Loading... Additional Content is being loaded
Analysis Report c0nnect1on.dll
Overview
General Information
| Sample Name: | c0nnect1on.dll |
| Analysis ID: | 321589 |
| MD5: | 2d93116851211adfa6deba0a297a1c86 |
| SHA1: | 5be2f48e6ba3f71f1941b7fb8cc925c7fa4fd0bf |
| SHA256: | d365d2272c6be7f3420d9083251496bfa2f48e4b2ac2f3563b65c3b246714a18 |
| Tags: | dllgoziisfbitalytributariaUrsnif |
|
Most interesting Screenshot:  |
|
Detection
Ursnif
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Creates a COM Internet Explorer object
Machine Learning detection for sample
Writes or reads registry keys via WMI
Writes registry values via WMI
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Classification
AV Detection: |
  |
|---|
| Multi AV Scanner detection for submitted file |
| Source: |
Virustotal: |
Perma Link | ||
| Source: |
ReversingLabs: |
|||
| Machine Learning detection for sample |
| Source: |
Joe Sandbox ML: |
||
Networking: |
|
|---|
| Creates a COM Internet Explorer object |
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| Source: |
Key opened: |
Jump to behavior | ||
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| Source: |
IP Address: |
||
| JA3 SSL client fingerprint seen in connection with other malware |
| Source: |
JA3 fingerprint: |
||
| Source: |
HTTP traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: | ||