top title background image
flash

widnOAntje.exe

Status: finished
Submission Time: 2023-03-20 18:10:21 +01:00
Malicious
Evader
Trojan
Spyware
AgentTesla

Comments

Tags

  • AgentTesla
  • exe
  • Telegram

Details

  • Analysis ID:
    830834
  • API (Web) ID:
    1197929
  • Original Filename:
    4d5ea75ef0273df2b1e2463dd7472cf1.exe
  • Analysis Started:
    2023-03-20 18:18:13 +01:00
  • Analysis Finished:
    2023-03-20 18:38:06 +01:00
  • MD5:
    4d5ea75ef0273df2b1e2463dd7472cf1
  • SHA1:
    cdd8e983ba556f08faf43b29dcdc134658c39b55
  • SHA256:
    0b3b2b8094ce254dcd224e91a84b116e806b8cc7fc895fed43cf9ea350743338
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 56
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 96
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301

Third Party Analysis Engines

malicious
Score: 35/66
malicious
Score: 13/39

IPs

IP Country Detection
149.154.167.220
United Kingdom

Domains

Name IP Detection
api.telegram.org
149.154.167.220

URLs

Name Detection
https://api.telegram.org/bot5494052141:AAF2aO4sQ_tu4BOnk0pmxB995km7Mslduy0/sendDocument
https://picsum.photos/80
https://krdict.korean.go.kr/api/search?key=AEBB6D3290D88C645CF1452F7DA3229D0
Click to see the 4 hidden entries
https://api.telegram.org/bot5494052141:AAF2aO4sQ_tu4BOnk0pmxB995km7Mslduy0/
https://api.telegram.org
http://api.telegram.org
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\widnOAntje.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\trktna5t.oee\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3036000, file counter 36, database pages 24, 1st free page 14, free pages 11, cookie 0x5, schema 4, UTF-8, version-valid-for 36
#
C:\Users\user\AppData\Roaming\trktna5t.oee\Edge Chromium\Default\Cookies
SQLite 3.x database, last written using SQLite version 3035005, file counter 7, database pages 5, cookie 0x4, schema 4, UTF-8, version-valid-for 7
#
Click to see the 1 hidden entries
C:\Users\user\AppData\Roaming\trktna5t.oee\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
#