File name:

c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe

Full analysis: https://app.any.run/tasks/fbcf453e-b8f4-45d6-8ca0-39031c8418b2
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: October 03, 2025, 17:00:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sfuzuan
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

7DC938629B68A466C3239DC1A7B2B311

SHA1:

6CF1A0F023D54F0F83205B117284DAD3A034498E

SHA256:

C7571D55C36ED2C2CCE16D8A0F6B6C0FFE91422D53D5F2AD25DD761463B8FE1A

SSDEEP:

6144:zJ1nGDwv1tjCtJQVXNY1gFrkcLezOOrTUrW6Ov03lWCjw0FSP1RDnRseya5Iv06T:CU74E9YGRj5OrTUrXWt00LmemdYs746

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SFUZUAN mutex has been found

      • 45347ba (PID: 8084)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)

    • SFUZUAN has been detected (SURICATA)

      • svchost.exe (PID: 2428)

    • Connects to the CnC server

      • svchost.exe (PID: 2428)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)
      • 45347ba (PID: 8084)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)

    • Reads the date of Windows installation

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)

    • Application launched itself

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)

    • Executable content was dropped or overwritten

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)

    • Executes as Windows Service

      • 45347ba (PID: 8084)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2428)

  • INFO

    • Reads the computer name

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)
      • 45347ba (PID: 8084)

    • The sample compiled with chinese language support

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)

    • Checks supported languages

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)
      • 45347ba (PID: 8084)

    • Process checks computer location settings

      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2268)

    • Reads the machine GUID from the registry

      • 45347ba (PID: 8084)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)

    • Reads the software policy settings

      • 45347ba (PID: 8084)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)
      • slui.exe (PID: 4964)

    • Checks proxy server information

      • slui.exe (PID: 4964)
      • c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:02:13 22:56:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 145408
InitializedDataSize: 236544
UninitializedDataSize: -
EntryPoint: 0x1317f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 23.9.20.1611
ProductVersionNumber: 23.9.20.1611
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 23, 9, 20, 1611
ProductVersion: 23, 9, 20, 1611
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2268"C:\Users\admin\Desktop\c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe" C:\Users\admin\Desktop\c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
23, 9, 20, 1611
Modules
Images
c:\users\admin\desktop\c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2980"C:\Users\admin\Desktop\c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe" C:\Users\admin\Desktop\c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe
c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe
User:
admin
Integrity Level:
HIGH
Version:
23, 9, 20, 1611
Modules
Images
c:\users\admin\desktop\c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4964C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8084C:\Windows\Syswow64\45347baC:\Windows\SysWOW64\45347ba
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
23, 9, 20, 1611
Modules
Images
c:\windows\syswow64\45347ba
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
12 440
Read events
12 429
Write events
11
Delete events
0

Modification events

(PID) Process:(2268) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2268) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2268) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2268) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2980) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2980) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2980) c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2980c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeC:\Windows\SysWOW64\45347baexecutable
MD5:921E70F2E82BE04E87F3E57F4CB808E9
SHA256:B2BA39410F5CA0673262C3C041AAA58B0161B1B1B369378767AA9026685A8FFC
808445347baC:\Windows\8a66a8text
MD5:D0CB6EAB6E089ADE58BB1923FB2D221E
SHA256:AF9EE019D866FF3AA729473F30C1DA3C19E1F00D8689DDE4372DF5F1E6E07345
2980c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exeC:\Windows\3304c8text
MD5:0537A70609ECD3690F5A3E6BC80E78AF
SHA256:4CFB83C38C79A176EAC9F0F4116D0E884056872E380B51D08D2889B39A105791
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
271
TCP/UDP connections
369
DNS requests
61
Threats
89

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
223.6.6.6:443
https://dns.alidns.com/resolve?name=down.nugong.asia&type=1
CN
binary
257 b
unknown
8084
45347ba
GET
200
223.6.6.6:80
http://dns.alidns.com/resolve?name=down.nugong.asia&type=1
CN
binary
257 b
whitelisted
8084
45347ba
GET
200
223.5.5.5:80
http://223.5.5.5/resolve?name=down.nugong.asia&type=1
CN
binary
257 b
whitelisted
8084
45347ba
GET
200
223.6.6.6:80
http://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16
CN
binary
255 b
whitelisted
8084
45347ba
GET
200
223.6.6.6:80
http://dns.alidns.com/resolve?name=spi2.tyui54345.xyz&type=16
CN
binary
255 b
whitelisted
—
—
GET
200
223.6.6.6:443
https://dns.alidns.com/resolve?name=spi2.tyui54345.xyz&type=16
CN
binary
255 b
unknown
8084
45347ba
GET
200
223.5.5.5:80
http://223.5.5.5/resolve?name=spi1.tyui54345.xyz&type=16
CN
binary
255 b
whitelisted
8084
45347ba
GET
200
223.5.5.5:80
http://223.5.5.5/resolve?name=spi2.tyui54345.xyz&type=16
CN
binary
255 b
whitelisted
—
—
POST
204
2.16.204.153:443
https://www.bing.com/web/xlsc.aspx?t=5&dl=1&wsbc=1
unknown
—
—
unknown
—
—
GET
200
2.16.204.153:443
https://www.bing.com/DSB/search?dsbmr=1&format=dsbjson&client=windowsminiserp&dsbschemaversion=1.1&dsbminiserp=1&q=q&cc=US&setlang=en-us&clientDateTime=10%2F3%2F2025%2C%205%3A00%3A51%20PM
unknown
binary
64.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3984
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6016
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
8084
45347ba
223.6.6.6:443
dns.alidns.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
whitelisted
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8084
45347ba
223.6.6.6:80
dns.alidns.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
whitelisted
5948
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8084
45347ba
223.5.5.5:443
dns.alidns.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
whitelisted
8084
45347ba
223.5.5.5:80
dns.alidns.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
down.nugong.asia
  • —
unknown
dns.alidns.com
  • 223.6.6.6
  • 223.5.5.5
whitelisted
www.bing.com
  • 2.16.204.146
  • 2.16.204.145
  • 2.16.204.144
  • 2.16.204.138
  • 2.16.204.143
  • 2.16.204.147
  • 2.16.204.142
  • 2.16.204.141
  • 2.16.204.137
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.131
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.129
  • 40.126.31.130
  • 20.190.159.130
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
down.xy58.top
  • —
unknown
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted

Threats

PID
Process
Class
Message
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
8084
45347ba
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
8084
45347ba
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c7571d55c36ed2c2cce16d8a0f6b6c0ffe91422d53d5f2ad25dd761463b8fe1a.exe