top title background image
flash

SecuriteInfo.com.generic.ml.22865.exe

Status: finished
Submission Time: 2022-05-26 14:04:12 +02:00
Malicious
Trojan
Evader
Spyware
GuLoader, AgentTesla

Comments

Tags

  • exe

Details

  • Analysis ID:
    634596
  • API (Web) ID:
    1002100
  • Analysis Started:
    2022-05-26 14:04:15 +02:00
  • Analysis Finished:
    2022-05-26 14:27:16 +02:00
  • MD5:
    deb3e51a2d7d566c86b22046c1058f1a
  • SHA1:
    a780f7bbf2255a7dcd963c80fad20ee164ca6b93
  • SHA256:
    4b4bb7b5e2fbe3814fca75d1ab132a97c67255ebfe6dc4f3312d64483a181286
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 72
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 100
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

Third Party Analysis Engines

malicious
Score: 6/67
malicious
Score: 5/26

IPs

IP Country Detection
5.9.197.244
Germany
149.154.167.220
United Kingdom

Domains

Name IP Detection
fides-kenya.com
5.9.197.244
www.fides-kenya.com
0.0.0.0
api.telegram.org
149.154.167.220

URLs

Name Detection
http://www.fides-kenya.com/yem/wam.bin
https://support.google.com/chrome/?p=plugin_flash
https://api.telegram.org/bot5147163644:AAEDa60jT_0f_OgilwiEp-CBiARVO2Rx3Mo/sendDocumentdocument-----
Click to see the 15 hidden entries
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest
https://api.telegram.org/bot5147163644:AAEDa60jT_0f_OgilwiEp-CBiARVO2Rx3Mo/sendDocument
http://nsis.sf.net/NSIS_ErrorError
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
http://scripts.sil.org/OFLSource
http://www.avast.com0/
http://127.0.0.1:HTTP/1.1
http://DynDns.comDynDNSnamejidpasswordPsi/Psi
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
http://hqQZjN.com
https://api.telegram.org/
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
https://api.telegram.org
http://creativecommons.org/licenses/by-sa/4.0/
http://V58nqJBvA8Uitwi1EyuW.com

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\ArtDeco_green_6.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
#
C:\Users\user\AppData\Local\Temp\MpCommu.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\Temp\OLIGOCARPOUS.SNO
data
#
Click to see the 13 hidden entries
C:\Users\user\AppData\Local\Temp\SourceCodePro-Black.otf
OpenType font data
#
C:\Users\user\AppData\Local\Temp\analysekapitlet.ini
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\applications-system.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\lang-1034.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\libfreetype-6.dll
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\Temp\libpcre-1.dll
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\Temp\lilas.lnk
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
#
C:\Users\user\AppData\Local\Temp\microphone-hardware-disabled-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\multimedia-player-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\network-server.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\nsr150B.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\task-past-due.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
\Device\ConDrv
ASCII text, with CRLF line terminators
#