| File name: | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612 |
| Full analysis: | https://app.any.run/tasks/f67a9fea-86cd-47e1-8c48-15db80c9bfda |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 31, 2025, 18:53:25 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections |
| MD5: | C35E65FF57740B9E7C7342650501FCEB |
| SHA1: | 0BC817B263A33C06C7CA9101D7442AED865D922A |
| SHA256: | F999449AA7EC3FD4D6568C9234155A9420846B13B1C83A84EB9E259D724E426A |
| SSDEEP: | 98304:b+OYKbCzLDFMRbUSlL3Jx9fKOOaaFGqTJo2wa5Fhkkb2wIA7TQg0wu+shO547k/h:A9 |
| .exe | | | Win32 Executable (generic) (42.6) |
|---|---|---|
| .exe | | | Win16/32 Executable Delphi generic (19.5) |
| .exe | | | Generic Win/DOS Executable (18.9) |
| .exe | | | DOS Executable Generic (18.9) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:01:23 07:03:26+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 2696192 |
| InitializedDataSize: | 940544 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2931e4 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.0.0.6042 |
| ProductVersionNumber: | 6.0.0.6042 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | iTop Inc. |
| FileDescription: | iTop VPN Mini |
| FileVersion: | 6.0.0.6042 |
| InternalName: | - |
| LegalCopyright: | © iTop Inc. All rights reserved. |
| LegalTrademarks: | iTop Inc. |
| OriginalFileName: | iTopVPNMini.exe |
| ProductName: | iTop VPN |
| ProductVersion: | 6 |
| Comments: | - |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1276 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 1 Version: 122.0.6261.70 Modules
| |||||||||||||||
| 2104 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 1 Version: 122.0.6261.70 Modules
| |||||||||||||||
| 2332 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 122.0.6261.70 Modules
| |||||||||||||||
| 3884 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 1 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 4020 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | explorer.exe | ||||||||||||
User: admin Company: iTop Inc. Integrity Level: MEDIUM Description: iTop VPN Mini Exit code: 0 Version: 6.0.0.6042 Modules
| |||||||||||||||
| 6028 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 6036 | "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe" | C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 6072 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 1 Version: 122.0.6261.70 Modules
| |||||||||||||||
| 6880 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7184 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (2332) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2332) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2104) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 2 | |||
| (PID) Process: | (2104) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 3 | |||
| (PID) Process: | (6028) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (6028) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (6072) chrome.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 1 | |||
| (PID) Process: | (7484) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 1 | |||
| (PID) Process: | (7376) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 2 | |||
| (PID) Process: | (7376) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 3 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksfds.exe\Vogteam.dec | binary | |
MD5:B843C2E743038D5689DD0E54781BC59F | SHA256:436739637B3F6A65BB00D3D80616443BDEBD0A4C8FB849714FCD42EA5BB29C75 | |||
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksfds.exe\Jod.oy | binary | |
MD5:E61034F6E9324C928E1907A3F4D20EA3 | SHA256:CBAFC1D06E674151F363D0B99BDA59FAE0BF8C22C896BF27CC819E7F47FA7EA7 | |||
| 6072 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Login Data | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksfon.ps1 | text | |
MD5:3BFFBDF194F52FA0F0E2A7543FEBEE3A | SHA256:202BC57106E258E3BC97A4C268EA9DB2ED111B6099C44A8D051818E65D8BDB01 | |||
| 2104 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Cookies | binary | |
MD5:06AD9E737639FDC745B3B65312857109 | SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404 | |||
| 1276 | chrome.exe | C:\Users\admin\AppData\Local\Temp\Web Data | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksfds.exe\Nahimic.exe | executable | |
MD5:76C6FA6BEC0ECC08D33A2F2B7360F2C0 | SHA256:39679EE4DE6993C82B73BCF8AB58D86B9551DA860EF242F5D3C8EBF577BFBD77 | |||
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksfds.exe\sdHookpp.32.dll | executable | |
MD5:230313B9885A7DC703B431730E7C38D0 | SHA256:264FF65ECCF58C8A3501B9DBA9282ADB807A6C92408DD19BDF1BE35021D7B9F4 | |||
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksflk.exe | html | |
MD5:84A055E068DF3976A359836B6E3EE61F | SHA256:EBCF724E1B494DDF338BECA74A4715755E0FFF9087E65C045C870E31E3A27B41 | |||
| 4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | C:\Users\admin\hjksffy.exe | executable | |
MD5:FDA139D8EDC75F77C2606DC9A67F762D | SHA256:B8DFA80C6A22B7168B3B6738295A472C1F8D96C932062C72A53062B04DE909EA | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.124:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | GET | 200 | 172.67.202.142:80 | http://mi.ricespider.digital/kernelbase64.bin | unknown | — | — | unknown |
— | — | GET | 403 | 172.67.202.142:80 | http://h4.sublimeravage.shop/shark.bin | unknown | — | — | unknown |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | GET | 200 | 172.67.202.142:80 | http://ns.thumbsemifinal.top/caUvXyK.ps1 | unknown | — | — | unknown |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | GET | 200 | 172.67.202.142:80 | http://h4.sublimeravage.shop/sh.ext.bin | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
900 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
900 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6544 | svchost.exe | 20.190.159.0:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.168.124:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
5496 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | 172.67.202.142:443 | — | CLOUDFLARENET | US | unknown |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | 172.67.202.142:80 | — | CLOUDFLARENET | US | unknown |
6544 | svchost.exe | 20.190.159.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
login.live.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | Potentially Bad Traffic | ET HUNTING Request to .TOP Domain with Minimal Headers |
4020 | SecuriteInfo.com.Win32.Trojan.Agent.76OBD3.27317.25612.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |