File name:

HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe

Full analysis: https://app.any.run/tasks/d4780038-d0b1-4d2e-b779-7839087a6a5d
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 03, 2023, 19:07:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

41F28FF8D5E2BA9C79FA62E830038734

SHA1:

3251D577356B19164B32098E012B12CA65F60B47

SHA256:

F50BC6EA15A41F1AFF50A177BEFAD85A312FBD93418E683BF0EB9A28F523BDFE

SSDEEP:

24576:7ThBihfRDxduK88k77M26FrU70xgz62EZZOPTwoD0:7tQh5DxduK88k77M26Fs626Z+EoD0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)

    • Changes the autorun value in the registry

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)

    • DCRAT has been detected (SURICATA)

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

  • SUSPICIOUS

    • Executed via WMI

      • schtasks.exe (PID: 2004)
      • schtasks.exe (PID: 284)
      • schtasks.exe (PID: 2796)
      • schtasks.exe (PID: 1204)

    • Executing commands from a ".bat" file

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)

    • Reads the Internet Settings

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)
      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

    • Starts CMD.EXE for commands execution

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1392)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 1392)

    • Connects to the server without a host name

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

  • INFO

    • Checks supported languages

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)
      • chcp.com (PID: 364)
      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

    • Reads the computer name

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)
      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

    • Reads Environment values

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)
      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

    • Create files in a temporary directory

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2700)
      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)

    • The executable file from the user directory is run by the CMD process

      • HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe (PID: 2924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:10:05 02:33:20+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 908288
InitializedDataSize: 23040
UninitializedDataSize: -
EntryPoint: 0xdfb4e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.132.56703
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: -
FileDescription: -
FileVersion: 1.0.132.56703
InternalName: telescop.dll
LegalCopyright: Please find more information at https://research.activision.com/opensource
OriginalFileName: telescop.dll
ProductName: -
ProductVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start heur-trojan-spy.msil.stealer.gen-f50bc6ea15a4.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT heur-trojan-spy.msil.stealer.gen-f50bc6ea15a4.exe

Process information

PID
CMD
Path
Indicators
Parent process
284schtasks.exe /create /tn "HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4" /sc minute /mo 8 /tr "'C:\Users\admin\AppData\Local\Temp\4kp5pfrr\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
364chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1204schtasks.exe /create /tn "HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4" /sc minute /mo 5 /tr "'C:\Users\admin\AppData\Local\Temp\2p41qtmt\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1392C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\oGOODQDuXR.bat" "C:\Windows\System32\cmd.exe—HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1660w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2004schtasks.exe /create /tn "HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4" /sc minute /mo 5 /tr "'C:\Users\admin\AppData\Local\Temp\a1ic2yxv\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2700"C:\Users\admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe" C:\Users\admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.132.56703
Modules
Images
c:\users\admin\appdata\local\temp\heur-trojan-spy.msil.stealer.gen-f50bc6ea15a4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
2796schtasks.exe /create /tn "HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4" /sc minute /mo 12 /tr "'C:\Users\admin\AppData\Local\Temp\vek4kqj2\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2924"C:\Users\admin\AppData\Local\Temp\a1ic2yxv\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe" C:\Users\admin\AppData\Local\Temp\a1ic2yxv\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.132.56703
Modules
Images
c:\users\admin\appdata\local\temp\a1ic2yxv\heur-trojan-spy.msil.stealer.gen-f50bc6ea15a4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
Total events
1 244
Read events
1 233
Write events
11
Delete events
0

