URL:

https://anonfile.com/feWdPfwbbc/Slayer_RDP_Scanner_zip

Full analysis: https://app.any.run/tasks/3cd3be77-dfb2-48c4-86e2-4e2945971ef5
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 15, 2019, 00:42:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
keylogger
Indicators:
MD5:

C1880E16F355E67033CD991305C4BF30

SHA1:

4720AF83C7A42E138B2193E6A2C4890247032DED

SHA256:

CB09705508E65A5810EB16B0BDE20519719D89DADB0B44323CBC53E8AD254344

SSDEEP:

3:N8RGUR26AX63Gac:2g5XcG/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2492)
      • Slayer RDP Scanner.exe (PID: 3232)
      • Slayer RDP Brute.exe (PID: 1228)
      • Slayer RDP Brute.exe (PID: 2188)

    • Writes to a start menu file

      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2492)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1248)

    • Detected logs from REMCOS RAT

      • Slayer RDP Scanner.exe (PID: 3232)

    • REMCOS RAT was detected

      • Slayer RDP Scanner.exe (PID: 3232)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Slayer RDP Scanner.exe (PID: 3864)

    • Creates files in the user directory

      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2492)
      • Slayer RDP Scanner.exe (PID: 3232)

    • Application launched itself

      • Slayer RDP Scanner.exe (PID: 3864)
      • Slayer RDP Brute.exe (PID: 2492)

    • Connects to unusual port

      • Slayer RDP Scanner.exe (PID: 3232)

    • Writes files like Keylogger logs

      • Slayer RDP Scanner.exe (PID: 3232)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2860)

    • Changes internet zones settings

      • iexplore.exe (PID: 2860)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3192)

    • Creates files in the user directory

      • iexplore.exe (PID: 3192)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3088)
      • iexplore.exe (PID: 2860)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3192)
      • iexplore.exe (PID: 2860)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2860)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2860)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs winrar.exe no specs searchprotocolhost.exe no specs slayer rdp scanner.exe slayer rdp brute.exe slayer rdp brute.exe no specs #REMCOS slayer rdp scanner.exe slayer rdp brute.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
588"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Slayer_RDP_Scanner.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1228"C:\Users\admin\AppData\Local\Temp\Slayer RDP Brute.exe" C:\Users\admin\AppData\Local\Temp\Slayer RDP Brute.exe—Slayer RDP Scanner.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP BruterX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\slayer rdp brute.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1248"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2188"C:\Users\admin\Desktop\Slayer RDP Brute.exe" C:\Users\admin\Desktop\Slayer RDP Brute.exe—Slayer RDP Brute.exe
User:
admin
Company:
Slayer RDP Scanner
Integrity Level:
MEDIUM
Description:
Slayer RDP Scanner
Exit code:
1
Version:
1
Modules
Images
c:\users\admin\desktop\slayer rdp brute.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2492"C:\Users\admin\Desktop\Slayer RDP Brute.exe" C:\Users\admin\Desktop\Slayer RDP Brute.exe
explorer.exe
User:
admin
Company:
Slayer RDP Scanner
Integrity Level:
MEDIUM
Description:
Slayer RDP Scanner
Exit code:
0
Version:
1
Modules
Images
c:\users\admin\desktop\slayer rdp brute.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2860"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3088C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3192"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2860 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3232"C:\Users\admin\Desktop\Slayer RDP Scanner.exe" C:\Users\admin\Desktop\Slayer RDP Scanner.exe
Slayer RDP Scanner.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP BruterX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\slayer rdp scanner.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3864"C:\Users\admin\Desktop\Slayer RDP Scanner.exe" C:\Users\admin\Desktop\Slayer RDP Scanner.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP BruterX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\slayer rdp scanner.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
2 092
Read events
1 733
Write events
347
Delete events
12

Modification events

(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{4456976B-46BB-11E9-BAD8-5254004A04AF}
Value:
0
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2860) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307030005000F0000002A0036000603
Executable files
1
Suspicious files
13
Text files
38
Unknown types
6

Dropped files

PID
Process
Filename
Type
2860iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2860iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Slayer_RDP_Scanner_zip[1].txt —
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Slayer_RDP_Scanner_zip[1].htmhtml
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\d3ud741uvs727m_cloudfront_net[1]text
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\app[1].jstext
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\anonfile[1].csstext
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\js[1]text
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\shermore_info[1]text
MD5:—
SHA256:—
3192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\glyphicons-halflings-regular[1].eoteot
MD5:F4769F9BDB7466BE65088239C12046D1
SHA256:13634DA87D9E23F8C3ED9108CE1724D183A39AD072E73E1B3D8CBF646D2D0407
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
38
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
iexplore.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
2860
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3192
iexplore.exe
GET
200
54.230.199.200:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3192
iexplore.exe
194.32.146.60:443
anonfile.com
—
—
unknown
2860
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3192
iexplore.exe
151.101.2.217:443
vjs.zencdn.net
Fastly
US
suspicious
3192
iexplore.exe
23.111.8.154:443
oss.maxcdn.com
netDNA
US
unknown
3192
iexplore.exe
104.18.39.148:443
shermore.info
Cloudflare Inc
US
shared
3192
iexplore.exe
172.217.16.136:443
www.googletagmanager.com
Google Inc.
US
suspicious
3192
iexplore.exe
54.239.164.96:443
boudja.com
Amazon.com, Inc.
US
unknown
3192
iexplore.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3192
iexplore.exe
54.230.199.200:80
x.ss2.us
Amazon.com, Inc.
US
unknown
3192
iexplore.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
anonfile.com
  • 194.32.146.60
  • 194.32.146.61
whitelisted
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
www.googletagmanager.com
  • 172.217.16.136
whitelisted
shermore.info
  • 104.18.39.148
  • 104.18.38.148
whitelisted
d3ud741uvs727m.cloudfront.net
  • 54.230.199.20
  • 54.230.199.199
  • 54.230.199.75
  • 54.230.199.17
whitelisted
www.google-analytics.com
  • 172.217.18.110
whitelisted
boudja.com
  • 54.239.164.96
  • 54.239.164.28
  • 54.239.164.193
  • 54.239.164.214
whitelisted
x.ss2.us
  • 54.230.199.200
  • 54.230.199.209
  • 54.230.199.28
  • 54.230.199.89
whitelisted

Threats

PID
Process
Class
Message
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://anonfile.com/feWdPfwbbc/Slayer_RDP_Scanner_zip