Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

PO.exe

Status: finished
Submission Time: 2022-11-29 22:38:05 +01:00
Malicious
Trojan
Evader
Spyware
GuLoader, AgentTesla

Comments

Tags

  • exe

Details

  • Analysis ID:
    756266
  • API (Web) ID:
    1123542
  • Analysis Started:
    2022-11-29 22:38:05 +01:00
  • Analysis Finished:
    2022-11-29 23:00:53 +01:00
  • MD5:
    9297126fd9624f7dc2d4f64f072668a2
  • SHA1:
    c30b3c8fddd49f7dfba687026daf6293f6d90b1b
  • SHA256:
    edd8e1858bcc704fdea75837bb448eceda61317e7f8028e82aa2a0e5559c658a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 60
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

Third Party Analysis Engines

Open Full Report
malicious
Score: 21/72
malicious
Score: 7/26

IPs

IP Country Detection
149.154.167.220
 United Kingdom
162.159.133.233
 United States

Domains

Name IP Detection
cdn.discordapp.com
 162.159.133.233
api.telegram.org
 149.154.167.220

URLs

Name Detection
https://cdn.discordapp.com/
https://cdn.discordapp.com/attachments/1044649962652307570/1047171731867054230/bnezjstiSAD111.ocxt
https://cdn.discordapp.com/attachments/1044649962652307570/1047171731867054230/bnezjstiSAD111.ocxT
Click to see the 14 hidden entries
http://bLCeYs.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://api.telegram.org
https://api.telegram.org/bot5088709131:AAFHCIxHU907RAI3XEaH2G6LgE9wrdrAgI0/sendDocument
https://sFTel9k7EYFPshk.comt-Wl
http://nsis.sf.net/NSIS_ErrorError
http://127.0.0.1:HTTP/1.1
https://support.google.com/chrome/?p=plugin_flash
https://sFTel9k7EYFPshk.com
https://api.telegram.org/bot5088709131:AAFHCIxHU907RAI3XEaH2G6LgE9wrdrAgI0/sendDocumentdocument-----
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
https://cdn.discordapp.com/attachments/1044649962652307570/1047171731867054230/bnezjstiSAD111.ocx
https://api.telegram.org
http://DynDns.comDynDNS

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Diakonernes\Incongeniality\Ableptically\Omfattede\Iblanding\Heterodoxical.Ufo
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Diakonernes\Referenceliste\holdovers\open-menu-symbolic.svg
 SVG Scalable Vector Graphics image
 #
C:\Users\user\AppData\Local\Temp\TOBEN.lnk
 MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
 #
Click to see the 4 hidden entries
C:\Users\user\AppData\Local\Temp\nsr9735.tmp\System.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Roaming\hw3hufbj.yur\Chrome\Default\Cookies
 SQLite 3.x database, last written using SQLite version 3036000, file counter 36, database pages 24, 1st free page 14, free pages 11, cookie 0x5, schema 4, UTF-8, version-valid-for 36
 #
C:\Users\user\AppData\Roaming\hw3hufbj.yur\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite
 SQLite 3.x database, user version 12, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
 #
\Device\ConDrv
 ASCII text, with CRLF line terminators
 #