surun.info: a server that handed out encrypted PowerShell files tagged AveMariaRAT, Formbook and Expiro, and what to do on Windows
surun.info is a web address that URLhaus lists ten times on 22 September 2026 for PowerShell (.ps1) files, one tagged AveMariaRAT and rat, one tagged Formbook and one tagged expiro. All ten are marked offline now, and our own request to the address timed out, so nothing here proves your PC is infected.
If you only saw the name in a log, nothing is proven; if something on your PC may have fetched these files, treat it as watched: change passwords from another device, then scan and clean or reset Windows.
Facts checked October 17, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like a script, loader or program that downloads PowerShell files from surun.info usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags): summary
| Type | A malware server: URLhaus lists ten PowerShell files, tagged AveMariaRAT and rat (one), Formbook (one) and expiro (one) |
|---|---|
| Risk | High if a script on your PC fetched its files: keystrokes, passwords and screen may be seen. Low if you only saw the name |
| Symptoms | Often none. Unknown Startup folder items, RegSvcs.exe running with no reason and switched off Defender or firewall are the signs in the reports |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, remove the startup entries, and reset Windows if you are not sure |
| Our check (17 October 2026) | One plain request from our server: timeout. A silent address clears nothing; the danger rating comes from URLhaus |
| Running since / first seen | Domain registered 6 July 2018; files reported 22 September 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Windows. Nothing we read says Mac or phones are affected |
|---|---|
| Detection names | No Microsoft name is known for the files on this server, because we did not open them. For AveMaria Microsoft uses Backdoor:MSIL/AveMariaRAT.A!MTB to .D!MTB |
| Name | Surun.info |
| Domain registered | 6 July 2018 |
| Evidence | 10 write-ups by security sites; details still limited |
| First seen | 22 September 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 17 October 2026 |
Facts checked on 17 October 2026 against the URLhaus data for surun.info held in our database (10 rows), RDAP, one plain request from our server, and published pages by Microsoft, Trend Micro, Cyble, Deepwatch and MalwareBazaar.
We did not download the files and we infected no PC; the removal steps follow Microsoft's Windows tools and were not tried on a live infection. We found no readable vendor page on Formbook in this research, and say so.
What surun.info is, and what we know about it
surun.info is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write-up of this one address, so what follows is what URLhaus shows, what we saw ourselves, and what vendors have published about the malware families the tags name.
- 1
What URLhaus lists
Ten file addresses on surun.info, all PowerShell scripts with the ending .ps1. Nine sit in a folder path that starts /nh1ykmf/qagxfjr/wxtrdlm/ and one sits in /nh1ykmf/qagxfjr/cc/. The file names are Cryptedt, Crypted (inside a folder called Man), crypted, Cryptedk, Cryptedn, neriCrypted, jensi, sagasuit, RYAN and wisky. All ten were added within five minutes on 22 September 2026, all carry the threat label malware_download, all are marked offline, and the reporter is abuse_ch.
- 2
What the tags mean
ascii and powershell and ps1 describe the file: plain text, a PowerShell script. opendir means the folder could be listed by anyone who asked the server, which is how a whole set of files is found at once. rat means remote access trojan, a program that lets a stranger control a computer. AveMariaRAT, Formbook and expiro are names of malware families. One file is tagged AveMariaRAT, one Formbook, one expiro. The other seven carry no family tag.
- 3
What we could not confirm
We did not download any of the files, so we cannot tell you what is inside them, which build they carry or where it reports to. URLhaus shows tags, not proof, and a tag on one file does not mean the whole folder is that family. We also do not know which program or message makes a PC ask for these files. That first step is not visible from the server side.
- 4
What this means for you
If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these scripts. A normal visitor has no reason to request a file like Cryptedk.ps1.
- Kind of threat
- A server that handed out encrypted or obfuscated PowerShell files; tags name AveMariaRAT (a remote access trojan), Formbook and expiro
- Where the files are
- hxxps://surun[.]info/nh1ykmf/qagxfjr/wxtrdlm/ and hxxp://surun[.]info/nh1ykmf/qagxfjr/cc/: random looking folders
- Domain registered
- 6 July 2018 through GoDaddy.com, LLC; status flags client delete, renew, transfer and update prohibited (RDAP, read 17 October 2026)
- URLhaus entries
- 10 file addresses in our copy of the data, all added on 22 September 2026 between 17:15 and 17:19 UTC; all 10 offline. The order that created this guide counted 12 URLs, so the live URLhaus page may list more than our copy
- Delivery trick
- Scripts with names such as Crypted. The word suggests encrypted or packed content, which is our reading of the names, not a confirmed fact
- Platform
- Windows. PowerShell scripts and the families named are Windows threats. Nothing we read says Mac, iPhone or Android are affected
What surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags) does on an infected PC
What we checked on 17 October 2026, and what we could not
Our server sent one plain request to surun.info on 17 October 2026. It timed out. That is not a browser test: it did not run scripts, look for notification requests or follow redirects. It clears nothing.
Our check, 17 October 2026
- The address did not answerA plain request from our server ended in a timeout. A timeout can mean the server is switched off, blocks our server, filters by country or is simply slow. We cannot tell which.
- Why that is not a clean resultA host that served malware files often has nothing on its front door, or closes down after a few days. A silent address is common for this kind of server and is not a sign of safety.
- Notification request, pop-ups, redirects, ad networksNone seen. There was nothing to see: no page loaded.
- URLhaus listingTen PowerShell files, three with family tags (AveMariaRAT and rat, Formbook, expiro). All ten were offline in our copy of the data on 17 October 2026, 25 days after they were reported.
- Downloads and the files themselvesWe did not download any file and did not open the folder listing. We cannot tell you what the files contain.
Dangerous: treat it as a malware server Our check was one plain request that timed out, so it proves nothing either way. The danger rating comes from the ten URLhaus reports and their tags, not from our request. Offline today does not mean harmless: the files may be moved, and a PC that fetched them earlier keeps whatever they installed.
What happened to surun.info, from registration to our check
The domain is eight years old, but every report falls inside five minutes on one day. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.
6 July 2018
The domain is registered
RDAP shows surun.info registered on 6 July 2018 through GoDaddy.com, LLC. An old domain can be a purchased or a hacked one, and the record does not say which. We draw no conclusion from the age.
22 September 2026, 17:15
The first file is reported
abuse.ch adds http://surun[.]info/nh1ykmf/qagxfjr/cc/Cryptedt.ps1, tagged ascii, Formbook, opendir, powershell and ps1. It is the only row on plain http and the only one in the folder cc.
22 September 2026, 17:17
A file tagged AveMariaRAT
Man/Crypted.ps1 is added, tagged AveMariaRAT, opendir, powershell, ps1 and rat. It is the only row with the rat tag.
22 September 2026, 17:18
Six files in seven seconds
RYAN.ps1 and Cryptedk.ps1 (17:18:13), Cryptedn.ps1 (17:18:15), sagasuit.ps1 (17:18:16), jensi.ps1 (17:18:17) and crypted.ps1 (17:18:20) are added. crypted.ps1 is the one tagged expiro; the other five have only the file tags.
22 September 2026, 17:19
Two last files
neriCrypted.ps1 (17:19:53) and wisky.ps1 (17:19:54) are added with the file tags only. That makes ten rows, all offline in our copy.
All ten URLhaus entries for surun.info in our copy of the data. The folder and the file tags stay the same; the names change. 17 October 2026
Our request times out
Our server's plain request to the address gets no answer. All ten reported files are marked offline.
What the pattern suggests, and what it does not: ten files within five minutes in one tree of folders looks like one person uploading a batch of loaders for different payloads, or a researcher or bot finding an open folder and logging it. Both are our reading of the timestamps, not something any report says.
How a PowerShell file on a server turns into a trojan on a PC
A .ps1 file sitting on a server cannot hurt a person who never asks for it. It works only when a first program that is already running downloads it and runs it. We did not see the files on surun.info. This is how Cyble and Deepwatch describe PowerShell loaders that end in WarzoneRAT, the family that Microsoft lists as AveMaria.
- 1
A first script is already running
Cyble describes a VBScript that retrieves a PowerShell script from a paste style web address, saves it as BTYSA.ps1 and starts it through a hidden .cmd wrapper. How the VBScript reached the PC is a separate question and differs by campaign.
- 2
The PC asks a server for the next piece
This is the step where an address like surun.info appears in a firewall or DNS log. A person does not ask for neriCrypted.ps1 by hand; a script does.
- 3
PowerShell decodes a hidden program
A Joe Sandbox report of a related chain describes a hidden PowerShell command that reads a value stored in the registry, reverses it, decodes it from base64 and loads it as a .NET assembly. A MalwareBazaar entry for an AveMariaRAT tagged PowerShell file lists base64, encrypted and obfuscated tags. We have not seen the code of the surun.info files, so we cannot say whether they work the same way.
- 4
It runs inside a trusted Windows process
Cyble and Deepwatch describe the PowerShell stage injecting the final payload into RegSvcs.exe, a genuine Windows program. In Task Manager the process then carries a trusted name. Deepwatch also says the scripts change Windows Defender settings and turn off the Windows Firewall, which is why the checks below include Defender's exclusions.
- 5
It stays
Cyble reports persistence through files in the Startup folder (a script and a shortcut named WindowsServices). That is one campaign; others may use other places such as scheduled tasks or the Run key.
The point for a reader: the useful defences come before the file (do not run the first script) and after it (notice the process, the startup entry and the connection). By the time you can see the PowerShell file, the harm is already decided.
The three families in the tags: AveMariaRAT, Formbook and Expiro
Three tags are not three confirmed infections. A tag is a label that a reporter or a rule attached to one file. The table says what we could and could not establish for each; the amount of source material differs, and we say where it is thin.
| Tag | File it sits on | What we found | Source |
|---|---|---|---|
| AveMariaRAT and rat | Man/Crypted.ps1 | Ave Maria is a remote access trojan, also called WarzoneRAT. Microsoft lists four detections for it, all with alert level severe: Backdoor:MSIL/AveMariaRAT.A!MTB, .B!MTB, .C!MTB and .D!MTB (A and B updated 25 November 2022, C and D updated 20 December 2022). Cyble and Deepwatch describe PowerShell chains that inject it into RegSvcs.exe and alter Defender settings | Microsoft; Cyble; Deepwatch |
| Formbook | cc/Cryptedt.ps1 | Only the tag. The research for this guide found no vendor page on Formbook that we could read, so we say nothing about what it does. If you want that, read a vendor description of Formbook before deciding what to do | URLhaus data only |
| expiro | crypted.ps1 | Expiro is a family of Windows file infecting malware. Trend Micro describes it overwriting the entry code of a program and attaching its own body to the file, contacting remote sites, and spreading as a download, as a dropped file or over network shares. Its entries mention old Windows versions, so they are not a description of a current build | Trend Micro |
| No family tag | Seven other files | Nothing known. The names (RYAN, jensi, sagasuit, wisky, Cryptedk, Cryptedn, neriCrypted) tell us nothing reliable | Not available |
| Which build is this server's? | All ten | Not known. We did not open the files | Not available |
A file tagged expiro on a server that also holds files tagged AveMariaRAT and Formbook is a mixed bag. It could be a distribution point that serves different payloads, a mislabel, or a folder shared by several people. We cannot tell which, and a PC that fetched one file need not have fetched the others.
What surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags) can steal or download
What a remote access trojan or stealer can take from a Windows PC
The sources we read for this guide describe delivery and injection of AveMaria rather than its full feature list, so the list below is what a remote access trojan of this class generally lets a person do. It is not a confirmed list for these ten files.
Possible with a remote access trojan
- Every key you type
- A live view of your screen
- Your webcam
- Saved browser passwords
- Cryptocurrency wallet data
- Files searched for and downloaded
- Programs started or stopped
- Windows Defender settings changed
- Extra malware downloaded
| Data | What we can say | Source |
|---|---|---|
| Security settings | The PowerShell stage in the Deepwatch case bypasses security measures, changes Windows Defender settings and disables the Windows Firewall | Deepwatch |
| Credentials | The Joe Sandbox report of a related chain ends in credential theft and contact with its controller | Joe Sandbox (found through search; summary only) |
| Control of the PC | A remote access trojan is by definition a way for another person to use the PC. The rat tag on Man/Crypted.ps1 says so | URLhaus tag |
| Anything more specific | Not confirmed for these files | Not available |
What this can cost you
Reading the name or seeing it in a log costs nothing. The risks below apply to a Windows PC where a script fetched one of these files and the payload then ran.
