath
Value:
4647EEBC627FE12A1A18C47F297395BE41583FEE9A42821E522C2F39CB2501F81D9E00631705121F1F7FB2DF050E6A93AAF1C8CB6EBDE9CF5C0604B910EA7FB1DD95370C9CC944806D9A824EF0C12BD80C1195E62EFB07388E26F69DFA82C4C0CDDAA0BD690B0DB1E1033AD2A0C6DFCA054B70E4E3A260A1EB929586F963F65B05CF4FE388A7F6C0D1EB32AD50DA2EA575C8B30971C158DB29033F87DF4844B50DB0A8F3AA6BD5DCCFB5E50150B7F09DEE144334F9AC751A6071C4947BB5804F6424A8624927FFCFDAB4
(PID) Process:(6964) Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeKey:HKEY_CURRENT_USER\SOFTWARE\chrome-85RCMN
Operation:writeName:licence
Value:
24FE0F9A474C1F2C27979E646BE38BA1
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5772Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeC:\Users\admin\AppData\Roaming\QFEHcx.exeexecutable
MD5:42EBE056179491F4E967F537A03DFF96
SHA256:9E3CE6488F70A8CDDB11C36DC9DC9CDD9CFFFABD699D56237843377DF8AFA5C0
6964Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeC:\ProgramData\remcos\logs.datbinary
MD5:EA11469D246ED7BDE958F157CF53E1B2
SHA256:E56880E0C524932A666901E20CCF7D97757E5C9EE257FFC67AF12258807E765D
5772Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exeC:\Users\admin\AppData\Local\Temp\tmp220.tmpxml
MD5:5A740A0F434761F1BE4F6A2B5C08AC44
SHA256:E328BB7775C8E00B540B2DDB8C585C7B1AE05E062558098B86A951816FC6C6DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
163
DNS requests
16
Threats
243

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2692
SIHClient.exe
GET
200
23.48.23.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
23.48.23.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
23.48.23.145:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
107.173.177.152:2554
swertyhgvcfrdewsquiplkjmnb.ydns.eu
AS-COLOCROSSING
US
suspicious
2692
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2692
SIHClient.exe
23.48.23.145:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2692
SIHClient.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2692
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
swertyhgvcfrdewsquiplkjmnb.ydns.eu
  • 107.173.177.152
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
crl.microsoft.com
  • 23.48.23.145
  • 23.48.23.155
  • 23.48.23.162
  • 23.48.23.143
  • 23.48.23.150
  • 23.48.23.169
  • 23.48.23.158
  • 23.48.23.156
  • 23.48.23.146
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Dynamic DNS Service (ydns .eu)
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6964
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_9e3ce6488f70a8cddb11c36dc9dc9cdd9cfffabd699d56237843377df8afa5c0