Modification events

(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4
Value:
"C:\Users\admin\AppData\Local\Temp\a1ic2yxv\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe"
(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4
Value:
"C:\Users\admin\AppData\Local\Temp\4kp5pfrr\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe"
(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4
Value:
"C:\Users\admin\AppData\Local\Temp\vek4kqj2\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe"
(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2700) HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
4
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\a1ic2yxv\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeexecutable
MD5:41F28FF8D5E2BA9C79FA62E830038734
SHA256:F50BC6EA15A41F1AFF50A177BEFAD85A312FBD93418E683BF0EB9A28F523BDFE
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\a1ic2yxv\621fc758e76fd94a4d1ab6b874bdc43f2c4ed314text
MD5:5704E56352F61418691752D70AD6FD00
SHA256:B2D1EFF35808243E25E3732C4DD184FA9DA17431D73C61C1000ABB39DAA9D586
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\2p41qtmt\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeexecutable
MD5:41F28FF8D5E2BA9C79FA62E830038734
SHA256:F50BC6EA15A41F1AFF50A177BEFAD85A312FBD93418E683BF0EB9A28F523BDFE
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\4kp5pfrr\621fc758e76fd94a4d1ab6b874bdc43f2c4ed314text
MD5:9275994610F9CF60ADC710067E7A16F7
SHA256:CCC73C6421A77494FB2FD285F5FA5C5DA4753389989E57FF79B8D93BF83BEFF0
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\vek4kqj2\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeexecutable
MD5:41F28FF8D5E2BA9C79FA62E830038734
SHA256:F50BC6EA15A41F1AFF50A177BEFAD85A312FBD93418E683BF0EB9A28F523BDFE
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\4kp5pfrr\HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeexecutable
MD5:41F28FF8D5E2BA9C79FA62E830038734
SHA256:F50BC6EA15A41F1AFF50A177BEFAD85A312FBD93418E683BF0EB9A28F523BDFE
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\oGOODQDuXR.battext
MD5:5FF0D1B276DD193135E53AE670D59819
SHA256:5E1E597409B3F26F5229225B1CDAA82066E13391E3C45D5393258FB3FC7F8621
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\2p41qtmt\621fc758e76fd94a4d1ab6b874bdc43f2c4ed314text
MD5:F88D7C8F3A97F1497FC187C53E745F64
SHA256:04BD5A554555065F0A983C4835966B5571998CED0BD42D10BB8899428EBA4F6F
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\Go276k6l97text
MD5:45822BC7D97E49C97ED2F9784E9AB639
SHA256:8C54DCA1823D486ED1E965D4986969C2F4F72549A6A9E281121E6A9FF525D09E
2700HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exeC:\Users\admin\AppData\Local\Temp\vek4kqj2\621fc758e76fd94a4d1ab6b874bdc43f2c4ed314text
MD5:54925505F1F1B3B29BB44DB6FD66C89C
SHA256:08BE83413A656C6E90D0FC35F62ACAAE3DAF82732CAFB0E4DD0B5FED05969D45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
0
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2924
HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
GET
404
78.24.216.97:80
http://78.24.216.97/antidataPythonrule/searcherlogPython/Djangopoolanticut/messagehtopServer/bin/local/searcherDjango/CpuframeCam/rulesearcherPythonprogram/requestpoll.php?mELVRoHcaH3lkB7JnNeYMXZ=hZ5E2Odt5WJZ2fB1C&tAKuMakmns6q=Oppx1sCjLoJqN2iRH&nW0oZVx=feQluxOz&369fc1d8c1028b0c53a321987946c31a=c899e3f623864abbd75f3fc06c111b2a&fc18e417394b924176f400e41bae2870=QZzUWOkVWMmBDOjF2M5YzM1Q2YykjZxUmNwQWN5gjN1M2YkVDOjJGN&mELVRoHcaH3lkB7JnNeYMXZ=hZ5E2Odt5WJZ2fB1C&tAKuMakmns6q=Oppx1sCjLoJqN2iRH&nW0oZVx=feQluxOz
unknown
html
1.21 Kb
unknown
2924
HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
GET
404
78.24.216.97:80
http://78.24.216.97/antidataPythonrule/searcherlogPython/Djangopoolanticut/messagehtopServer/bin/local/searcherDjango/CpuframeCam/rulesearcherPythonprogram/requestpoll.php?mELVRoHcaH3lkB7JnNeYMXZ=hZ5E2Odt5WJZ2fB1C&tAKuMakmns6q=Oppx1sCjLoJqN2iRH&nW0oZVx=feQluxOz&369fc1d8c1028b0c53a321987946c31a=c899e3f623864abbd75f3fc06c111b2a&fc18e417394b924176f400e41bae2870=QZzUWOkVWMmBDOjF2M5YzM1Q2YykjZxUmNwQWN5gjN1M2YkVDOjJGN&mELVRoHcaH3lkB7JnNeYMXZ=hZ5E2Odt5WJZ2fB1C&tAKuMakmns6q=Oppx1sCjLoJqN2iRH&nW0oZVx=feQluxOz
unknown
html
1.21 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2924
HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
78.24.216.97:80
—
JSC IOT
RU
unknown

DNS requests

No data

Threats

PID
Process
Class
Message
2924
HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe