File name:

efa4cd8325e4546ab260ea774d4acc23

Full analysis: https://app.any.run/tasks/a66f7773-7fa8-43e9-97da-ee6eb64f33f4
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 03, 2023, 11:36:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealc
stealer
redline
amadey
botnet
trojan
loader
smoke
opendir
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EFA4CD8325E4546AB260EA774D4ACC23

SHA1:

DD1F1879F2C365C92F0B03700443DA0C1615E92A

SHA256:

B13A57C400F6768B5D11C671DFA94414C1C1130F840575A19FF15121A0CD3C3A

SSDEEP:

49152:6LnemIrLQ0l8SKLQ2dTLT7/CJjImMZYqRDMsUeF13VQ5RbYQ+uqsk9oz+V/h9ovt:en2nl8SKc2lLv1mMzllVXU9t+psk9oSS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • efa4cd8325e4546ab260ea774d4acc23.exe (PID: 2584)
      • Ma7jE31.exe (PID: 2348)
      • aH9RJ51.exe (PID: 2600)
      • Bw6ym19.exe (PID: 1532)
      • 5hN7oa1.exe (PID: 2280)
      • Ji0Pj27.exe (PID: 2944)
      • explothe.exe (PID: 2552)
      • ct6Iv81.exe (PID: 2520)

    • Runs injected code in another process

      • 3VX66MT.exe (PID: 848)

    • STEALC has been detected (SURICATA)

      • AppLaunch.exe (PID: 2732)

    • Connects to the CnC server

      • AppLaunch.exe (PID: 2732)
      • AppLaunch.exe (PID: 2904)
      • explothe.exe (PID: 2552)
      • explorer.exe (PID: 1944)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Changes the autorun value in the registry

      • explothe.exe (PID: 2552)

    • Uses Task Scheduler to run other applications

      • explothe.exe (PID: 2552)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 2904)

    • REDLINE has been detected (SURICATA)

      • AppLaunch.exe (PID: 2904)

    • AMADEY has been detected (SURICATA)

      • explothe.exe (PID: 2552)

    • AMADEY has been detected (YARA)

      • explothe.exe (PID: 2552)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 2904)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • efa4cd8325e4546ab260ea774d4acc23.exe (PID: 2584)
      • Ma7jE31.exe (PID: 2348)
      • aH9RJ51.exe (PID: 2600)
      • Ji0Pj27.exe (PID: 2944)
      • ct6Iv81.exe (PID: 2520)

    • Connects to the server without a host name

      • AppLaunch.exe (PID: 2732)
      • 6Yu0yv6.exe (PID: 364)
      • explothe.exe (PID: 2552)
      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • AppLaunch.exe (PID: 2732)
      • 5hN7oa1.exe (PID: 2280)
      • 6Yu0yv6.exe (PID: 364)
      • explothe.exe (PID: 2552)
      • 7nk6sX99.exe (PID: 2288)
      • cmd.exe (PID: 2412)

    • Starts itself from another location

      • 5hN7oa1.exe (PID: 2280)

    • Starts CMD.EXE for commands execution

      • explothe.exe (PID: 2552)
      • cmd.exe (PID: 2620)
      • 7nk6sX99.exe (PID: 2288)

    • Application launched itself

      • cmd.exe (PID: 2620)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2620)

    • Executing commands from a ".bat" file

      • 7nk6sX99.exe (PID: 2288)

    • Reads browser cookies

      • AppLaunch.exe (PID: 2904)

    • Searches for installed software

      • AppLaunch.exe (PID: 2904)

    • Connects to unusual port

      • AppLaunch.exe (PID: 2904)

    • Process requests binary or script from the Internet

      • explothe.exe (PID: 2552)

    • The process executes via Task Scheduler

      • explothe.exe (PID: 3604)
      • explothe.exe (PID: 3504)

  • INFO

    • Create files in a temporary directory

      • efa4cd8325e4546ab260ea774d4acc23.exe (PID: 2584)
      • ct6Iv81.exe (PID: 2520)
      • Ma7jE31.exe (PID: 2348)
      • aH9RJ51.exe (PID: 2600)
      • Bw6ym19.exe (PID: 1532)
      • 5hN7oa1.exe (PID: 2280)
      • 7nk6sX99.exe (PID: 2288)
      • Ji0Pj27.exe (PID: 2944)

    • Checks supported languages

      • efa4cd8325e4546ab260ea774d4acc23.exe (PID: 2584)
      • ct6Iv81.exe (PID: 2520)
      • Ma7jE31.exe (PID: 2348)
      • aH9RJ51.exe (PID: 2600)
      • Ji0Pj27.exe (PID: 2944)
      • 1hM21tr6.exe (PID: 584)
      • Bw6ym19.exe (PID: 1532)
      • 2Ol9662.exe (PID: 2216)
      • AppLaunch.exe (PID: 2920)
      • AppLaunch.exe (PID: 2732)
      • 3VX66MT.exe (PID: 848)
      • AppLaunch.exe (PID: 2904)
      • 5hN7oa1.exe (PID: 2280)
      • 6Yu0yv6.exe (PID: 364)
      • 4uQ064nO.exe (PID: 2668)
      • explothe.exe (PID: 2552)
      • 7nk6sX99.exe (PID: 2288)
      • explothe.exe (PID: 3504)
      • explothe.exe (PID: 3604)

    • Reads the computer name

      • AppLaunch.exe (PID: 2920)
      • AppLaunch.exe (PID: 2732)
      • AppLaunch.exe (PID: 2904)
      • 5hN7oa1.exe (PID: 2280)
      • 6Yu0yv6.exe (PID: 364)
      • explothe.exe (PID: 2552)
      • 7nk6sX99.exe (PID: 2288)

    • Checks proxy server information

      • AppLaunch.exe (PID: 2732)
      • 6Yu0yv6.exe (PID: 364)
      • explothe.exe (PID: 2552)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 2732)
      • 6Yu0yv6.exe (PID: 364)
      • AppLaunch.exe (PID: 2904)
      • explothe.exe (PID: 2552)

    • Reads Environment values

      • AppLaunch.exe (PID: 2904)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)

    • Creates files or folders in the user directory

      • explothe.exe (PID: 2552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(2552) explothe.exe
C2 (1)http://77.91.124.1
Version3.89
Options
Drop directoryS-%lu-
Drop name%-lu
Strings (120)-%lu
fefffe8cea
explothe.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"
shutdown -s -t 0
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:25 00:49:06+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 1576960
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
44
Malicious processes
14
Suspicious processes
2

Behavior graph

Click at the process to see the details
start inject efa4cd8325e4546ab260ea774d4acc23.exe no specs ah9rj51.exe no specs ji0pj27.exe no specs ct6iv81.exe no specs ma7je31.exe no specs bw6ym19.exe no specs 1hm21tr6.exe no specs applaunch.exe no specs applaunch.exe no specs 2ol9662.exe no specs #STEALC applaunch.exe 3vx66mt.exe no specs 4uq064no.exe no specs #REDLINE applaunch.exe 5hn7oa1.exe no specs #AMADEY explothe.exe 6yu0yv6.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs 7nk6sx99.exe no specs cmd.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe explothe.exe no specs #SMOKE explorer.exe rundll32.exe no specs explothe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364C:\Users\admin\AppData\Local\Temp\IXP001.TMP\6Yu0yv6.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\6Yu0yv6.exe
aH9RJ51.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\6yu0yv6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
584C:\Users\admin\AppData\Local\Temp\IXP005.TMP\1hM21tr6.exeC:\Users\admin\AppData\Local\Temp\IXP005.TMP\1hM21tr6.exe—Bw6ym19.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp005.tmp\1hm21tr6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
776"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform/C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
848C:\Users\admin\AppData\Local\Temp\IXP004.TMP\3VX66MT.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\3VX66MT.exe—Ma7jE31.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp004.tmp\3vx66mt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1160"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/C:\Program Files\Internet Explorer\iexplore.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
1532C:\Users\admin\AppData\Local\Temp\IXP004.TMP\Bw6ym19.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\Bw6ym19.exe—Ma7jE31.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp004.tmp\bw6ym19.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1560"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login/C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
1788CACLS "..\fefffe8cea" /P "admin:R" /EC:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1844CACLS "explothe.exe" /P "admin:R" /EC:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
21 492
Read events
21 101
Write events
378
Delete events
13

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(2732) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2732) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2732) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2732) AppLaunch.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1944) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2280) 5hN7oa1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2280) 5hN7oa1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2280) 5hN7oa1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2280) 5hN7oa1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
15
Suspicious files
13
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
2600aH9RJ51.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Ji0Pj27.exeexecutable
MD5:1CD90FB9375FB2205C7E36B6B645F39B
SHA256:33DCB3FAE55DF01C19200C60C8D424E19A25889CE639E06A040A4DE8888351ED
2584efa4cd8325e4546ab260ea774d4acc23.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\aH9RJ51.exeexecutable
MD5:0CF45C2D5822875C8FA0FB131BD72C95
SHA256:800CDD9F0B87D50E9C41E3A26121E3D6EF9FFB570EF24D90DA1EFD785C32E225
2520ct6Iv81.exeC:\Users\admin\AppData\Local\Temp\IXP003.TMP\Ma7jE31.exeexecutable
MD5:D5D6BE6AB582CC557309B0A200090D8B
SHA256:11E3D2237B5BCC602863776422A9F79121EE251754130307B75025DBF040B201
2348Ma7jE31.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\3VX66MT.exeexecutable
MD5:E9AD50B051131C3628CA79E199F814F9
SHA256:93476B5EAC68FC42419E8ECC11E6A4B2C38E1A5EB0B4A774C4A32E17D3954082
2584efa4cd8325e4546ab260ea774d4acc23.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\7nk6sX99.exeexecutable
MD5:0BB618B2E6FBF795A92999757A0B1F67
SHA256:FA3935773AD5D735782E9958E09BCE6D79C73221879AE928657ADE6A69156AF0
2944Ji0Pj27.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\5hN7oa1.exeexecutable
MD5:0D2734A7C08F90B55C8FD59E04F0DE2B
SHA256:5961ACC483022B942535F3CBEB957EDF2AE50C6A0913DF48B55CF904CBE099F4
1532Bw6ym19.exeC:\Users\admin\AppData\Local\Temp\IXP005.TMP\1hM21tr6.exeexecutable
MD5:5F0632D60D00F8F6AB677EE7F8727416
SHA256:7247D13084EEA57E8D80D6FDB483BB8EC4AD8A96C846E9C1193390829DAEB08D
2348Ma7jE31.exeC:\Users\admin\AppData\Local\Temp\IXP004.TMP\Bw6ym19.exeexecutable
MD5:9B54369085A8853EB58359D2DBCF8B15
SHA256:47242A710C483418C6F5A45F4505F7F08D48F069D0FCA08008E7FE9690F1C76B
2600aH9RJ51.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\6Yu0yv6.exeexecutable
MD5:62EF5C5C97DAEF81B39B2E7800092028
SHA256:7EA20849A4997D0121AC7FC1F0B4B282C456AE65545CA7DC3CCF24166B31C214
2944Ji0Pj27.exeC:\Users\admin\AppData\Local\Temp\IXP002.TMP\ct6Iv81.exeexecutable
MD5:A89740E3C02B89F0A55A8BC3CEBAC218
SHA256:7B66A49AE740200359446947C45C55F8EB2F551A0DDE4A44ACFA5776D47BB437
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
239
DNS requests
27
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2552
explothe.exe
POST
200
77.91.124.1:80
http://77.91.124.1/theme/index.php
unknown
text
6 b
unknown
364
6Yu0yv6.exe
POST
200
193.233.255.73:80
http://193.233.255.73/loghub/master
unknown
text
8 b
unknown
2732
AppLaunch.exe
POST
200
193.233.255.73:80
http://193.233.255.73/loghub/master
unknown
text
8 b
unknown
1944
explorer.exe
POST
404
77.91.68.29:80
http://77.91.68.29/fks/
unknown
binary
7 b
unknown
2552
explothe.exe
GET
200
77.91.124.1:80
http://77.91.124.1/theme/Plugins/clip64.dll
unknown
executable
89.0 Kb
unknown
2552
explothe.exe
GET
404
77.91.124.1:80
http://77.91.124.1/theme/Plugins/cred64.dll
unknown
html
273 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2732
AppLaunch.exe
193.233.255.73:80
—
LLC Baxet
RU
malicious
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
364
6Yu0yv6.exe
193.233.255.73:80
—
LLC Baxet
RU
malicious
2904
AppLaunch.exe
77.91.124.86:19084
—
Foton Telecom CJSC
RU
malicious
2552
explothe.exe
77.91.124.1:80
—
Foton Telecom CJSC
RU
unknown
2264
iexplore.exe
157.240.0.35:443
www.facebook.com
FACEBOOK
US
unknown
2264
iexplore.exe
142.250.185.77:443
accounts.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.facebook.com
  • 157.240.0.35
whitelisted
accounts.google.com
  • 142.250.185.77
shared
www.gstatic.com
  • 142.250.184.227
whitelisted
store.steampowered.com
  • 184.30.20.74
whitelisted
fonts.gstatic.com
  • 142.250.185.99
whitelisted
twitter.com
  • 104.244.42.1
  • 104.244.42.193
  • 104.244.42.65
  • 104.244.42.129
whitelisted
www.epicgames.com
  • 34.206.130.105
  • 52.0.122.33
  • 18.232.241.205
  • 54.221.225.92
  • 184.72.173.149
  • 18.235.28.127
  • 34.203.168.32
  • 3.224.236.2
whitelisted
steamcommunity.com
  • 104.64.126.192
whitelisted
store.akamai.steamstatic.com
  • 193.108.153.29
  • 193.108.153.27
whitelisted
www.google.com
  • 142.250.185.164
whitelisted

Threats

PID
Process
Class
Message
2732
AppLaunch.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)
2732
AppLaunch.exe
A Network Trojan was detected
STEALER [ANY.RUN] Win32/Stealc (Check-In)
2732
AppLaunch.exe
Potentially Bad Traffic
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
2904
AppLaunch.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
2904
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
2904
AppLaunch.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
2904
AppLaunch.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
2552
explothe.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Check-In
2552
explothe.exe
A Network Trojan was detected
AV TROJAN Agent.DHOA System Info Exfiltration
2552
explothe.exe
A Network Trojan was detected
ET MALWARE Win32/Amadey Bot Activity (POST) M2
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
efa4cd8325e4546ab260ea774d4acc23