File name:

2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer

Full analysis: https://app.any.run/tasks/9671372e-1260-4116-b4ff-96efd05466da
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 18:47:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
xred
backdoor
xor-url
generic
delphi
arch-doc
snake
keylogger
dyndns
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

45BDD40F6244013FB8E4CD32D04F3B3A

SHA1:

A938A192E9DB5ED48A6956B3091AF0010E6005E3

SHA256:

FD2EFE9E4FD89CDA1490AB007B40AE58DB5D77E6782D68E719B9770E75DCCEE9

SSDEEP:

98304:wr7ayGJ6kHOSAyu3a7BC7fGnWqboMC68WsaI33Bjxug50/FK2PtIxVIuRLNV+QOY:uU+aNBFZMlJkE/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XRED mutex has been found

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)
      • Synaptics.exe (PID: 7724)
      • Synaptics.exe (PID: 7884)

    • XRED has been detected

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)

    • Changes the autorun value in the registry

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)

    • XRED has been detected (YARA)

      • Synaptics.exe (PID: 7724)

    • XORed URL has been found (YARA)

      • ._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7496)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)

    • Reads security settings of Internet Explorer

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)
      • Synaptics.exe (PID: 7724)

    • There is functionality for communication over UDP network (YARA)

      • Synaptics.exe (PID: 7724)

    • There is functionality for taking screenshot (YARA)

      • Synaptics.exe (PID: 7724)

    • There is functionality for communication dyndns network (YARA)

      • Synaptics.exe (PID: 7724)

    • Executes as Windows Service

      • VSSVC.exe (PID: 8004)

    • Application launched itself

      • msiexec.exe (PID: 7568)

  • INFO

    • Reads the computer name

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)
      • msiexec.exe (PID: 7568)
      • Synaptics.exe (PID: 7724)
      • Synaptics.exe (PID: 7884)

    • Creates files in the program directory

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)
      • ._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7496)
      • Synaptics.exe (PID: 7724)

    • The sample compiled with turkish language support

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)

    • Checks supported languages

      • ._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7496)
      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)
      • msiexec.exe (PID: 7568)
      • Synaptics.exe (PID: 7724)
      • Synaptics.exe (PID: 7884)

    • Process checks computer location settings

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)

    • The sample compiled with english language support

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)
      • msiexec.exe (PID: 7568)

    • Auto-launch of the file from Registry key

      • 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7392)

    • Manual execution by a user

      • Synaptics.exe (PID: 7884)
      • WINWORD.EXE (PID: 7460)
      • OpenWith.exe (PID: 7696)
      • OpenWith.exe (PID: 7824)
      • OpenWith.exe (PID: 2656)
      • OpenWith.exe (PID: 7184)
      • OpenWith.exe (PID: 4000)
      • OpenWith.exe (PID: 5508)
      • OpenWith.exe (PID: 6272)
      • OpenWith.exe (PID: 7240)

    • Manages system restore points

      • SrTasks.exe (PID: 4724)

    • Checks proxy server information

      • Synaptics.exe (PID: 7724)

    • Compiled with Borland Delphi (YARA)

      • msiexec.exe (PID: 7516)
      • Synaptics.exe (PID: 7724)
      • ._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe (PID: 7496)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(7496) ._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe
Decrypted-URLs (18)http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
http://ns.adobe.com/xap/1.0/
http://ocsp.digicert.com0A
http://ocsp.digicert.com0C
http://ocsp.digicert.com0O
http://ocsp.digicert.com0X
http://www.digicert.com/CPS0
https://wixtoolset.org/
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (96.4)
.exe | Win32 Executable Delphi generic (2)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.3)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 7762432
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Turkish
CharacterSet: Windows, Turkish
CompanyName: Synaptics
FileDescription: Synaptics Pointing Device Driver
FileVersion: 1.0.0.4
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: Synaptics Pointing Device Driver
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
27
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XRED 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe #XOR-URL ._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exe no specs msiexec.exe no specs msiexec.exe #XRED synaptics.exe svchost.exe #XRED synaptics.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs startmenu.exe no specs COpenControlPanel no specs winword.exe openwith.exe no specs openwith.exe no specs ai.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs slui.exe openwith.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1532"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer32.dll"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2100"C:\Windows\syswow64\MsiExec.exe" /Y "C:\WINDOWS\SysWOW64\StartMenuHelper32.dll"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2600C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2656"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\ClassicIE.admlC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4000"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\OpenShell.admxC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4068"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "B31156BA-3291-486F-B90A-44232C2E0FAB" "C62BCF73-9D53-4516-AFAD-38BDC120D32B" "7460"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4724C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5508"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\OpenShellStartMenu.admlC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
30 271
Read events
29 505
Write events
720
Delete events
46

