File name:

2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/f4b5ede0-48a4-4c73-8687-8effbec3e87b
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 00:02:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
neconyd
ransomware
birele
sinkhole
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

BA7F5A14B374DAD2BB145B4FD70FD662

SHA1:

95C00BF01822483496DF2B641C40E71D29BCA77F

SHA256:

DE4CE8D9A8F4A00B78D452C485BAECA955BEEC9C71F5BB7D5EF60F0C61B3B027

SSDEEP:

3072:YR65qaR6CRp/5y03CwJ3/HxMqMdA33M5tC1isyPFCALzv4mlkVVXV9da3:YmqaRRRZ/MnA3cQYFCOzv3AVXVU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

    • BIRELE has been detected (SURICATA)

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

    • Neconyd has been detected

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

  • SUSPICIOUS

    • Application launched itself

      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7412)
      • omsecor.exe (PID: 7512)
      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8116)

    • Executable content was dropped or overwritten

      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7428)

    • Reads security settings of Internet Explorer

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

    • Executes application which crashes

      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7412)
      • omsecor.exe (PID: 7512)
      • omsecor.exe (PID: 8116)

    • Contacting a server suspected of hosting an CnC

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

  • INFO

    • Checks supported languages

      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7412)
      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7428)
      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 7512)
      • omsecor.exe (PID: 8140)
      • omsecor.exe (PID: 8116)

    • The sample compiled with english language support

      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7412)

    • Creates files or folders in the user directory

      • 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7428)
      • WerFault.exe (PID: 7684)
      • WerFault.exe (PID: 7676)
      • WerFault.exe (PID: 7020)

    • Checks proxy server information

      • omsecor.exe (PID: 7564)
      • slui.exe (PID: 8048)
      • omsecor.exe (PID: 8140)

    • Reads the computer name

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

    • Failed to create an executable file in Windows directory

      • omsecor.exe (PID: 7564)
      • omsecor.exe (PID: 8140)

    • Reads the software policy settings

      • slui.exe (PID: 8048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:11:23 10:59:31+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 8
CodeSize: 28672
InitializedDataSize: 98304
UninitializedDataSize: -
EntryPoint: 0x18b6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Comments
FileVersion: 0, 1, 2, 0
InternalName: CompanyName
LegalCopyright: LegalTrademarks
OriginalFileName: Build private
ProductName: Movie name
ProductVersion: 0, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
11
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe 2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs werfault.exe no specs slui.exe omsecor.exe #BIRELE omsecor.exe werfault.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7020C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8116 -s 340C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7412"C:\Users\admin\Desktop\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7428C:\Users\admin\Desktop\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\Desktop\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\desktop\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7512C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7564C:\Users\admin\AppData\Roaming\omsecor.exeC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
0
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
7676C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7512 -s 352C:\Windows\SysWOW64\WerFault.exe—omsecor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7684C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7412 -s 268C:\Windows\SysWOW64\WerFault.exe—2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
8048C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8116C:\Users\admin\AppData\Roaming\omsecor.exe /nomoveC:\Users\admin\AppData\Roaming\omsecor.exe
omsecor.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Comments
Exit code:
3221225622
Version:
0, 1, 2, 0
Modules
Images
c:\users\admin\appdata\roaming\omsecor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
9 219
Read events
9 213
Write events
6
Delete events
0

Modification events

(PID) Process:(7564) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7564) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7564) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8140) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8140) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8140) omsecor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7684WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-04-28_ba7f5_13472dad99d2e38bcad72f9b5142ec61d3ffd5_f4d5b093_bd547d01-5f25-474e-82df-f9020090ec8d\Report.wer —
MD5:—
SHA256:—
7676WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_4dcd37ce964bd7a4680ff6147e8cad66d7a6614_103ca111_0f324eb1-8ce5-4881-9372-d2cd3a36cefb\Report.wer —
MD5:—
SHA256:—
7020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_omsecor.exe_4dcd37ce964bd7a4680ff6147e8cad66d7a6614_103ca111_e5229648-19ca-455b-8a1a-3b9872758973\Report.wer —
MD5:—
SHA256:—
7684WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCFC5.tmp.dmpbinary
MD5:5A3DB7070E33A3B88307BCE725C03BFF
SHA256:873368D63BA41ADFE0AEE8A285650DF45F6272AFDA287A33CE3D8029CB4D9D04
7684WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D9.tmp.WERInternalMetadata.xmlbinary
MD5:4DC31DE27EEACA1980AAE9B3F191B648
SHA256:EBBDDA1DC6CD0E80AC6A45E1525EB2A2EBFC88E71AC69190133B728762D64DED
7676WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD287.tmp.xmlxml
MD5:FED764EA804A31EF631E19387BEA6D86
SHA256:610BB93159908390BAAA5BCCDFED45D504FA917E26C0342475CFB78313D845B9
7676WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD248.tmp.WERInternalMetadata.xmlbinary
MD5:688426635C1AB009884DE5D1AC7ED8B4
SHA256:72BCA8CC2F43232AD8A90C15FDAB8F7D12EF6C9D9FE87C50F080087C828FBCCF
7684WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader.exe.7412.dmpbinary
MD5:D113195BDED2FF279280D90DF5F5DD0C
SHA256:74589E12A79C0EFBDC2B74FCB27CDDB6711695605C9590E8FA96C455CA70CB23
7020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1F68.tmp.WERInternalMetadata.xmlbinary
MD5:31DB0FB87C68153B61D57E5DF2D5881F
SHA256:BEB160FD447E01E49C78E7CD9652348ABDF3568E0C7E95A60D5456C92BA33A9D
7676WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\omsecor.exe.7512.dmpbinary
MD5:3A449035AB5DF762A11A9E19B80A1ED8
SHA256:1D88E64E6E0314933CBC26A6753C66EE65DE65D7F8C50B4E559250CE76F413CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
37
DNS requests
8
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7564
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/624/291.html
unknown
—
—
malicious
2152
RUXIMICS.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2152
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7564
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/912/305.html
unknown
—
—
malicious
7564
omsecor.exe
GET
403
75.2.18.233:80
http://mkkuei4kdsz.com/819/728.html
unknown
—
—
malicious
7564
omsecor.exe
GET
200
44.247.155.67:80
http://ow5dirasuek.com/523/877.html
unknown
—
—
malicious
7564
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/860/278.html
unknown
—
—
malicious
7564
omsecor.exe
GET
—
193.166.255.171:80
http://lousta.net/624/880.html
unknown
—
—
malicious
7564
omsecor.exe
GET
200
44.247.155.67:80
http://ow5dirasuek.com/470/735.html
unknown
—
—
malicious
7564
omsecor.exe
GET
403
75.2.18.233:80
http://mkkuei4kdsz.com/615/679.html
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2152
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7564
omsecor.exe
193.166.255.171:80
lousta.net
Tieteen tietotekniikan keskus Oy
FI
malicious
2152
RUXIMICS.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2152
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7564
omsecor.exe
75.2.18.233:80
mkkuei4kdsz.com
AMAZON-02
US
malicious
7564
omsecor.exe
44.247.155.67:80
ow5dirasuek.com
AMAZON-02
US
malicious
7196
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
lousta.net
  • 193.166.255.171
malicious
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
mkkuei4kdsz.com
  • 75.2.18.233
malicious
ow5dirasuek.com
  • 44.247.155.67
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
7564
omsecor.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
7564
omsecor.exe
Malware Command and Control Activity Detected
ET MALWARE Ransom.Win32.Birele.gsg Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-28_ba7f5a14b374dad2bb145b4fd70fd662_amadey_elex_rhadamanthys_smoke-loader