File name:

anydesk-6-0-5.exe

Full analysis: https://app.any.run/tasks/7b04ed24-138c-45c1-a6a8-81be4df9f9da
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: January 16, 2024, 12:44:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rhadamanthys
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A4D4C0A0388852421DB53DDCB919F090

SHA1:

33A8D89A37567C8D3C036FD0B15E1D2F4FC46579

SHA256:

DD7AA730255DA936AF74821FE2E90CBEEC20A06F543F1FABF924D129F526C014

SSDEEP:

98304:UW+imXje2nSfkIjIzhbHrzHNmoitP/87ebN6RdunnNw0AJCXBIHRDfkAaGG8YnDI:xgoxQI6V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • anydesk-6-0-5.exe (PID: 128)
      • anydesk-6-0-5.exe (PID: 2068)

    • RHADAMANTHYS has been detected (YARA)

      • anydesk-6-0-5.exe (PID: 2068)
      • anydesk-6-0-5.exe (PID: 2076)
      • anydesk-6-0-5.exe (PID: 128)

  • SUSPICIOUS

    • Application launched itself

      • anydesk-6-0-5.exe (PID: 128)

    • Reads the Internet Settings

      • anydesk-6-0-5.exe (PID: 2068)

    • Executable content was dropped or overwritten

      • anydesk-6-0-5.exe (PID: 2068)

  • INFO

    • Process checks whether UAC notifications are on

      • anydesk-6-0-5.exe (PID: 128)

    • Checks supported languages

      • anydesk-6-0-5.exe (PID: 128)
      • anydesk-6-0-5.exe (PID: 2068)
      • anydesk-6-0-5.exe (PID: 2076)

    • Reads the computer name

      • anydesk-6-0-5.exe (PID: 128)
      • anydesk-6-0-5.exe (PID: 2068)
      • anydesk-6-0-5.exe (PID: 2076)

    • Creates files or folders in the user directory

      • anydesk-6-0-5.exe (PID: 128)

    • Reads the machine GUID from the registry

      • anydesk-6-0-5.exe (PID: 128)
      • anydesk-6-0-5.exe (PID: 2068)

    • Reads CPU info

      • anydesk-6-0-5.exe (PID: 128)

    • Process checks computer location settings

      • anydesk-6-0-5.exe (PID: 2076)
      • anydesk-6-0-5.exe (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:07:10 18:01:11+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 10752
InitializedDataSize: 3642368
UninitializedDataSize: 10432000
EntryPoint: 0x1ce9
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 6.0.5.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: philandro Software GmbH
FileDescription: AnyDesk
FileVersion: 6.0.5.0
ProductName: AnyDesk
ProductVersion: 6
LegalCopyright: (C) 2020 philandro Software GmbH
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RHADAMANTHYS anydesk-6-0-5.exe no specs #RHADAMANTHYS anydesk-6-0-5.exe #RHADAMANTHYS anydesk-6-0-5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\anydesk-6-0-5.exe" C:\Users\admin\AppData\Local\Temp\anydesk-6-0-5.exe
explorer.exe
User:
admin
Company:
philandro Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
6.0.5.0
Modules
Images
c:\users\admin\appdata\local\temp\anydesk-6-0-5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2068"C:\Users\admin\AppData\Local\Temp\anydesk-6-0-5.exe" --local-serviceC:\Users\admin\AppData\Local\Temp\anydesk-6-0-5.exe
anydesk-6-0-5.exe
User:
admin
Company:
philandro Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
6.0.5.0
Modules
Images
c:\users\admin\appdata\local\temp\anydesk-6-0-5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2076"C:\Users\admin\AppData\Local\Temp\anydesk-6-0-5.exe" --local-controlC:\Users\admin\AppData\Local\Temp\anydesk-6-0-5.exe
anydesk-6-0-5.exe
User:
admin
Company:
philandro Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
6.0.5.0
Modules
Images
c:\users\admin\appdata\local\temp\anydesk-6-0-5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 094
Read events
1 094
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
128anydesk-6-0-5.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GP6UOS44S2FWN92GQ0K2.tempbinary
MD5:DF23CF7BA08664548D2780F13D4FE568
SHA256:EDD9B268324AF6E3CF207C25F7006A7322BD39C0B9B2A8FEEF5897A915EA170F
128anydesk-6-0-5.exeC:\Users\admin\AppData\Roaming\AnyDesk\user.conftext
MD5:5059D0251F3292C45A54E0AB40CCA733
SHA256:88D22B3A6A8BCB3AB03CFAC5EEF7FDF1CF4C99E17576D05997D2F0DFC96B8189
128anydesk-6-0-5.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-msbinary
MD5:DF23CF7BA08664548D2780F13D4FE568
SHA256:EDD9B268324AF6E3CF207C25F7006A7322BD39C0B9B2A8FEEF5897A915EA170F
2068anydesk-6-0-5.exeC:\Users\admin\AppData\Local\Temp\gcapi.dllexecutable
MD5:1CE7D5A1566C8C449D0F6772A8C27900
SHA256:73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
2068anydesk-6-0-5.exeC:\Users\admin\AppData\Roaming\AnyDesk\system.conftext
MD5:1ED8440E9D93FF4C3C0F9CA02BA2E6C1
SHA256:C08A76E879D94D91DCDF258991E81ADC064408BCA8B830C50867156EE6773B14
2068anydesk-6-0-5.exeC:\Users\admin\AppData\Roaming\AnyDesk\service.conftext
MD5:BD36754448490DB46C289930BEF3355F
SHA256:944DB1A38C89B938A40816075C03223AD0486216177E08A8AAB504FAAA727A60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
4
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
anydesk-6-0-5.exe
POST
200
18.245.86.84:80
http://api.playanext.com/httpapi
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2068
anydesk-6-0-5.exe
92.223.88.232:443
boot-01.net.anydesk.com
G-Core Labs S.A.
LU
unknown
2068
anydesk-6-0-5.exe
208.115.231.126:80
relay-28682325.net.anydesk.com
LIMESTONENETWORKS
US
unknown
2068
anydesk-6-0-5.exe
51.83.238.210:80
relay-5f86ddd5.net.anydesk.com
OVH SAS
PL
unknown
2068
anydesk-6-0-5.exe
18.245.86.84:80
api.playanext.com
—
US
unknown

DNS requests

Domain
IP
Reputation
boot-01.net.anydesk.com
  • 92.223.88.232
whitelisted
relay-28682325.net.anydesk.com
  • 208.115.231.126
unknown
relay-5f86ddd5.net.anydesk.com
  • 51.83.238.210
unknown
api.playanext.com
  • 18.245.86.84
  • 18.245.86.26
  • 18.245.86.79
  • 18.245.86.105
whitelisted

Threats

PID
Process
Class
Message
2068
anydesk-6-0-5.exe
Misc activity
ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)
2068
anydesk-6-0-5.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
anydesk-6-0-5.exe