flash

Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe

Status: finished
Submission Time: 2023-01-25 09:52:48 +01:00
Malicious
Trojan
Evader
Spyware
AgentTesla, GuLoader

Comments

Tags

Details

  • Analysis ID:
    791299
  • API (Web) ID:
    1158562
  • Analysis Started:
    2023-01-25 09:52:49 +01:00
  • Analysis Finished:
    2023-01-25 10:19:43 +01:00
  • MD5:
    17388d36388d280c4e2d724c9ab58002
  • SHA1:
    ee660100dfbad59a2796244514bff64c66cd0ca7
  • SHA256:
    5f20a33e263b8b8f5388b8e2512d0678312257b8fdf592b8a83aa481076048ca
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
64/100

System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

malicious
100/100

malicious
23/70

IPs

IP Country Detection
103.83.194.19
United States
192.185.87.146
United States
64.185.227.155
United States

Domains

Name IP Detection
ftp.sentientshift.com
0.0.0.0
api4.ipify.org
64.185.227.155
sentientshift.com
192.185.87.146
Click to see the 2 hidden entries
enlluec.tk
103.83.194.19
api.ipify.org
0.0.0.0

URLs

Name Detection
https://api.ipify.org/
http://ftp.sentientshift.com
http://www.apache.org/licenses/LICENSE-2.0
Click to see the 9 hidden entries
https://api.ipify.org
http://sentientshift.com
http://creativecommons.org/licenses/by-sa/4.0/
http://nsis.sf.net/NSIS_Error
http://nsis.sf.net/NSIS_ErrorError
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://enlluec.tk/dkVAJHULLLAJIKvMzyyDm233.pcx
http://mozilla.org/MPL/2.0/.
https://enlluec.tk/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\nsExec.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\0bpuok1y.lva\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3036000, file counter 36, database pages 24, 1st free page 14, free pages 11, cookie 0x5, schema 4, UTF-8, version-valid-for 36
#
Click to see the 8 hidden entries
C:\Users\user\AppData\Roaming\0bpuok1y.lva\Edge Chromium\Default\Cookies
SQLite 3.x database, last written using SQLite version 3035005, file counter 7, database pages 5, cookie 0x4, schema 4, UTF-8, version-valid-for 7
#
C:\Users\user\AppData\Roaming\0bpuok1y.lva\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
#
C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
#
C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Reinspired.Aut
ASCII text, with very long lines (50244), with no line terminators
#
C:\Users\user\Pacifisterne\Automatcafeer\Seacross.Him
data
#
C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne\default.css
Unicode text, UTF-8 text
#
C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne\network-cellular-signal-none-symbolic.svg
SVG Scalable Vector Graphics image
#
C:\Users\user\Pacifisterne\Automatcafeer\Tubulating\application-x-executable.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#