Analysis date (UTC): 1 September 2025, 15:15Analysis environment: Windows 10 Pro, build 19044, x64

https://github.com/bepass-org/oblivion-desktop/releases/download/v3.0.0/oblivion-desktop-win-x64.exe

MD5:45C0B8A7B1804853A320BF272D3C18EC

SHA1:A970C0CDD2D1762A20E02D867A6150F0AF2E3ED1

SHA256:B3C58674968EF9A19B9049C6D57578B79AF1FE786B8FE9DD27A91770DA8D3042

Analysis result

Threat level:Malicious activity

Tags:

githubevasionnodejsanti-evasion

Full analysis:Analysis https://github.com/bepass-org/oblivion-desktop/releases/download/v3.0.0/oblivion-desktop-win-x64.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes powershell execution policy (Unrestricted)

oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 5724)

Opens a text file (SCRIPT)

cscript.exe (PID: 4380)
cscript.exe (PID: 7736)
cscript.exe (PID: 7268)

Changes the autorun value in the registry

oblivion-desktop.exe (PID: 2108)

Antivirus name has been found in the command line (generic signature)

proxy-reset.exe (PID: 5524)

SUSPICIOUS

Malware-specific behavior (creating "System.dll" in Temp)

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)

Executable content was dropped or overwritten

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)
oblivion-desktop.exe (PID: 5548)

Reads security settings of Internet Explorer

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)

The process creates files with name similar to system file names

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)

Application launched itself

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 6736)
oblivion-desktop.exe (PID: 2108)
updater.exe (PID: 4156)
oblivion-desktop.exe (PID: 5724)

Drops 7-zip archiver for unpacking

oblivion-desktop-win-x64.exe (PID: 72)

There is functionality for taking screenshot (YARA)

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)
oblivion-desktop.exe (PID: 7588)

Process drops legitimate windows executable

oblivion-desktop-win-x64.exe (PID: 72)

Creates a software uninstall entry

oblivion-desktop-win-x64.exe (PID: 72)

Starts application with an unusual extension

cmd.exe (PID: 6236)
cmd.exe (PID: 4088)
cmd.exe (PID: 804)

Starts CMD.EXE for commands execution

NETSTAT.EXE (PID: 6524)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 2108)
NETSTAT.EXE (PID: 5504)
NETSTAT.EXE (PID: 1936)
oblivion-desktop.exe (PID: 5724)
NETSTAT.EXE (PID: 6236)
NETSTAT.EXE (PID: 6952)

Uses ROUTE.EXE to obtain the routing table information

cmd.exe (PID: 6868)
cmd.exe (PID: 1136)
cmd.exe (PID: 1568)
cmd.exe (PID: 6256)
cmd.exe (PID: 6784)

Get information on the list of running processes

oblivion-desktop.exe (PID: 5548)
cmd.exe (PID: 1336)

Checks for external IP

oblivion-desktop.exe (PID: 3656)
oblivion-desktop.exe (PID: 7628)
oblivion-desktop.exe (PID: 6388)

Using 'findstr.exe' to search for text patterns in files and output

cmd.exe (PID: 8108)
cmd.exe (PID: 4856)
cmd.exe (PID: 6664)
cmd.exe (PID: 6284)

The process hides Powershell's copyright startup banner

oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 5724)

Uses NETSH.EXE to obtain data on the network

cmd.exe (PID: 6736)
cmd.exe (PID: 6732)

The process bypasses the loading of PowerShell profile settings

oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 5724)

Starts POWERSHELL.EXE for commands execution

oblivion-desktop.exe (PID: 2108)
cmd.exe (PID: 5724)
oblivion-desktop.exe (PID: 5724)
cmd.exe (PID: 7164)

Creates FileSystem object to access computer's file system (SCRIPT)

cscript.exe (PID: 4380)
cscript.exe (PID: 7736)
cscript.exe (PID: 7268)

Writes binary data to a Stream object (SCRIPT)

cscript.exe (PID: 4380)

Gets full path of the running script (SCRIPT)

cscript.exe (PID: 4380)
cscript.exe (PID: 7736)
cscript.exe (PID: 7268)

Reads data from a binary Stream object (SCRIPT)

cscript.exe (PID: 4380)
cscript.exe (PID: 7736)
cscript.exe (PID: 7268)

The process executes via Task Scheduler

updater.exe (PID: 4156)
PLUGScheduler.exe (PID: 4148)

SQL CE related mutex has been found

powershell.exe (PID: 6356)
powershell.exe (PID: 7100)

Uses REG/REGEDIT.EXE to modify registry

proxy-reset.exe (PID: 5524)

Process uses IPCONFIG to discover network configuration

cmd.exe (PID: 7492)
cmd.exe (PID: 6992)

PowerShell delay command usage (probably sleep evasion)

powershell.exe (PID: 7100)
powershell.exe (PID: 6356)

INFO

Executable content was dropped or overwritten

msedge.exe (PID: 1392)

Application launched itself

msedge.exe (PID: 1392)
msedge.exe (PID: 2216)

Reads Environment values

identity_helper.exe (PID: 7556)
identity_helper.exe (PID: 8168)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 5724)

Reads the computer name

identity_helper.exe (PID: 7556)
oblivion-desktop-win-x64.exe (PID: 7740)
identity_helper.exe (PID: 8168)
oblivion-desktop-win-x64.exe (PID: 72)
oblivion-desktop.exe (PID: 6832)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 3656)
oblivion-desktop.exe (PID: 7588)
oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 7628)
usque.exe (PID: 5500)
usque.exe (PID: 4060)
updater.exe (PID: 4156)
PLUGScheduler.exe (PID: 4148)
oblivion-desktop.exe (PID: 5724)
oblivion-desktop.exe (PID: 6356)
oblivion-desktop.exe (PID: 6388)
usque.exe (PID: 6284)

Create files in a temporary directory

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 5724)

Checks supported languages

identity_helper.exe (PID: 8168)
identity_helper.exe (PID: 7556)
oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)
oblivion-desktop.exe (PID: 5548)
chcp.com (PID: 3580)
oblivion-desktop.exe (PID: 6832)
oblivion-desktop.exe (PID: 4020)
oblivion-desktop.exe (PID: 3656)
oblivion-desktop.exe (PID: 6736)
oblivion-desktop.exe (PID: 2108)
chcp.com (PID: 3960)
oblivion-desktop.exe (PID: 7628)
oblivion-desktop.exe (PID: 3640)
oblivion-desktop.exe (PID: 7588)
masque-plus.exe (PID: 6288)
oblivion-desktop.exe (PID: 320)
usque.exe (PID: 5500)
usque.exe (PID: 4060)
PLUGScheduler.exe (PID: 4148)
updater.exe (PID: 4156)
updater.exe (PID: 5016)
proxy-reset.exe (PID: 5524)
oblivion-desktop.exe (PID: 5724)
chcp.com (PID: 5460)
oblivion-desktop.exe (PID: 6356)
oblivion-desktop.exe (PID: 6544)
oblivion-desktop.exe (PID: 6388)
oblivion-desktop.exe (PID: 5736)
masque-plus.exe (PID: 6928)
usque.exe (PID: 6284)

Process checks computer location settings

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 4020)
oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 3640)
oblivion-desktop.exe (PID: 5724)
oblivion-desktop.exe (PID: 6544)

The sample compiled with english language support

oblivion-desktop-win-x64.exe (PID: 7740)
oblivion-desktop-win-x64.exe (PID: 72)

Creates files in the program directory

oblivion-desktop-win-x64.exe (PID: 72)
PLUGScheduler.exe (PID: 4148)

Creates files or folders in the user directory

oblivion-desktop-win-x64.exe (PID: 72)
oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 3656)
oblivion-desktop.exe (PID: 2108)
usque.exe (PID: 5500)
oblivion-desktop.exe (PID: 5724)
oblivion-desktop.exe (PID: 6388)

Reads product name

oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 5724)

Manual execution by a user

oblivion-desktop.exe (PID: 5548)
proxy-reset.exe (PID: 5524)
oblivion-desktop.exe (PID: 5724)

Changes the display of characters in the console

cmd.exe (PID: 6236)
cmd.exe (PID: 4088)
cmd.exe (PID: 804)

Prints a route via ROUTE.EXE

ROUTE.EXE (PID: 3108)
ROUTE.EXE (PID: 700)
ROUTE.EXE (PID: 1520)
ROUTE.EXE (PID: 6272)
ROUTE.EXE (PID: 6788)

Checks proxy server information

oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 2108)
slui.exe (PID: 7196)
powershell.exe (PID: 6356)
reg.exe (PID: 3996)
oblivion-desktop.exe (PID: 5724)
powershell.exe (PID: 7100)

Reads the machine GUID from the registry

oblivion-desktop.exe (PID: 5548)
oblivion-desktop.exe (PID: 2108)
usque.exe (PID: 5500)
oblivion-desktop.exe (PID: 5724)

Reads security settings of Internet Explorer

cscript.exe (PID: 4380)
cscript.exe (PID: 7736)
cscript.exe (PID: 7268)
cscript.exe (PID: 6276)
cscript.exe (PID: 6884)

Node.js compiler has been detected

oblivion-desktop.exe (PID: 2108)
oblivion-desktop.exe (PID: 7588)
oblivion-desktop.exe (PID: 7628)

Launching a file from a Registry key

oblivion-desktop.exe (PID: 2108)

Reads the software policy settings

slui.exe (PID: 7196)
usque.exe (PID: 5500)

Process checks whether UAC notifications are on

updater.exe (PID: 4156)

Threats

PID	Process	Class	Message
2432	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access release user assets on GitHub
3656	oblivion-desktop.exe	Potentially Bad Traffic	ET INFO External IP Lookup Domain DNS Lookup (my-ip .io)
3656	oblivion-desktop.exe	Potentially Bad Traffic	ET INFO External IP Lookup Domain DNS Lookup (my-ip .io)
7628	oblivion-desktop.exe	Potentially Bad Traffic	ET INFO External IP Lookup Domain DNS Lookup (my-ip .io)
7628	oblivion-desktop.exe	Potentially Bad Traffic	ET INFO External IP Lookup Domain DNS Lookup (my-ip .io)
4060	usque.exe	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
4060	usque.exe	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
4060	usque.exe	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
4060	usque.exe	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
4060	usque.exe	Generic Protocol Command Decode	SURICATA QUIC failed decrypt

Rows per page