Find similar analyses in TI Lookup
Analysis date (UTC): 15 July 2024, 02:50Analysis environment: Windows 10 Pro, build 19045, x64

trump

MD5:315A9D36ED86894269E0126B649FB3D6
SHA1:CAAA1F85DD333C9D19767B5DE527152D5ACBC2A4
SHA256:CB0B9E509A0F16EB864277CD76C4DCAA5016A356DD62C04DFF8F8D96736174A7

Analysis result

Threat level:Malicious activity
Tags:
ransomware
Full analysis:Analysis trump (MD5: 315A9D36ED86894269E0126B649FB3D6) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

  • trump.exe (PID: 5988)

Renames files like ransomware

  • trump.exe (PID: 5988)

SUSPICIOUS

Starts CMD.EXE for commands execution

  • trump.exe (PID: 5988)

Starts application with an unusual extension

  • cmd.exe (PID: 5220)

Creates files like ransomware instruction

  • trump.exe (PID: 5988)

INFO

Checks supported languages

  • trump.exe (PID: 5988)
  • chcp.com (PID: 2704)

Reads the computer name

  • trump.exe (PID: 5988)

Dropped object may contain TOR URL's

  • trump.exe (PID: 5988)

Threats

PIDProcessClassMessage
5988trump.exeMisc AttackET DROP Spamhaus DROP Listed Traffic Inbound group 30

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED