flash

sSQ1r2KRD8.exe

Status: finished
Submission Time: 16.09.2020 20:05:52
Malicious
Trojan
Spyware
Evader
MassLogger RAT

Comments

Tags

  • exe
  • MassLogger

Details

  • Analysis ID:
    286546
  • API (Web) ID:
    468296
  • Analysis Started:
    16.09.2020 20:05:53
  • Analysis Finished:
    16.09.2020 20:23:23
  • MD5:
    d408d9b719debd7ac1a42cae6128890f
  • SHA1:
    cabbd9c628578f60bc6d6c09d49123cd9deda8b0
  • SHA256:
    27ed7853f8176995ba85c2fb099e49a6344c9d8afa38b2cb8d137032d96f9db8
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
31/66

malicious
14/38

malicious
36/48

malicious

IPs

IP Country Detection
54.235.83.248
United States
54.225.66.103
United States
174.129.214.20
United States

Domains

Name IP Detection
elb097307-934924932.us-east-1.elb.amazonaws.com
174.129.214.20
api.ipify.org
0.0.0.0

URLs

Name Detection
http://api.ipify.org/Pv
http://api.ipify.org/
http://api.ipify.org/p
Click to see the 9 hidden entries
http://www.codeplex.com/DotNetZip.
https://www.youtube.com/watch?v=Qxk6cu21JSg
http://api.ipify.org4
http://api.ipify.orgD
http://elb097307-934924932.us-east-1.elb.amazonaws.com
http://api.ipify8
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://api.ipify.org
http://surdmutablet.com/panel/?/upload

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\appdata\hdhskdhl.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\appdata\hdhskdhl.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
Click to see the 8 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_hdhskdhl.exe_62353bac14fb45e5436d1253beacee2f39bbe7_de5b8f1d_1aa33460\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2116.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Sep 17 03:07:20 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D8B.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E28.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\B164D5310B\DotNetZip-axk3iqgs.tmp
Zip archive data, at least v2.0 to extract
#
C:\Users\user\AppData\Local\B164D5310B\Log.txt
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\B164D5310B\Screenshot.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
#
C:\Users\user\AppData\Roaming\appdata\hdhskdhl.exe:ZoneIdentifier
empty
#