Analysis date (UTC): 23 January 2026, 03:33Analysis environment: Windows 10 Pro, build 19044, x64

2025.ip138.com

MD5:4DCF381187EFBE91C4328512EFBDD3B3
SHA1:7241EB8F595048E9D4AF83BB774F34394121BF8F
SHA256:F535913DDBA36D4F160356E116D8CD2F2BA0971BEEEF86AA7E401EB85D87A53E

Analysis result

Threat level:Malicious activity
Tags:
remoteratgh0st

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

No suspicious indicators.

INFO

Checks supported languages

  • identity_helper.exe (PID: 3056)

Application launched itself

  • msedge.exe (PID: 7240)

Reads the computer name

  • identity_helper.exe (PID: 3056)

Reads Environment values

  • identity_helper.exe (PID: 3056)

Drops script file

  • msedge.exe (PID: 7828)

Threats

PIDProcessClassMessage
6848msedge.exeDomain Observed Used for C2 DetectedMALWARE [ANY.RUN] Win32/gh0st CnC related domain (2025 .ip138 .com)
——Unknown TrafficET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN