File name:

MediaChance.Multimedia.Builder.keygen.by.FFF.zip

Full analysis: https://app.any.run/tasks/0888676d-d6af-472f-8ac6-d984f55b13c5
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: October 08, 2023, 12:35:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
azorult
trojan
fareit
pony
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

508367896E89BBDAE0BB02599763A615

SHA1:

295CC034152044E391B0886960E67313CDA5D235

SHA256:

D5195A27B375DC31B464EA8E47C34FF6396ADC439A8EC9040130C52BAC8B4B4D

SSDEEP:

98304:mA7AY39r/pydOYAUDPLswj1V3Rr1kA8XTlQ5ToVfDFagcb2lLUMhnElJ1g1nOeWM:tk7unnfygj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • keygen-pj.exe (PID: 3264)
      • keygen-step-1.exe (PID: 3412)
      • keygen-step-3.exe (PID: 940)
      • key.exe (PID: 3612)

    • Drops the executable file immediately after the start

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • keygen-pj.exe (PID: 3264)

    • Connects to the CnC server

      • keygen-step-1.exe (PID: 3412)
      • key.exe (PID: 3612)

    • Steals credentials from Web Browsers

      • key.exe (PID: 3612)

    • PONY was detected

      • key.exe (PID: 3612)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 940)

    • AZORULT was detected

      • keygen-step-1.exe (PID: 3412)

    • Actions looks like stealing of personal data

      • key.exe (PID: 3612)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 3632)
      • taskmgr.exe (PID: 3516)

    • Reads the Internet Settings

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • cmd.exe (PID: 2080)
      • keygen-step-1.exe (PID: 3412)
      • control.exe (PID: 4020)
      • keygen-step-3.exe (PID: 940)
      • keygen-pj.exe (PID: 3264)
      • key.exe (PID: 3612)
      • taskmgr.exe (PID: 3516)

    • Executing commands from a ".bat" file

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • key.exe (PID: 3612)

    • Starts CMD.EXE for commands execution

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • keygen-step-3.exe (PID: 940)
      • key.exe (PID: 3612)

    • Process drops legitimate windows executable

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 4020)

    • Reads settings of System Certificates

      • keygen-step-3.exe (PID: 940)

    • Searches for installed software

      • key.exe (PID: 3612)

    • Adds/modifies Windows certificates

      • cmd.exe (PID: 2080)

    • Reads security settings of Internet Explorer

      • keygen-step-3.exe (PID: 940)

    • Checks Windows Trust Settings

      • keygen-step-3.exe (PID: 940)

    • Accesses Microsoft Outlook profiles

      • key.exe (PID: 3612)

    • The process checks if it is being run in the virtual environment

      • rundll32.exe (PID: 3196)

  • INFO

    • Checks supported languages

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • keygen-pj.exe (PID: 3264)
      • keygen-step-1.exe (PID: 3412)
      • keygen-step-3.exe (PID: 940)
      • key.exe (PID: 3612)

    • Reads the computer name

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • keygen-step-1.exe (PID: 3412)
      • keygen-pj.exe (PID: 3264)
      • keygen-step-3.exe (PID: 940)
      • key.exe (PID: 3612)

    • Create files in a temporary directory

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • keygen-pj.exe (PID: 3264)
      • key.exe (PID: 3612)

    • Manual execution by a user

      • MediaChance.Multimedia.Builder.keygen.by.FFF.exe (PID: 948)
      • notepad.exe (PID: 3824)
      • taskmgr.exe (PID: 3516)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3656)

    • The executable file from the user directory is run by the CMD process

      • keygen-pj.exe (PID: 3264)
      • keygen-step-1.exe (PID: 3412)
      • keygen-step-3.exe (PID: 940)

    • Reads the machine GUID from the registry

      • keygen-step-1.exe (PID: 3412)
      • keygen-step-3.exe (PID: 940)

    • Reads product name

      • keygen-step-1.exe (PID: 3412)

    • Reads Environment values

      • keygen-step-1.exe (PID: 3412)

    • Checks proxy server information

      • keygen-step-1.exe (PID: 3412)
      • keygen-step-3.exe (PID: 940)

    • Creates files or folders in the user directory

      • keygen-step-3.exe (PID: 940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:10:08 15:34:24
ZipCRC: 0x9164731b
ZipCompressedSize: 3473033
ZipUncompressedSize: 3473033
ZipFileName: MediaChance.Multimedia.Builder.keygen.by.FFF.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
16
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe no specs mediachance.multimedia.builder.keygen.by.fff.exe no specs cmd.exe no specs keygen-pj.exe no specs #AZORULT keygen-step-1.exe control.exe no specs keygen-step-3.exe rundll32.exe no specs #PONY key.exe cmd.exe no specs ping.exe no specs cmd.exe no specs taskmgr.exe no specs taskmgr.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
940keygen-step-3.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
cmd.exe
User:
admin
Company:
wht
Integrity Level:
MEDIUM
Description:
wht
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
948"C:\Users\admin\Desktop\MediaChance.Multimedia.Builder.keygen.by.FFF.exe" C:\Users\admin\Desktop\MediaChance.Multimedia.Builder.keygen.by.FFF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\desktop\mediachance.multimedia.builder.keygen.by.fff.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2080C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.bat" "C:\Windows\System32\cmd.exe—MediaChance.Multimedia.Builder.keygen.by.FFF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2148C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\1444796.bat" "C:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe" "C:\Windows\System32\cmd.exe—key.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2436"C:\Windows\system32\taskmgr.exe" /1C:\Windows\System32\taskmgr.exe
taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3196"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\imagehlp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3204"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe" >> NULC:\Windows\System32\cmd.exe—keygen-step-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3264keygen-pj.exe -pFseuY0dpSCC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-pj.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3412keygen-step-1.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-1.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
3488ping 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
12 100
Read events
11 954
Write events
146
Delete events
0

Modification events

(PID) Process:(3632) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
6
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
948MediaChance.Multimedia.Builder.keygen.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cplexecutable
MD5:13E1CB6735D173E590804B1A8517EF6E
SHA256:68FA23BD3646C5EBB275B22CCCEB2C4070AE3DF2745871B989DF4D62A04A115F
948MediaChance.Multimedia.Builder.keygen.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeexecutable
MD5:7C7EB58A27069EA17214FD3C7733F6AC
SHA256:B0D8F2ACD2450C5436366796883AE58F2B26184C04E547D808CF28F59F664B7D
3264keygen-pj.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exeexecutable
MD5:AA48FA678A65A000FD139EDB33F46565
SHA256:3497EC8D3717BF385A651855082D4A93805296ABC5189A0A81BF51CD80D46D1E
940keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:2A61A3D0F5BEB7727441B0E010C30D7D
SHA256:8F97E861ACD3950FDE5361476DD989039EDFF251A00B7DE4DF84CBACFA629A0D
948MediaChance.Multimedia.Builder.keygen.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exeexecutable
MD5:FD7DBEAC1F7CA63CCE4E5A67B5BAB984
SHA256:B87550150CD0E3ECF8E8A7B62B90CFDDFA4D6414F271B02349E3BB6D3BEB2A14
3632WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3632.389\MediaChance.Multimedia.Builder.keygen.by.FFF.zipcompressed
MD5:28A6C05D903B1FEBFC15115491DAF212
SHA256:E064938290B29600311C2F509BCDF7CD638A9CFDA4C361B08C0A69FCD491D897
948MediaChance.Multimedia.Builder.keygen.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:4F8CC92BD220656D0D33D83D7E6C1352
SHA256:7BB8BCE3DF116BA96404C0F084D0333D8F0BEFD9FDF59667B98C8955F69DBB32
948MediaChance.Multimedia.Builder.keygen.by.FFF.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:A3A78FC361CA97368EE77A406FF39DB1
SHA256:4833C439DC79F191A30C89A601CA428F0EF156ADD0ED2BD33BB0D93C2DA1E516
3656WinRAR.exeC:\Users\admin\Desktop\MediaChance.Multimedia.Builder.keygen.by.FFF.exeexecutable
MD5:AF1E76ED37E15CAF650E1FE91DB2D407
SHA256:A25808CBF57B02ED817E3D7C1D171C0F150D482E92EDAEBBCAA40D8F694533E2
940keygen-step-3.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_34D61B4A2A4AE0D3DDAB879224BCA77Bbinary
MD5:D5894824B0B42A555A7313AB6589EAA2
SHA256:37E22FB5BA8A2648218F1CCC9F263F5020947A68741EA857CE948E1DACBBF988
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
6
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
940
keygen-step-3.exe
GET
200
104.18.15.101:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEGxVq9vQB5LHnQcM2BGe1r8%3D
unknown
binary
2.18 Kb
unknown
3612
key.exe
POST
—
188.114.96.3:80
http://top.thisispw.com/keys7369921/gate.php
unknown
—
—
unknown
940
keygen-step-3.exe
GET
200
104.18.15.101:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
—
—
POST
200
185.173.37.179:80
http://gigaload.info/1210776429.php
unknown
text
4 b
unknown
940
keygen-step-3.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8b1c40e4052e6700
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3412
keygen-step-1.exe
185.173.37.179:80
gigaload.info
Cloud assets LLC
RU
unknown
940
keygen-step-3.exe
62.72.28.104:443
www.connectingkeralam.com
PTGi International Carrier Services, Inc.
US
unknown
940
keygen-step-3.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
940
keygen-step-3.exe
104.18.15.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
3612
key.exe
188.114.96.3:80
top.thisispw.com
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
gigaload.info
  • 185.173.37.179
unknown
www.connectingkeralam.com
  • 62.72.28.104
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.comodoca.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.usertrust.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
top.thisispw.com
  • 188.114.96.3
  • 188.114.97.3
malicious

Threats

PID
Process
Class
Message
3412
keygen-step-1.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M2
3412
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
940
keygen-step-3.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
3612
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
3612
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
—
—
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MediaChance.Multimedia.Builder.keygen.by.FFF.zip