File name:

d5f6e39b19e5b45d9953d4cb1401cc51.exe

Full analysis: https://app.any.run/tasks/f5025f6d-d2a7-4204-ab91-baf3733a073b
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: March 25, 2025, 05:44:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
loader
themida
rdp
auto
generic
gcleaner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

D5F6E39B19E5B45D9953D4CB1401CC51

SHA1:

C20F5112E5C6743247C3AA2939BBAC098E7DF551

SHA256:

BC1F7CA5B344AC935361475D3A386CA9C17AE5B856E1028622D2A7131D6EB666

SSDEEP:

98304:c3VyIA1tBjSlefO5YTcAEJm4IAiKG5lRIePIr5RFReQgf7tOe4EtEvEam3jg/vi8:S30

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AMADEY has been detected (SURICATA)

      • rapes.exe (PID: 7232)
    • Connects to the CnC server

      • rapes.exe (PID: 7232)
    • AMADEY mutex has been found

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • rapes.exe (PID: 4560)
      • rapes.exe (PID: 6676)
    • GENERIC has been found (auto)

      • b09382ff8a.exe (PID: 1056)
      • svchost015.exe (PID: 1184)
    • GCLEANER has been detected (YARA)

      • svchost015.exe (PID: 1184)
    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 1184)
    • AMADEY has been detected (YARA)

      • rapes.exe (PID: 7232)
  • SUSPICIOUS

    • Reads the BIOS version

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • b09382ff8a.exe (PID: 1056)
      • rapes.exe (PID: 4560)
      • rapes.exe (PID: 6676)
    • Reads security settings of Internet Explorer

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • svchost015.exe (PID: 1184)
    • Executable content was dropped or overwritten

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • b09382ff8a.exe (PID: 1056)
      • svchost015.exe (PID: 1184)
    • Starts itself from another location

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
    • Contacting a server suspected of hosting an CnC

      • rapes.exe (PID: 7232)
    • Connects to the server without a host name

      • rapes.exe (PID: 7232)
      • svchost015.exe (PID: 1184)
    • Process requests binary or script from the Internet

      • rapes.exe (PID: 7232)
    • Potential Corporate Privacy Violation

      • rapes.exe (PID: 7232)
      • svchost015.exe (PID: 1184)
    • There is functionality for enable RDP (YARA)

      • rapes.exe (PID: 7232)
    • The process executes via Task Scheduler

      • rapes.exe (PID: 4560)
      • rapes.exe (PID: 6676)
  • INFO

    • Reads the computer name

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • svchost015.exe (PID: 1184)
      • b09382ff8a.exe (PID: 1056)
    • Checks supported languages

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • b09382ff8a.exe (PID: 1056)
      • svchost015.exe (PID: 1184)
      • rapes.exe (PID: 4560)
      • rapes.exe (PID: 6676)
    • Process checks computer location settings

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
    • Create files in a temporary directory

      • d5f6e39b19e5b45d9953d4cb1401cc51.exe (PID: 496)
      • rapes.exe (PID: 7232)
      • b09382ff8a.exe (PID: 1056)
      • svchost015.exe (PID: 1184)
    • Checks proxy server information

      • rapes.exe (PID: 7232)
      • BackgroundTransferHost.exe (PID: 4040)
      • svchost015.exe (PID: 1184)
    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8064)
      • BackgroundTransferHost.exe (PID: 4040)
      • BackgroundTransferHost.exe (PID: 7692)
      • BackgroundTransferHost.exe (PID: 5552)
      • BackgroundTransferHost.exe (PID: 8072)
    • Creates files or folders in the user directory

      • rapes.exe (PID: 7232)
      • BackgroundTransferHost.exe (PID: 4040)
      • svchost015.exe (PID: 1184)
    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 4040)
      • slui.exe (PID: 7412)
    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 1184)
    • Themida protector has been detected

      • rapes.exe (PID: 7232)
    • The sample compiled with english language support

      • b09382ff8a.exe (PID: 1056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(7232) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)ps1
og:
r=
------
.jpg
rundll32.exe
GET
/Ni9kiput/index.php
<c>
WinDefender
&&
pc:
wb
Norton
rapes.exe
ProgramData\
rundll32
Powershell.exe
/k
kernel32.dll
Sophos
random
POST
cred.dll|clip.dll|
#
un:
Bitdefender
cred.dll
/Plugins/
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
e3
2019
00000419
Kaspersky Lab
st=s
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
ar:
bi:
Content-Type: multipart/form-data; boundary=----
+++
Startup
Avira
ESET
" && ren
msi
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
bb556cff4a
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
2025
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
00000422
lv:
e2
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dm:
AVG
DefaultSettings.YResolution
clip.dll
&unit=
AVAST Software
exe
http://
Keyboard Layout\Preload
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
5.21
-unicode-
-executionpolicy remotesigned -File "
ComputerName
2022
--
vs:
\
sd:
d1
S-%lu-
" Content-Type: application/octet-stream
%-lu
GetNativeSystemInfo
176.113.115.6
&& Exit"
Content-Type: application/x-www-form-urlencoded
/quiet
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
00000423
Rem
zip
\App
2016
"
0000043f
os:
cmd
id:
av:
-%lu
DefaultSettings.XResolution
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:23 11:06:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 324096
InitializedDataSize: 115200
UninitializedDataSize: -
EntryPoint: 0x4c2000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
14
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start d5f6e39b19e5b45d9953d4cb1401cc51.exe #AMADEY rapes.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe #GENERIC b09382ff8a.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #GCLEANER svchost015.exe rapes.exe no specs slui.exe no specs rapes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Users\admin\AppData\Local\Temp\d5f6e39b19e5b45d9953d4cb1401cc51.exe" C:\Users\admin\AppData\Local\Temp\d5f6e39b19e5b45d9953d4cb1401cc51.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\d5f6e39b19e5b45d9953d4cb1401cc51.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1056"C:\Users\admin\AppData\Local\Temp\10328690101\b09382ff8a.exe" C:\Users\admin\AppData\Local\Temp\10328690101\b09382ff8a.exe
rapes.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
2, 0, 4, 0
Modules
Images
c:\users\admin\appdata\local\temp\10328690101\b09382ff8a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1184"C:\Users\admin\AppData\Local\Temp\10328690101\b09382ff8a.exe" C:\Users\admin\AppData\Local\Temp\svchost015.exe
b09382ff8a.exe
User:
admin
Company:
X-Ways Software Technology AG
Integrity Level:
MEDIUM
Description:
WinHex
Exit code:
0
Version:
21.1
Modules
Images
c:\users\admin\appdata\local\temp\svchost015.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4040"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4560"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5552"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6676"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7232"C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe" C:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exe
d5f6e39b19e5b45d9953d4cb1401cc51.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\bb556cff4a\rapes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Amadey
(PID) Process(7232) rapes.exe
C2176.113.115.6
URLhttp://176.113.115.6/Ni9kiput/index.php
Version5.21
Options
Drop directorybb556cff4a
Drop namerapes.exe
Strings (125)ps1
og:
r=
------
.jpg
rundll32.exe
GET
/Ni9kiput/index.php
<c>
WinDefender
&&
pc:
wb
Norton
rapes.exe
ProgramData\
rundll32
Powershell.exe
/k
kernel32.dll
Sophos
random
POST
cred.dll|clip.dll|
#
un:
Bitdefender
cred.dll
/Plugins/
shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
|
Doctor Web
e3
2019
00000419
Kaspersky Lab
st=s
%USERPROFILE%
\0000
VideoID
CurrentBuild
dll
ar:
bi:
Content-Type: multipart/form-data; boundary=----
+++
Startup
Avira
ESET
" && ren
msi
------
Content-Disposition: form-data; name="data"; filename="
Main
<d>
bb556cff4a
SYSTEM\ControlSet001\Services\BasicDisplay\Video
360TotalSecurity
=
e1
rb
Comodo
?scr=1
Panda Security
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
" && timeout 1 && del
2025
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
0123456789
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Programs
00000422
lv:
e2
:::
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows NT\CurrentVersion
dm:
AVG
DefaultSettings.YResolution
clip.dll
&unit=
AVAST Software
exe
http://
Keyboard Layout\Preload
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
cmd /C RMDIR /s/q
https://
shutdown -s -t 0
5.21
-unicode-
-executionpolicy remotesigned -File "
ComputerName
2022
--
vs:
\
sd:
d1
S-%lu-
" Content-Type: application/octet-stream
%-lu
GetNativeSystemInfo
176.113.115.6
&& Exit"
Content-Type: application/x-www-form-urlencoded
/quiet
abcdefghijklmnopqrstuvwxyz0123456789-_
ProductName
"taskkill /f /im "
00000423
Rem
zip
\App
2016
"
0000043f
os:
cmd
id:
av:
-%lu
DefaultSettings.XResolution
7380C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7412"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 983
Read events
3 962
Write events
21
Delete events
0

Modification events

(PID) Process:(7232) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7232) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7232) rapes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8064) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8064) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8064) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4040) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5552) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
8
Suspicious files
11
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9e8960f1-93c6-48de-bf73-57a8a40b6726.down_data
MD5:
SHA256:
4040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:40530F15F92B2A0CB0699937E840664E
SHA256:58FD004C96BA35ACB62E4E39D2A20A1BC3A406FDF74549F51048EAB42833689B
496d5f6e39b19e5b45d9953d4cb1401cc51.exeC:\Users\admin\AppData\Local\Temp\bb556cff4a\rapes.exeexecutable
MD5:D5F6E39B19E5B45D9953D4CB1401CC51
SHA256:BC1F7CA5B344AC935361475D3A386CA9C17AE5B856E1028622D2A7131D6EB666
1056b09382ff8a.exeC:\Users\admin\AppData\Local\Temp\svchost015.exeexecutable
MD5:B826DD92D78EA2526E465A34324EBEEA
SHA256:7824B50ACDD144764DAC7445A4067B35CF0FEF619E451045AB6C1F54F5653A5B
1184svchost015.exeC:\Users\admin\AppData\Local\Temp\e2fwC3D4uY\Bunifu_UI_v1.5.3.dllexecutable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
1184svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\service[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
4040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4c064a1a-97d8-46bd-8097-aa48675f858d.de12f386-1442-43a6-bc93-c5cc369e4f8b.down_metabinary
MD5:0330C35F4647A7D99351F2AA0075BF7B
SHA256:75B099A9C0213B3AA21A386C0B274109C1BB939695775291E1B270839A98C463
1184svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\soft[1]executable
MD5:FC1E4DF340C9005E05B8BFC96CEC9E09
SHA256:0C68AFFA8190AF92AAC6B35099F3E67659C42F6BC854A7D764A3A448EFF2CB51
4040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
1184svchost015.exeC:\Users\admin\AppData\Local\Temp\e2fwC3D4uY\YCL.exeexecutable
MD5:FC1E4DF340C9005E05B8BFC96CEC9E09
SHA256:0C68AFFA8190AF92AAC6B35099F3E67659C42F6BC854A7D764A3A448EFF2CB51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
30
DNS requests
18
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
7232
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
malicious
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7232
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
malicious
7652
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
7232
rapes.exe
GET
200
176.113.115.7:80
http://176.113.115.7/files/martin2/random.exe
unknown
malicious
4040
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
1184
svchost015.exe
GET
200
185.156.73.98:80
http://185.156.73.98/success?substr=mixfour&s=three&sub=none
unknown
unknown
864
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7232
rapes.exe
POST
200
176.113.115.6:80
http://176.113.115.6/Ni9kiput/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7232
rapes.exe
176.113.115.6:80
Red Bytes LLC
RU
malicious
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.71
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.129
  • 40.126.31.0
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.19.122.29
  • 2.19.122.43
  • 2.19.122.38
  • 2.19.122.35
  • 2.19.122.47
  • 2.19.122.30
  • 2.19.122.42
  • 2.19.122.36
  • 2.19.122.44
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
7232
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
7232
rapes.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7232
rapes.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
7232
rapes.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7232
rapes.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
7232
rapes.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7232
rapes.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7232
rapes.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1184
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
1184
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info