analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip

Full analysis: https://app.any.run/tasks/8740ebc9-829c-493a-b33b-bea690c5c721
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 15:41:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
stop
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

C1ACB33E084DAF418279BAD5C383470B

SHA1:

BAA2F4F5B3655EF427BAA42D5F59E2511C05D1E7

SHA256:

E7314F5F29097BF5E3AC35220E15030FEF9E1DF53753D12352D8420D869725EF

SSDEEP:

12288:9kLHXjgM14/64hT/05NIVoclKU6OwaloRHoCyrrnN7C/s65/WUVVad8b:sjgSuYjIVocgR7gnN70ss//VaM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3832)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2948)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 560)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3872)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 508)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3632)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2148)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3420)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3172)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3396)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2672)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3752)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3432)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2648)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3264)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 612)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2252)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2168)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2232)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3456)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1748)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1592)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2328)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1552)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1388)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3304)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3972)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3680)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2896)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3016)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 600)

    • Changes settings of System certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Changes the autorun value in the registry

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Loads the Task Scheduler COM API

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • STOP was detected

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3832)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 560)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3872)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2948)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3632)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 508)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3420)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2148)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3396)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3172)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 612)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2672)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3264)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3752)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2648)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Reads the computer name

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Application launched itself

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3832)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Adds / modifies Windows certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Uses ICACLS.EXE to modify access control list

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

  • INFO

    • Manual execution by user

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2948)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 560)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3872)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3632)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 508)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3420)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2148)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3172)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3752)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3396)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2672)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3264)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2252)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3432)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 612)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2648)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2168)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2232)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1592)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2328)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1748)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3972)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1552)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3680)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3304)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2896)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3016)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3456)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1388)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 600)

    • Reads settings of System Certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Checks Windows Trust Settings

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Reads the computer name

      • icacls.exe (PID: 2368)

    • Checks supported languages

      • icacls.exe (PID: 2368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
ZipUncompressedSize: 808448
ZipCompressedSize: 716690
ZipCRC: 0xac31dfc4
ZipModifyDate: 2022:01:24 15:40:21
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
43
Malicious processes
17
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe icacls.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe #STOP 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
1004"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
2928"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
3696"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1424"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
2368icacls "C:\Users\admin\AppData\Local\b1e4a996-45fb-43fd-902c-f7a858a62f41" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\system32\icacls.exe—161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
3832"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3340"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
3872"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
560"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
11 854
Read events
11 674
Write events
170
Delete events
10

Modification events

(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
8
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
3340161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\SystemID\PersonalID.txttext
MD5:5F8B73CDFC3CB55693977750C305887E
SHA256:828F4B9C3CDA16D67A118F2AB95A5F36619C6600F71A180DBDDD606CB5F8F7E8
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:7762F4E2DF4234A10AEA482710FCAFB3
SHA256:193B221C6A1188B01D785D1A365ACB032B6B34418C736903928D46BA7CFE08C3
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:6447F4DAFDB09F8828132EB09E1B9D5A
SHA256:B8C50F19424B1B6B2AFA9C2F66AEB59A65637801A3F5AEBF0D34FA426D50D9C3
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:F465C2D35FE1D0FA5A2445CE16EDB2FE
SHA256:76E004A83345D8C7463BB0F79083BD661A6DBB704BBFC45C030AC384C02B4432
3340161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\bowsakkdestx.txtbinary
MD5:856F86FA2DBB84B24F7DC5CE447859FB
SHA256:4D8FF1AB7F22F5D740C6FC63021358E207DE1E918983DAAA773AA3EB6F40BA96
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:3764883055DA6FFC81E4A929CA5072C1
SHA256:7FF45E2195491FA6A2F3CECEE4B52D9E964CB6719448431B1C7B702E98076920
1424161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\b1e4a996-45fb-43fd-902c-f7a858a62f41\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeexecutable
MD5:7382BE38C39BFD3FF5DDD1D8A9FAAA6A
SHA256:161548B327B0AB4197A1F1B0D3BC8668BEADBBBDBB05A92D25478F4358733C34
3340161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:A372D8F552750096ACDBD1E251EF2330
SHA256:A5B78BF2A3EE5FEB97233E7C38F61CB7E1056BDD973C19FE39030BDBFEB36509
1424161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:A372D8F552750096ACDBD1E251EF2330
SHA256:A5B78BF2A3EE5FEB97233E7C38F61CB7E1056BDD973C19FE39030BDBFEB36509
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:49639B4124119DFEB7616D8DD50F9BB7
SHA256:7F935C9D0A9BD17558459D5A6387B61452011BEA4589AD94A6F2435540A373B5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
23.79.149.131:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=132875126920420000
US
—
—
whitelisted
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
88.158.247.38:80
http://tzgl.org/fhsgtsspen6/get.php?pid=6E3AAB7CB29BC9495DFDE01272C66F39&first=true
RO
binary
559 b
malicious
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
404
88.158.247.38:80
http://tzgl.org/files/1/build3.exe
RO
html
216 b
malicious
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?57dc01fc755c98fc
US
compressed
4.70 Kb
whitelisted
—
—
GET
200
23.79.149.131:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=132875126920420000
US
compressed
78.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
—
—
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
—
—
23.79.149.131:80
query.prod.cms.rt.microsoft.com
Akamai International B.V.
US
unknown
1424
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
88.158.247.38:80
tzgl.org
S.N. Radiocomunicatii S.A.
RO
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 77.123.139.190
shared
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.comodoca.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
ocsp.usertrust.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
kotob.top
  • —
malicious
tzgl.org
  • 88.158.247.38
  • 183.78.205.92
  • 211.171.233.126
  • 61.98.7.132
  • 210.182.29.70
  • 189.129.113.216
  • 109.102.255.230
  • 151.251.30.69
  • 187.212.179.214
  • 186.7.139.88
malicious
query.prod.cms.rt.microsoft.com
  • 23.79.149.131
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
1424
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
—
—
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip