top title background image
flash

SecuriteInfo.com.Trojan.PackedNET.368.27409.exe

Status: finished
Submission Time: 2020-08-01 15:29:13 +02:00
Malicious
Trojan
Evader
MassLogger RAT

Comments

Tags

Details

  • Analysis ID:
    255521
  • API (Web) ID:
    406581
  • Analysis Started:
    2020-08-01 15:29:14 +02:00
  • Analysis Finished:
    2020-08-01 15:36:48 +02:00
  • MD5:
    83b2e446ef645c76f7426736f4917a1d
  • SHA1:
    932402f459b63382fe5bb26c30abfed5bf907580
  • SHA256:
    1a5a011f8d38b7b3ce3dc46694f3557a0249b2e0495621e557df68e077bd5007
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 68
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

URLs

Name Detection
http://www.codeplex.com/DotNetZip.
https://www.youtube.com/watch?v=Qxk6cu21JSg
http://api.ipify.orgD

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\RegAsm.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PackedNET.368.27409.exe.log
ASCII text, with CRLF line terminators
#
Click to see the 4 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12zyyea2.omh.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njssx54k.trr.ps1
very short file (no magic)
#
C:\Users\user\Documents\20200801\PowerShell_transcript.506013.o4mSlqmO.20200801153106.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#