top title background image
flash

rJUSTIFICANTEDEPAGO.exe

Status: finished
Submission Time: 2023-03-20 10:47:06 +01:00
Malicious
Trojan
Evader
Spyware
GuLoader, AgentTesla

Comments

Tags

  • exe

Details

  • Analysis ID:
    830400
  • API (Web) ID:
    1197499
  • Analysis Started:
    2023-03-20 10:47:08 +01:00
  • Analysis Finished:
    2023-03-20 11:35:26 +01:00
  • MD5:
    e542cf9ce8a67a5b681cc9b0004e0b10
  • SHA1:
    40161158f7cab76c57b4d95798c74ebc7d612cfe
  • SHA256:
    4e78f6957f4c8c0f56a9b49e139342b1df7b1dc05518d96e776aa687a80f8c58
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 60
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 96
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301

Third Party Analysis Engines

malicious
Score: 15/69

IPs

IP Country Detection
172.217.16.206
United States
142.250.186.33
United States

Domains

Name IP Detection
drive.google.com
172.217.16.206
googlehosted.l.googleusercontent.com
142.250.186.33
doc-0s-98-docs.googleusercontent.com
0.0.0.0

URLs

Name Detection
https://github.com/dotnet/runtimeBSJB
https://doc-0s-98-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/npt87m3l1utm86tkghdjh82fk6qcfges/1679307750000/00651307112604445902/*/1Ll5Auv3nDnZ4O0Qt2f2ZcFUknFi4BgKW?e=download&uuid=ea605c4e-1574-48ab-a781-ae85f09da2da
http://nsis.sf.net/NSIS_ErrorError
Click to see the 3 hidden entries
https://doc-0s-98-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/npt87m3l
https://doc-0s-98-docs.googleusercontent.com/%%doc-0s-98-docs.googleusercontent.com
https://github.com/dotnet/runtime

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Biofeedback\Zonar187\Fgtedes\Kisser\battery-level-90-charging-symbolic.svg
SVG Scalable Vector Graphics image
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Nonconcessive\Gennemgaas\Dispend70\colorimeter-colorhug-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Nonconcessive\Gennemgaas\Dispend70\media-playlist-consecutive-symbolic.svg
SVG Scalable Vector Graphics image
#
Click to see the 11 hidden entries
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Nonconcessive\Gennemgaas\Dispend70\network-offline-symbolic.svg
SVG Scalable Vector Graphics image
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Nonconcessive\Gennemgaas\Dispend70\network-wireless.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Nonteachable\Bekmpelsesforanstaltninger\Carcinoid2\Efterplaprer\System.Reflection.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Rntgenstraaler\Overholde\Wingdings\Preaddition.Bor
ASCII text, with very long lines (36518), with no line terminators
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Rntgenstraaler\Overholde\Wingdings\System.Reflection.TypeExtensions.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Stereoing\preferences-desktop-font-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Stereoing\task-due-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Stereoing\window-close.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Stersfarterne\Svigermdrenes.Hip
data
#
C:\Users\user\AppData\Local\Temp\nsz62F8.tmp\AdvSplash.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\nsz62F8.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#