- High
Passwords and accounts
A trojan that watches the keyboard or reads saved logins sees new passwords too. Changing passwords from the PC that may be infected does not help.
- High
Someone using your PC live
The rat tag points to a remote access trojan. That is not a one off theft: the controller can come back, watch the screen and act while you are logged in.
- High
Weakened protection
Deepwatch says a similar PowerShell stage changes Defender settings and disables the Windows Firewall. A PC in that state may not warn you about the next thing.
- Medium
More malware on the same PC
Three different family tags on one server show it may hand out more than one kind of payload. A PC that fetched one file may have fetched others.
- Medium
Crypto and banking
Wallet files, seed phrases and open bank sessions on a watched PC should be treated as known. Crypto sent from a stolen wallet cannot be reversed. We did not confirm that these files take wallet data.
- Low
Nothing, if you only saw the name
A name in a block list, a log or a warning is not an infection.
What you may notice, and what you may not
Loaders and remote access trojans are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and most victims notice nothing.
| Sign | What the reports show |
|---|---|
| A file in the Startup folder you did not put there | Cyble found a script and a shortcut named WindowsServices in the Startup folder in one campaign |
| RegSvcs.exe running with no reason | Cyble and Deepwatch describe the final payload being injected into RegSvcs.exe. It is a real Windows program, so one running with no reason, or using network, is worth a look |
| Windows Security or the firewall switched off | Deepwatch says a similar PowerShell stage turns off the Windows Firewall and changes Defender settings |
| A Defender detection named AveMariaRAT | Microsoft's names are Backdoor:MSIL/AveMariaRAT.A!MTB to .D!MTB, where MTB means it was caught by behaviour |
| Slow PC, odd disk or network use | Common in the sources for loaders and file infectors, but it also has ordinary causes |
| Nothing at all | Stealth is the point of a loader that runs in memory |
How to check the PC for surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags)
How a person ends up asking for these files
Nobody visits surun.info on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are the ones the sources describe for similar chains.
- 1
A script that arrives as an attachment or download
Cyble's case begins with a VBScript. A script file that arrives in an email, a zip or a download and is opened by the user is the usual start of such a chain. We did not see the start of the surun.info chain.
- 2
Software bundles and fake files
Trend Micro lists download from the internet and dropped by other malware as channels for Expiro. A cracked program or a fake installer is a common carrier for loaders in general, but no source we read ties it to this server.
- 3
Another infection that fetches more
A PC that already has a loader can be told to fetch more. Seeing one family tag on a server does not mean the PC was infected through it.
Check your PC before you delete anything
Start with the question that matters: did something on this PC contact surun.info, or did you open an unexpected script, zip or installer? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.
- 1
Disconnect first
Turn off Wi-Fi or unplug the network cable. A remote access trojan needs the connection to be used.
- 2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
- 3
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for a detection called AveMariaRAT, Expiro, Formbook or anything blocked or quarantined around the time of first contact. Results of an offline scan also appear there.
- 4
Look at the Startup folder and Startup apps
Press Windows key + R, type shell:startup and press Enter. Look for script files or shortcuts you did not make, such as a .vbs file or a shortcut with a name like WindowsServices. Then open Settings > Apps > Startup and look for names you did not install. Do not delete yet; write down the name and where it points.
- 5
Open Task Scheduler
Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names, or that run PowerShell, a .vbs or a .cmd file from a user folder. Sources do not tie scheduled tasks to these ten files, so a clean list does not clear the PC.
- 6
Look for trusted programs that should not be running
Open Task Manager and look at the Processes tab for RegSvcs.exe or msbuild.exe running with no reason, or any process with a lot of network use. Cyble and Deepwatch name RegSvcs.exe as a hiding place. Its presence is not proof (it is a real Windows program), and its absence does not clear the PC.
- 7
Check that protection is still on
Open Windows Security and look for red warnings under Virus & threat protection and Firewall & network protection. Then go to Virus & threat protection > Manage settings > Exclusions and look for folders you did not add. Deepwatch says a similar PowerShell stage changes Defender settings, so a switched off protection or an unknown exclusion is a strong reason to go on to the plan.
- 8
Check your accounts from another device
Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.
- 9
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a PC with these files, so the order of the plan is our judgement from Microsoft's pages, not a tested result.
