top title background image
flash

vmzeus_3.3.2.0.exe

Status: finished
Submission Time: 2020-07-19 20:46:07 +02:00
Malicious
E-Banking Trojan
Trojan
Evader
ZeusVM

Comments

Tags

  • vmzeus
  • ZeuS

Details

  • Analysis ID:
    247223
  • API (Web) ID:
    390087
  • Analysis Started:
    2020-07-20 00:32:49 +02:00
  • Analysis Finished:
    2020-07-20 00:41:59 +02:00
  • MD5:
    f1478eb97a80b4dc8113447d52764527
  • SHA1:
    ad9a1528b5dcf820f0790f8f2ffefa8839cd43a0
  • SHA256:
    fa5f5817b08add918117f89e06e53abea40fcda0ae3ae588622f9c1a73202cae
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 57/71
malicious
Score: 22/39
malicious
Score: 25/31
malicious

IPs

IP Country Detection
3.3.2.0
United States

Domains

Name IP Detection
maximorong.biz
0.0.0.0

URLs

Name Detection
http://maximorong.biz/html/r
http://maximorong.biz/html/M
http://maximorong.biz/
Click to see the 2 hidden entries
http://maximorong.biz/html/
http://maximorong.biz/html/z

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Mozilla\winMozilla.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_winMozilla.exe_40ed9ee615d74411aa8f6afff5a3a9c29ea8a_54c63b09_12dd7b46\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_winMozilla.exe_cd573b6f11e82819bd4b02f9661d36191773862_54c63b09_10818633\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 15 hidden entries
C:\Users\user\AppData\Local\Temp\tmpa8313950.bat
DOS batch file, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER600F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8615.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER851A.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER825A.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Jul 19 22:34:40 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B19.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A7C.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER78F4.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Jul 19 22:34:37 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vmzeus_3.3.2.0.e_271be6cd54a298ba3853578999248928bc6da3fa_f82afa80_06e54ff0\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F43.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D1F.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Jul 19 22:34:30 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FC3.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EF7.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BAA.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Jul 19 22:34:26 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vmzeus_3.3.2.0.e_52ac9d5e32d983cbb583dd22a6f85e1b62156e2f_f82afa80_13cd603c\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#