File name:

steamtoolssetup.exe

Full analysis: https://app.any.run/tasks/6847effe-a645-4816-9a41-6b63a2f04610
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 24, 2025, 22:48:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
auto-startup
auto-reg
crypto-regex
xworm
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

69C7ADF3CDBC010EC49C5D70F18C2A1B

SHA1:

9C642BDF14D30B6D18E5CC7CB849F178B9FE2E87

SHA256:

C91FEC2BABA671461BC033211721C140D0337EAAA0A83092B4D83BAB2F9F9805

SSDEEP:

98304:nxMDn8E9v4E81lurz6yjL+etaegixgf3vYpeTWgxfRRReyTRoOOTIpVvym94y8Ud:Z7pKP/GUknIoPRL/yDcofHe0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • svchost.exe (PID: 7360)

    • Create files in the Startup directory

      • svchost.exe (PID: 7360)

    • XWORM has been detected

      • svchost.exe (PID: 7360)

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 7360)

    • XWORM has been detected (YARA)

      • svchost.exe (PID: 7360)

    • XWORM has been detected (SURICATA)

      • svchost.exe (PID: 7360)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • steamtoolssetup.exe (PID: 7308)
      • st-setup-1.8.16.exe (PID: 7492)
      • svchost.exe (PID: 7360)

    • The process creates files with name similar to system file names

      • steamtoolssetup.exe (PID: 7308)
      • st-setup-1.8.16.exe (PID: 7492)

    • Reads the date of Windows installation

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)

    • Reads security settings of Internet Explorer

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 7360)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • st-setup-1.8.16.exe (PID: 7492)

    • The process drops C-runtime libraries

      • st-setup-1.8.16.exe (PID: 7492)

    • Uses ICACLS.EXE to modify access control lists

      • st-setup-1.8.16.exe (PID: 7492)

    • Creates a software uninstall entry

      • st-setup-1.8.16.exe (PID: 7492)

    • Process drops legitimate windows executable

      • st-setup-1.8.16.exe (PID: 7492)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 7984)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 7360)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 8020)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 8020)

    • Connects to unusual port

      • svchost.exe (PID: 7360)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 7360)

    • There is functionality for taking screenshot (YARA)

      • SteamTools.exe (PID: 8124)

    • The process executes via Task Scheduler

      • svchost (PID: 7228)
      • svchost (PID: 6656)

  • INFO

    • Reads the machine GUID from the registry

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • svchost (PID: 7956)
      • svchost (PID: 7228)
      • svchost (PID: 6656)

    • Creates files or folders in the user directory

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • st-setup-1.8.16.exe (PID: 7492)

    • Checks supported languages

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • st-setup-1.8.16.exe (PID: 7492)
      • svchost (PID: 7956)
      • SteamTools.exe (PID: 8124)
      • svchost (PID: 7228)
      • svchost (PID: 6656)

    • Reads the computer name

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)
      • st-setup-1.8.16.exe (PID: 7492)
      • svchost (PID: 7956)
      • SteamTools.exe (PID: 8124)
      • svchost (PID: 7228)
      • svchost (PID: 6656)

    • Process checks computer location settings

      • steamtoolssetup.exe (PID: 7308)
      • svchost.exe (PID: 7360)

    • Create files in a temporary directory

      • st-setup-1.8.16.exe (PID: 7492)

    • Reads Environment values

      • svchost.exe (PID: 7360)

    • Checks proxy server information

      • svchost.exe (PID: 7360)
      • SteamTools.exe (PID: 8124)
      • slui.exe (PID: 1616)

    • Disables trace logs

      • svchost.exe (PID: 7360)

    • Creates files in the program directory

      • st-setup-1.8.16.exe (PID: 7492)

    • Auto-launch of the file from Registry key

      • svchost.exe (PID: 7360)

    • Auto-launch of the file from Startup directory

      • svchost.exe (PID: 7360)

    • Manual execution by a user

      • svchost (PID: 7956)

    • The sample compiled with english language support

      • st-setup-1.8.16.exe (PID: 7492)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 8020)

    • Reads the software policy settings

      • slui.exe (PID: 1616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(7360) svchost.exe
C2107.172.44.175:1889
Keys
AES012
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexThMjqUyKmaZXuLR3
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:22 22:29:36+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 8675840
InitializedDataSize: 83968
UninitializedDataSize: -
EntryPoint: 0x84818e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: steamtools setup.exe
LegalCopyright:
OriginalFileName: steamtools setup.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
20
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start steamtoolssetup.exe #XWORM svchost.exe st-setup-1.8.16.exe no specs st-setup-1.8.16.exe svchost.exe schtasks.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs svchost no specs explorer.exe no specs explorer.exe no specs cmd.exe no specs conhost.exe no specs steamtools.exe svchost no specs slui.exe svchost no specs

Process information

PID
CMD
Path
Indicators
Parent process
1616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6656"C:\Users\admin\AppData\Roaming\svchost"C:\Users\admin\AppData\Roaming\svchost—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7228"C:\Users\admin\AppData\Roaming\svchost"C:\Users\admin\AppData\Roaming\svchost—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7308"C:\Users\admin\Desktop\steamtoolssetup.exe" C:\Users\admin\Desktop\steamtoolssetup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\steamtoolssetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7360"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
steamtoolssetup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(7360) svchost.exe
C2107.172.44.175:1889
Keys
AES012
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexThMjqUyKmaZXuLR3
7396"C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe" C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe—steamtoolssetup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\st-setup-1.8.16.exe
c:\windows\system32\ntdll.dll
7492"C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe" C:\Users\admin\AppData\Roaming\st-setup-1.8.16.exe
steamtoolssetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\st-setup-1.8.16.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7724"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svchost" /tr "C:\Users\admin\AppData\Roaming\svchost"C:\Windows\System32\schtasks.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 601
Read events
7 589
Write events
12
Delete events
0

Modification events

(PID) Process:(7360) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:svchost
Value:
C:\Users\admin\AppData\Roaming\svchost
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:DisplayName
Value:
SteamTools
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:UninstallString
Value:
"C:\Program Files\SteamTools\Uninstall.exe"
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\SteamTools\Uninstall.exe" /S
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:InstallLocation
Value:
C:\Program Files\SteamTools
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:DisplayIcon
Value:
C:\Program Files\SteamTools\SteamTools.exe,0
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:NoModify
Value:
1
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SteamTools
Operation:writeName:NoRepair
Value:
1
(PID) Process:(7492) st-setup-1.8.16.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\SteamTools
Operation:writeName:Language
Value:
1033
(PID) Process:(8124) SteamTools.exeKey:HKEY_CURRENT_USER\SOFTWARE\Valve\Steamtools
Operation:writeName:fScreenIndex
Value:
0
Executable files
20
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Core.dllexecutable
MD5:4BE563C65FF66351F94035D6B5624CC7
SHA256:C0EFDB388A3D1AAC1507B3DAABE63E7A3283AF81B1D1C04FDD1CA9F837882D51
7308steamtoolssetup.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:32A7C924D1FD14826740F4BDBAAB7B84
SHA256:54D3FBC258CC6CA53B5DBBDBE3F0224A13BE23AC0AFFAC4DFF469E7568E85CCA
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Core.dllexecutable
MD5:817520432A42EFA345B2D97F5C24510E
SHA256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
7492st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsoCBD0.tmp\modern-header.bmpimage
MD5:F1928D020EBD3BF2C54FB46B3253F2A9
SHA256:A928EDA70352B4BF7FE85EBEE91B1CA819AD78A4DBA4547B95A1A3FFF51F89DD
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Svg.dllexecutable
MD5:03761F923E52A7269A6E3A7452F6BE93
SHA256:7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
7492st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsoCBD0.tmp\modern-wizard.bmpimage
MD5:3614A4BE6B610F1DAF6C801574F161FE
SHA256:16E0EDC9F47E6E95A9BCAD15ADBDC46BE774FBCD045DD526FC16FC38FDC8D49B
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\msvcp140_1.dllexecutable
MD5:18A6C1A3D630DFCBC227082D5B06681A
SHA256:AF589D441CD97638B1A0B9192A4014C52B64B35ECF5437CAA65F27B3583E07AA
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Network.dllexecutable
MD5:3569693D5BAE82854DE1D88F86C33184
SHA256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
7492st-setup-1.8.16.exeC:\Users\admin\AppData\Local\Temp\nsyCBBF.tmp —
MD5:—
SHA256:—
7492st-setup-1.8.16.exeC:\Program Files\SteamTools\Qt5Widgets.dllexecutable
MD5:4CD1F8FDCD617932DB131C3688845EA8
SHA256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
8
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8124
SteamTools.exe
GET
302
59.83.212.226:80
http://new-service.biliapi.net/picture/chatres/update/version2.txt
unknown
—
—
unknown
7360
svchost.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
8124
SteamTools.exe
GET
200
8.133.135.83:80
http://stools.oss-cn-shanghai.aliyuncs.com/version2.txt
unknown
—
—
unknown
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7360
svchost.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
8124
SteamTools.exe
59.83.212.226:80
new-service.biliapi.net
CHINA UNICOM China169 Backbone
CN
unknown
8124
SteamTools.exe
8.133.135.83:80
stools.oss-cn-shanghai.aliyuncs.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
7360
svchost.exe
107.172.44.175:1889
—
AS-COLOCROSSING
US
malicious
2800
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1616
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
steamtools.info
  • —
unknown
new-service.biliapi.net
  • 59.83.212.226
  • 101.72.254.91
  • 119.188.209.64
  • 119.188.209.184
  • 175.43.192.134
  • 116.162.9.226
  • 123.6.40.124
  • 122.192.127.62
  • 119.188.209.185
  • 36.248.43.254
unknown
stools.oss-cn-shanghai.aliyuncs.com
  • 8.133.135.83
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7360
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7360
svchost.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
8124
SteamTools.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2196
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
8124
SteamTools.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7360
svchost.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
steamtoolssetup.exe