File name:

SPAM2.zip

Full analysis: https://app.any.run/tasks/b463a247-0b16-4307-b5d2-c11ed54aa00f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: October 09, 2019, 13:06:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
trojan
stealer
eredel
baldr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D0993B2DF29528FFEE79D50A52BD4A08

SHA1:

34FD23F4729E2A6B63D8D1DC311188D2188E6EF9

SHA256:

DB29691E24F2660DDB8C7EEB4E5B50D0C96C65806CE6B94958CC57F90DEAEE2A

SSDEEP:

98304:CxFOmH/EmaB8knUxODI4/Fe5nWplHsQ1aNNGyTnWEPgoZm3DM:SImHfaBZnPDNgCH31aNNGyTnDPgIm3DM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • drawing.exe (PID: 2344)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Connects to CnC server

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • EREDEL was detected

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Actions looks like stealing of personal data

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Stealing of credential data

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1980)
      • stepa.asyx.rulogin (2).exe (PID: 2124)

    • Uses WMIC.EXE to obtain a system information

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Searches for installed software

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

    • Reads the cookies of Google Chrome

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)

  • INFO

    • Manual execution by user

      • stepa.asyx.rulogin (1).exe (PID: 2260)
      • WinRAR.exe (PID: 1980)
      • stepa.asyx.rulogin (2).exe (PID: 2124)
      • stepa.asyx.rulogin (3).exe (PID: 1420)
      • stepa.asyx.rulogin (4).exe (PID: 2156)
      • NOTEPAD.EXE (PID: 1452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:10:09 15:04:04
ZipCRC: 0x6b5af83a
ZipCompressedSize: 1512447
ZipUncompressedSize: 1622016
ZipFileName: stepa.asyx.rulogin (1).exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs winrar.exe #EREDEL stepa.asyx.rulogin (1).exe wmic.exe no specs #EREDEL stepa.asyx.rulogin (2).exe wmic.exe no specs drawing.exe no specs #EREDEL stepa.asyx.rulogin (3).exe wmic.exe no specs #EREDEL stepa.asyx.rulogin (4).exe wmic.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1420"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (3).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (3).exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ApiSet Stub DLL
Exit code:
0
Version:
10.0.10137.0 (th1.150602-2238)
Modules
Images
c:\users\admin\desktop\spam2\stepa.asyx.rulogin (3).exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
1436"wmic" os get Caption /format:listC:\Windows\SysWOW64\Wbem\wmic.exe—stepa.asyx.rulogin (4).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1452"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\New Text Document.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1612"wmic" os get Caption /format:listC:\Windows\SysWOW64\Wbem\wmic.exe—stepa.asyx.rulogin (3).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1856"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\SPAM2.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1980"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\SPAM2.zip" C:\Users\admin\Desktop\SPAM2\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2124"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (2).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (2).exe
explorer.exe
User:
admin
Company:
Apple Inc.
Integrity Level:
MEDIUM
Description:
libtidy.dll
Exit code:
0
Version:
15.18.1.2330
Modules
Images
c:\users\admin\desktop\spam2\stepa.asyx.rulogin (2).exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
2156"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (4).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (4).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spam2\stepa.asyx.rulogin (4).exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2260"C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (1).exe" C:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (1).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\spam2\stepa.asyx.rulogin (1).exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2344"C:\Users\admin\AppData\Local\Temp\drawing.exe" C:\Users\admin\AppData\Local\Temp\\cc0421e834a74a7fb35798ccd7055ab0C:\Users\admin\AppData\Local\Temp\drawing.exe—stepa.asyx.rulogin (2).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\drawing.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
Total events
594
Read events
548
Write events
46
Delete events
0

Modification events

(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1856) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\73\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SPAM2.zip
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1856) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1980) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
5
Suspicious files
8
Text files
20
Unknown types
8

Dropped files

PID
Process
Filename
Type
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\976c.77e4a0 —
MD5:—
SHA256:—
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\86c7.ab7670 —
MD5:—
SHA256:—
2124stepa.asyx.rulogin (2).exeC:\Users\admin\AppData\Local\Temp\fb88b745.ae37 —
MD5:—
SHA256:—
2124stepa.asyx.rulogin (2).exeC:\Users\admin\AppData\Local\Temp\1a7a4ebc.8ad8 —
MD5:—
SHA256:—
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\93582306dd4c46f5a14f68e0d8cbdc09\Cookies\Chrome.txttext
MD5:—
SHA256:—
1980WinRAR.exeC:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (1).exeexecutable
MD5:—
SHA256:—
1980WinRAR.exeC:\Users\admin\Desktop\SPAM2\stepa.asyx.rulogin (4).exeexecutable
MD5:—
SHA256:—
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\74ee.d876cesqlite
MD5:—
SHA256:—
2260stepa.asyx.rulogin (1).exeC:\Users\admin\AppData\Local\Temp\93582306dd4c46f5a14f68e0d8cbdc09\passwords.logtext
MD5:—
SHA256:—
1420stepa.asyx.rulogin (3).exeC:\Users\admin\AppData\Local\Temp\f881.fd840e —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
1
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2156
stepa.asyx.rulogin (4).exe
POST
200
178.33.33.187:80
http://stepa.asyx.ru/gate.php?hwid=7CD9E0E6&os=Windows%207&file=3&cookie=7&pswd=1&credit=0&autofill=0&wallets=0&telegram=0&id=&version=v1.2.5
DE
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2260
stepa.asyx.rulogin (1).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious
2124
stepa.asyx.rulogin (2).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious
2156
stepa.asyx.rulogin (4).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious
1420
stepa.asyx.rulogin (3).exe
178.33.33.187:80
stepa.asyx.ru
OVH SAS
DE
malicious

DNS requests

Domain
IP
Reputation
stepa.asyx.ru
  • 178.33.33.187
malicious

Threats

PID
Process
Class
Message
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
ET TROJAN MSIL/Eredel Stealer CnC Checkin
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.MSIL.Agent.gen (Eredel Stealer)
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.PWS.Stealer.Gen.Baldr
2260
stepa.asyx.rulogin (1).exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no accept headers
2260
stepa.asyx.rulogin (1).exe
Potentially Bad Traffic
ET TROJAN Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
ET TROJAN MSIL/Eredel Stealer CnC Checkin
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.MSIL.Agent.gen (Eredel Stealer)
2124
stepa.asyx.rulogin (2).exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.PWS.Stealer.Gen.Baldr
4 ETPRO signatures available at the full report
Process
Message
stepa.asyx.rulogin (1).exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
stepa.asyx.rulogin (4).exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SPAM2.zip