top title background image
flash

SecuriteInfo.com.Trojan.Packed.140.25706.exe

Status: finished
Submission Time: 2020-08-01 21:35:37 +02:00
Malicious
Trojan
Evader
Trickbot

Comments

Tags

Details

  • Analysis ID:
    255653
  • API (Web) ID:
    406845
  • Analysis Started:
    2020-08-01 23:22:25 +02:00
  • Analysis Finished:
    2020-08-01 23:29:36 +02:00
  • MD5:
    b7c00c44013156eb819069183f99bba9
  • SHA1:
    7c64c8c6dff74b5c44b070f0a69284b1edd6e86b
  • SHA256:
    39763b9851a6b87da54699ba9ed40e475fe9f6c8b07b0c7a43c914fbfa0b1f45
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 88
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
91.235.129.20
Ukraine
185.99.2.66
Bosnia and Herzegowina
134.119.191.11
Germany
Click to see the 2 hidden entries
85.204.116.216
Romania
190.136.178.52
Argentina

Domains

Name IP Detection
asf-ris-prod-neurope.northeurope.cloudapp.azure.com
168.63.67.155
icanhazip.com
116.202.55.106

URLs

Name Detection
https://190.136.178.52:449/ono57/579569_W10017134.BB37133BBDD0AA51FFB700D7F858D77D/0/Windows%2010%20
https://goo.gl/1FhVpgPersistent-AuthWWW-AuthenticateVarySet-CookienginxServerRetry-AfterProxy-Suppor
https://goo.gl/1FhVpg
Click to see the 8 hidden entries
https://sectigo.com/CPS0
https://190.136.178.52:449/Z
http://icanhazip.com/
https://190.136.178.52:449
https://190.136.178.52:449/ono57/579569_W10017134.BB37133BBDD0AA51FFB700D7F858D77D/5/spk/
https://190.136.178.52:449/ono57/579569_W10017134.BB37133BBDD0AA51FFB700D7F858D77D/5/spk/s
https://190.136.178.52:449/
http://bit.ly/icanhazip-faq

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58139 bytes, 1 file
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Users\user\AppData\Local\Temp\logFC60.tmp
Non-ISO extended-ASCII text, with CRLF line terminators
#