How to remove surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags)
How to remove surun.info
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to surun.info or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever surun.info installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
The tags describe Windows threats and the files are PowerShell scripts. We found nothing that says surun.info affects anything else.
| Your device | What we know | What to do |
|---|---|---|
| Mac | The files are .ps1 scripts and the families named are Windows threats | Nothing to remove for this threat. Do not follow the Windows steps on a Mac |
| iPhone or iPad | No source describes this on iOS | Nothing to remove. If you typed passwords on a suspicious page, change them |
| Android | No source mentions it | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After a clean PC: protect what was taken
The PC is one half. The other half is everything you typed or stored on it while a trojan may have been there. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
Start with email, because it resets everything else, then bank, work, cloud storage and crypto. Anything typed on the PC while it was watched is already known. Do this on a phone or another computer, never on the PC in question.
- 2
Sign out other sessions and turn on two step sign in
Most large services let you sign out of all devices from the security page of the account. Turn on two step sign in with an authenticator app or a security key where it is offered, and update the recovery email and phone.
- 3
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there.
- 4
Run Microsoft Defender Offline
Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows restarts and the scan takes several minutes. It runs outside the normal Windows, so malware has a harder time hiding. Results appear under Protection history. If BitLocker is on, suspend it first or the restart may ask for the recovery key.
- 5
Remove what the check found, with care
If the Startup folder, Task Scheduler or Startup apps showed an entry that you can tie to the malware, remove it. If you cannot tell, do not guess: the safe answer is the reset below. Turn Defender and the firewall back on if they were off, and delete exclusions you did not add.
- 6
If you are not sure, reset Windows
Go to Settings > System > Recovery > Reset this PC. Keep my files removes apps and settings but keeps personal files; Remove everything wipes the PC. For a PC that may have been under remote control, the full wipe is the answer that does not depend on finding every piece. Back up documents first.
- 7
Restore only documents by hand
Copy back documents and photos, not programs, and not a full system image from after the first contact. Install apps from their makers' own sites.
- 8
Rebuild logins in a password manager
Do not let the browser save passwords again on a PC that was watched. Use a password manager and an authenticator app or security key.
- 9
Watch your money and your accounts
Check card statements and exchange logs for a few weeks and turn on alerts. If personal data was stolen, report it to your national fraud or identity theft service.
If you own surun.info or run a site on it
A domain registered in 2018 may belong to someone whose server was hacked, and URLhaus reports are about files, not about who put them there. We do not know whether surun.info is a bad domain or a hijacked one. If it is yours, these are the steps that follow from the facts.
- 1
Look at the folders in the reports
Check whether /nh1ykmf/qagxfjr/wxtrdlm/ and /nh1ykmf/qagxfjr/cc/ exist on your server. Random looking folder names that you did not create are a sign that someone else uploaded files. The opendir tag says the listing was open, so also turn off directory listing.
- 2
Find how the files got there
Check access logs around 22 September 2026, upload forms, outdated plugins and the accounts that can write to the server. Change all passwords and keys for the hosting panel, FTP, SSH and the database.
- 3
Clean up and restore
Remove the files you did not create, restore the site from a backup made before the incident if you have one, and update everything. A host that only deletes the files without closing the way in will see them return.
- 4
Check the domain account
RDAP lists GoDaddy.com, LLC as registrar and shows the lock flags client delete, renew, transfer and update prohibited, which is a normal protective state. Still check the registrar account for unknown logins and turn on two step sign in.
- 5
Ask for a review
When the server is clean, you can ask abuse.ch to review the entries. The files are already offline, so the listing will not change by itself without your report.
Keep a PC out of this kind of chain
The PowerShell file is the late part of the chain. Every write-up we read starts earlier, with a script or a file that a person opened.
Do
- Treat an unexpected script, zip or Office attachment as an attack, and close it. Cyble's chain began with a VBScript.
- Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
- Show file endings in File Explorer so a .vbs or .ps1 file posing as a document is visible.
- Get programs from their makers' own sites or from the Microsoft Store.
- Use a password manager and two step sign in, so one stolen password is not enough.
- Keep a backup of documents on a disk that you unplug.
Don't
- Do not open attachments from senders you do not expect, even when the file looks like an invoice or an order.
- Do not run cracked programs or bundles from sites that promise free versions of paid software.
- Do not paste a PowerShell command from a web page or a message that you do not understand.
- Do not change your passwords on the PC you suspect.
- Do not rely on a quiet scan to say that you are safe.
Questions about surun.info (PowerShell files, AveMariaRAT, Formbook, Expiro tags)
What is surun.info?
It is a web address that URLhaus, the malware tracking project run by abuse.ch, lists for ten PowerShell files added on 22 September 2026. One is tagged AveMariaRAT and rat, one Formbook and one expiro. All ten are marked offline in our copy of the data.
It is not a program on your PC and not a website anyone is meant to visit. We did not download the files, so what they contain is not confirmed by us, and we found no public write-up of this one address.
Is surun.info safe to open?
No. Do not request files from it, and do not run anything that does. Our own plain request to the address on 17 October 2026 timed out, which proves nothing: servers that hand out malware often have nothing on the front door, or switch off after a few days.
The files being offline today does not make the address safe, because they can be put back, and it does not help a PC that fetched them earlier. The rating comes from the ten URLhaus reports and their tags.
What are the .ps1 files on surun.info?
A .ps1 file is a PowerShell script, plain text that Windows can run. The names, such as Crypted, Cryptedk and neriCrypted, suggest packed or encrypted content, but that is our reading of the names.
Vendors describe PowerShell stages that decode a hidden .NET program and run it inside RegSvcs.exe. We did not open these files, so we cannot say whether they work that way. A script only runs when something on the PC starts it.
What is AveMariaRAT?
Ave Maria, also called WarzoneRAT, is a remote access trojan: a program that lets another person control a PC. Microsoft lists four detections for it, Backdoor:MSIL/AveMariaRAT.A!MTB to .D!MTB, all rated severe.
Cyble and Deepwatch describe PowerShell chains that inject it into RegSvcs.exe and change Defender and firewall settings. One file on surun.info carries this tag. A tag is a label on a file, not proof of what every file in the folder does.
What do the Formbook and expiro tags mean?
They are names of malware families attached to one file each: Formbook to cc/Cryptedt.ps1 and expiro to crypted.ps1. Trend Micro describes Expiro as a Windows file infector that attaches its body to program files, contacts remote sites and spreads through downloads and network shares.
For Formbook we found no readable vendor page during this research, so we say nothing about what it does. Neither tag proves that a given PC was infected.
I saw surun.info in my firewall or DNS log. Am I infected?
Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page:
- Protection history
- the Startup folder and Startup apps
- Task Scheduler
- Task Manager
- a Microsoft Defender Offline scan
Do the account changes from another device. The files are offline now, so the request may also have failed.
How do I remove this from Windows?
Change your passwords from another device first. Then run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check the Startup folder, Startup apps and Task Scheduler for entries you did not make, make sure Defender and the firewall are on, and remove the entries you can tie to the malware.
If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages and did not test the steps on an infected PC.
Does surun.info affect Mac, iPhone or Android?
We found nothing that says so. The files are PowerShell scripts and the families named are Windows threats.
On a Mac, iPhone or Android phone there is nothing to remove for this threat; if you typed a password on a suspicious page, change it. Only a Windows PC that ran a script fetching these files is in question.
Will resetting Windows remove it, and are my accounts safe afterwards?
A reset with Remove everything wipes the programs and startup entries, which is the answer that does not depend on finding every piece. It does not undo what was already taken.
Passwords, session logins and crypto seed phrases that a trojan saw stay exposed until you change them, from another device, and turn on two step sign in. Restore documents by hand, not a full system image taken after the first contact.
Will Fortect remove surun.info?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For surun.info, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Microsoft Security Intelligence: Backdoor:MSIL/AveMariaRAT detections (A and B updated 25 November 2022, C and D updated 20 December 2022) (read October 17, 2026)
- Trend Micro threat encyclopedia: PE_EXPIRO entries (file infector) (read October 17, 2026)
- Cyble: WarzoneRAT returns with multi stage attack post FBI seizure (read October 17, 2026)
- Deepwatch: Cyber Intel Brief, 28 March to 3 April 2024 (WarzoneRAT PowerShell stage) (read October 17, 2026)
- abuse.ch MalwareBazaar: PowerShell sample tagged AveMariaRAT, first seen 2026-09-03 (read October 17, 2026)