Modification events

(PID) Process:(7392) 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E232827701000044F8271D1F3A104485AC14651078412D8B0300006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CA8D000000
(PID) Process:(7392) 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7392) 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(7392) 2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CA8D000000
(PID) Process:(7568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000CB891C6E25C8DB01901D0000341F0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000CB891C6E25C8DB01901D0000341F0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000A21A646E25C8DB01901D0000341F0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000008D466B6E25C8DB01901D0000341F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000EEB6616E25C8DB01901D0000341F0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7568) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000EEB6616E25C8DB01901D0000341F0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
62
Suspicious files
170
Text files
23
Unknown types
1

Dropped files

PID
Process
Filename
Type
7496._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\ProgramData\OpenShellSetup64_4_4_195.msi —
MD5:—
SHA256:—
7568msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7568msiexec.exeC:\Windows\Installer\1142b3.msi —
MD5:—
SHA256:—
73922025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:45BDD40F6244013FB8E4CD32D04F3B3A
SHA256:FD2EFE9E4FD89CDA1490AB007B40AE58DB5D77E6782D68E719B9770E75DCCEE9
73922025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeC:\Users\admin\Desktop\._cache_2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer.exeexecutable
MD5:FEB30D464607626F3EB3FAF91CAD2D82
SHA256:DC79E3ABEBD128D7F44FA8F03A4E660B5F60B011F7BCF374B35C18A741F5818A
7568msiexec.exeC:\Windows\Temp\~DF51044ECBB442B719.TMPbinary
MD5:9D7D8204FE9A664B63C78510C0071C47
SHA256:A613339AF9FBE4BE59BE8311EB5B67761A4A6BD1901DD9C00DFD3EEE942D9D89
7568msiexec.exeC:\Windows\Temp\~DF48F59297EA219350.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
7568msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{47ae73f1-01da-4ad4-b215-911563c15979}_OnDiskSnapshotPropbinary
MD5:5AA8D30B9B375089F823E2E60D66C391
SHA256:789E78B7AE587D703ADCAEEE47DE72DA5EE7F30788E0F819044026284D77FC27
7568msiexec.exeC:\Windows\Installer\MSI463D.tmpbinary
MD5:BEFCE9AD49655E36671EDDC3A7EC210B
SHA256:F2EA01ACC56F8E0548FA323C57AEC5F0C2F061424F3B32064CD1277C27D926DE
7568msiexec.exeC:\Program Files\Open-Shell\Skins\Classic Skin.skin7executable
MD5:FAA7CA24C9006EF763C6F457B1DC0DFA
SHA256:7BF49E5A5D9E6E47F89BCFE6381C2E7FF3BAFB004866B8BB9F0DF1A436250742
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
89
DNS requests
20
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7724
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7460
WINWORD.EXE
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6572
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7724
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
whitelisted
2196
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.166
  • 23.48.23.147
  • 23.48.23.164
  • 23.48.23.150
  • 23.48.23.177
  • 23.48.23.161
  • 23.48.23.162
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
omex.cdn.office.net
  • 2.19.126.151
  • 2.19.126.160
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
messaging.lifecycle.office.com
  • 52.111.236.4
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to Abused Domain *.mooo.com
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET MALWARE Snake Keylogger Payload Request (GET)
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-18_45bdd40f6244013fb8e4cd32d04f3b3a_amadey_black-basta_darkgate_elex_gcleaner_luca-stealer