File name:

CS2.Bhop.exe

Full analysis: https://app.any.run/tasks/8d8f8c45-967c-468e-96ed-2e21cd54fab5
Verdict: Malicious activity
Analysis date: November 13, 2024, 16:46:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

6F9758A0A1EFC422F2F2F9CAFEA719FB

SHA1:

5BB110F31C4796373B9A3118CC988D4922798767

SHA256:

C65940B9C0293BB48CEA7B6BD037E21B51438F3742FF825E93A1B04CB21EDC6D

SSDEEP:

98304:JIyDPrEddwfpIclaLYvI9yf+8Gm11Syu4YJbebWn7CvlpaMh3pmV4Cssw/EelmPD:pjZQ8AOkm6k6P43uvnjqB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • CS2.Bhop.exe (PID: 6624)

    • Executable content was dropped or overwritten

      • CS2.Bhop.exe (PID: 6624)

    • The process drops C-runtime libraries

      • CS2.Bhop.exe (PID: 6624)

    • Process drops python dynamic module

      • CS2.Bhop.exe (PID: 6624)

    • Loads Python modules

      • CS2.Bhop.exe (PID: 5832)

    • Application launched itself

      • CS2.Bhop.exe (PID: 6624)

  • INFO

    • Create files in a temporary directory

      • CS2.Bhop.exe (PID: 6624)

    • Checks supported languages

      • CS2.Bhop.exe (PID: 6624)
      • CS2.Bhop.exe (PID: 5832)

    • Reads the computer name

      • CS2.Bhop.exe (PID: 6624)
      • CS2.Bhop.exe (PID: 5832)

    • Creates files or folders in the user directory

      • CS2.Bhop.exe (PID: 5832)

    • PyInstaller has been detected (YARA)

      • CS2.Bhop.exe (PID: 6624)

    • Checks proxy server information

      • CS2.Bhop.exe (PID: 5832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:11:03 07:16:16+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 176640
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc320
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.2.0
ProductVersionNumber: 1.0.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ItsJesewe
FileDescription: CS2 Bhop
FileVersion: 1.0.2.0
InternalName: CS2 Bhop
LegalCopyright: © ItsJesewe. MIT License.
OriginalFileName: CS2 Bhop.exe
ProductName: CS2 Bhop
ProductVersion: 1.0.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT cs2.bhop.exe conhost.exe no specs cs2.bhop.exe

Process information

PID
CMD
Path
Indicators
Parent process
5832"C:\Users\admin\AppData\Local\Temp\CS2.Bhop.exe" C:\Users\admin\AppData\Local\Temp\CS2.Bhop.exe
CS2.Bhop.exe
User:
admin
Company:
ItsJesewe
Integrity Level:
MEDIUM
Description:
CS2 Bhop
Version:
1.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\cs2.bhop.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6216\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CS2.Bhop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6624"C:\Users\admin\AppData\Local\Temp\CS2.Bhop.exe" C:\Users\admin\AppData\Local\Temp\CS2.Bhop.exe
explorer.exe
User:
admin
Company:
ItsJesewe
Integrity Level:
MEDIUM
Description:
CS2 Bhop
Version:
1.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\cs2.bhop.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
440
Read events
440
Write events
0
Delete events
0

Modification events

No data
Executable files
28
Suspicious files
1
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_queue.pydexecutable
MD5:7D91DD8E5F1DBC3058EA399F5F31C1E6
SHA256:76BBA42B1392DC57A867AEF385B990FA302A4F1DCF453705AC119C9C98A36E8D
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_brotli.cp312-win_amd64.pydexecutable
MD5:9AD5BB6F92EE2CFD29DDE8DD4DA99EB7
SHA256:788ACBFD0EDD6CA3EF3E97A9487EEAEA86515642C71CB11BBCF25721E6573EC8
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_bz2.pydexecutable
MD5:DD26ED92888DE9C57660A7AD631BB916
SHA256:324268786921EC940CBD4B5E2F71DAFD08E578A12E373A715658527E5B211697
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\importlib_metadata-8.5.0.dist-info\INSTALLERtext
MD5:365C9BFEB7D89244F2CE01C1DE44CB85
SHA256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_lzma.pydexecutable
MD5:8CFBAFE65D6E38DDE8E2E8006B66BB3E
SHA256:6D548DB0AB73291F82CF0F4CA9EC0C81460185319C8965E829FAEACAE19444FF
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_asyncio.pydexecutable
MD5:CC0F232F2A8A359DEE29A573667E6D77
SHA256:7A5C88CE496BAFDF31A94AE6D70B017070703BC0A7DA1DFAE7C12B21BB61030D
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\charset_normalizer\md__mypyc.cp312-win_amd64.pydexecutable
MD5:BF9A9DA1CF3C98346002648C3EAE6DCF
SHA256:4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\certifi\cacert.pemtext
MD5:181AC9A809B1A8F1BC39C1C5C777CF2A
SHA256:488BA960602BF07CC63F4EF7AEC108692FEC41820FC3328A8E3F3DE038149AEE
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_hashlib.pydexecutable
MD5:D19CB5CA144AE1FD29B6395B0225CF40
SHA256:F95EC2562A3C70FB1A6E44D72F4223CE3C7A0F0038159D09DCE629F59591D5AA
6624CS2.Bhop.exeC:\Users\admin\AppData\Local\Temp\_MEI66242\_decimal.pydexecutable
MD5:CEA3B419C7CA87140A157629C6DBD299
SHA256:95B9850E6FB335B235589DD1348E007507C6B28E332C9ABB111F2A0035C358E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7112
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5640
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5832
CS2.Bhop.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
shared
5832
CS2.Bhop.exe
140.82.121.6:443
api.github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
shared
api.github.com
  • 140.82.121.6
whitelisted
www.bing.com
  • 2.23.209.188
  • 2.23.209.141
  • 2.23.209.137
  • 2.23.209.185
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.192
  • 2.23.209.183
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.134
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.76
whitelisted
th.bing.com
  • 2.23.209.154
  • 2.23.209.150
  • 2.23.209.161
  • 2.23.209.144
  • 2.23.209.141
  • 2.23.209.156
  • 2.23.209.158
  • 2.23.209.137
  • 2.23.209.149
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CS2.Bhop.exe