URL:

https://mini-01-s3.vx-underground.org/samples/Builders/XWorm/U+%20RAT%20(Chinese)/U+%20RAT.7z

Full analysis: https://app.any.run/tasks/b78f9006-822c-4232-bca2-13d063712f15
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: May 14, 2025, 17:30:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xworm
crypto-regex
ip-check
Indicators:
MD5:

C43053C1D0D7BA919889A1848B071ACE

SHA1:

79E623B044F86877B8FE14B643C3DD2C5A46B6CF

SHA256:

9E60D3FADEBFB3438E8416952F9540CFF52D242B54F93BB28123CFC51E11E69E

SSDEEP:

3:N8xdjnDJuayKYaAFUxy0HA2xon:2PDdyKYLEIn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XWORM has been detected (YARA)

      • U+ Rat.exe (PID: 8144)
      • UClient.exe (PID: 7472)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 5728)

    • The process checks if it is being run in the virtual environment

      • U+ Rat.exe (PID: 8144)

    • There is functionality for capture public ip (YARA)

      • U+ Rat.exe (PID: 8144)

    • Found regular expressions for crypto-addresses (YARA)

      • U+ Rat.exe (PID: 8144)

    • There is functionality for taking screenshot (YARA)

      • U+ Rat.exe (PID: 8144)

    • Reads security settings of Internet Explorer

      • U+ Rat.exe (PID: 8144)
      • UClient.exe (PID: 7472)

    • Executable content was dropped or overwritten

      • vbc.exe (PID: 8076)
      • vbc.exe (PID: 5956)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 4164)
      • firefox.exe (PID: 6480)

    • Manual execution by a user

      • WinRAR.exe (PID: 5728)
      • U+ Rat.exe (PID: 8144)
      • UClient.exe (PID: 7472)
      • UClient.exe (PID: 6924)

    • Checks supported languages

      • U+ Rat.exe (PID: 8144)
      • vbc.exe (PID: 8076)
      • cvtres.exe (PID: 7360)
      • UClient.exe (PID: 7472)

    • Reads the computer name

      • U+ Rat.exe (PID: 8144)
      • UClient.exe (PID: 7472)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5728)

    • Reads the machine GUID from the registry

      • U+ Rat.exe (PID: 8144)
      • UClient.exe (PID: 7472)
      • vbc.exe (PID: 8076)

    • Reads the software policy settings

      • slui.exe (PID: 8108)
      • slui.exe (PID: 7568)

    • Create files in a temporary directory

      • U+ Rat.exe (PID: 8144)
      • cvtres.exe (PID: 7360)
      • vbc.exe (PID: 8076)

    • Checks proxy server information

      • slui.exe (PID: 7568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
29
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs sppextcomobj.exe no specs firefox.exe no specs slui.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe #XWORM u+ rat.exe no specs slui.exe vbc.exe conhost.exe no specs cvtres.exe no specs #XWORM uclient.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe mobsync.exe no specs vbc.exe conhost.exe no specs cvtres.exe no specs uclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Exit code:
0
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1452C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2384"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4984 -childID 6 -isForBrowser -prefsHandle 5092 -prefMapHandle 5004 -prefsLen 38183 -prefMapSize 244583 -jsInitHandle 1284 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f2f1460-16de-4637-beb6-cfe118936382} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 16fd0016310 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
4164"C:\Program Files\Mozilla Firefox\firefox.exe" https://mini-01-s3.vx-underground.org/samples/Builders/XWorm/U+%20RAT%20(Chinese)/U+%20RAT.7zC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4244"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5096 -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1284 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b4fcc1c-f871-4fd4-91c1-923f06a5f004} 4164 "\\.\pipe\gecko-crash-server-pipe.4164" 16fd0016690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
4932"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\combase.dll
4980"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
5728"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\U+ RAT.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5868"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5956"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\admin\AppData\Local\Temp\rl0aehcb.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
UClient.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
14.8.9037.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
28 955
Read events
28 766
Write events
185
Delete events
4

Modification events

(PID) Process:(4164) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\U+ RAT.7z
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5728) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
52
Suspicious files
207
Text files
250
Unknown types
4

Dropped files

PID
Process
Filename
Type
4164firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:2C99A16AED3906D92FFE3EF1808E2753
SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.dbbinary
MD5:F04FD1F982893147EEBD04C567DCF86C
SHA256:5FAA6ABB9DC03C9D7DF5A480CE6ADF6A22BD454BAF06C8EDD2FE7509052435D2
4164firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
4164firefox.exeC:\Users\admin\Downloads\U+ RAT.DMWwXxMH.7z.part —
MD5:—
SHA256:—
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
4164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
111
DNS requests
93
Threats
40

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
—
—
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
—
—
POST
200
184.24.77.44:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
—
—
POST
200
184.24.77.44:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
—
—
POST
200
142.250.185.163:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
—
—
POST
200
142.250.185.163:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
—
—
POST
200
142.250.185.163:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
—
—
POST
200
184.24.77.80:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
34.36.137.203:443
contile.services.mozilla.com
—
—
whitelisted
—
—
104.18.7.192:443
mini-01-s3.vx-underground.org
CLOUDFLARENET
—
shared
—
—
142.250.185.74:443
safebrowsing.googleapis.com
—
—
whitelisted
—
—
34.107.243.93:443
push.services.mozilla.com
GOOGLE
US
whitelisted
—
—
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.175
  • 23.48.23.156
  • 23.48.23.166
  • 23.48.23.167
  • 23.48.23.154
  • 23.48.23.183
  • 23.48.23.170
  • 23.48.23.168
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.142
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
mini-01-s3.vx-underground.org
  • 104.18.7.192
  • 104.18.6.192
  • 2606:4700::6812:6c0
  • 2606:4700::6812:7c0
malicious
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
content-signature-chains.prod.autograph.services.mozaws.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted

Threats

PID
Process
Class
Message
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
7472
UClient.exe
A Network Trojan was detected
ET MALWARE Possible MEME#4CHAN Exfil Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mini-01-s3.vx-underground.org/samples/Builders/XWorm/U+%20RAT%20(Chinese)/U+%20RAT.7z