Register Login

sloganpng

top title background image

citadel_1.3.4.5.exe

Status: finished

Submission Time: 2020-07-19 20:46:18 +02:00

Malicious

E-Banking Trojan

Trojan

Evader

ZeusVM

Comments

Tags

Details

Analysis ID:
247228
API (Web) ID:
390097
Analysis Started:

2020-07-20 00:42:28 +02:00
Analysis Finished:

2020-07-20 00:50:34 +02:00
MD5:
8dea3337a2681be366086df2563375ec
SHA1:
e89098c215538c7afa1f550fc0d73264be1900ab
SHA256:
ff92eb5433354ad51ba6c586ed91e8b69f32271b0d523352c87f8ae4d075151b
Technologies:

Engines
IOCs

Joe Sandbox

Engine	Download Report	Detection	Info
		malicious
	Full Report Management Report IOC Report	malicious Score: 100	System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report

malicious

Score: 58/69

Open Full Report

malicious

Score: 27/42

malicious

Score: 28/31

malicious

IPs

IP	Country	Detection
1.3.4.5	China

URLs

Name	Detection
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x.phpfilefile
http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x.php

Dropped files

Name	File Type	Hashes	Detection
C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML	exported SGML document, UTF-8 Unicode text, with CRLF line terminators	#
C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak	exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	#
Click to see the 1 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML	ASCII text, with CRLF line terminators	#