top title background image
flash

điện chuyển tiền 2002-Sacombank.exe

Status: finished
Submission Time: 2020-09-21 15:25:59 +02:00
Malicious
Trojan
Evader
Nanocore

Comments

Tags

Details

  • Analysis ID:
    288062
  • API (Web) ID:
    471254
  • Analysis Started:
    2020-09-21 15:26:05 +02:00
  • Analysis Finished:
    2020-09-21 15:40:35 +02:00
  • MD5:
    1cf81ecb60092d5630fe9000420d3245
  • SHA1:
    55c053e4822a81ba75ba9f1d19763d7840851265
  • SHA256:
    b05bbc1ec002c006b0df222fa5d97881cc892a8b2a107a92f0ed5956520f0674
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 15/66
malicious

IPs

IP Country Detection
79.134.225.72
Switzerland

URLs

Name Detection
http://www.zhongyicts.com.cnr-f&v-F
http://www.founder.com.cn/cn/cThe
http://www.jiyu-kobo.co.jp/rIFF
Click to see the 45 hidden entries
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-jones.html
http://www.jiyu-kobo.co.jp/Kurs
http://www.carterandcone.comC
http://www.jiyu-kobo.co.jp/
http://www.galapagosdesign.com/DPlease
http://www.zhongyicts.com.cno.
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.fontbureau.com/designers8
http://www.zhongyicts.com.cnP
http://www.fonts.com
http://www.sandoll.co.kr
http://www.carterandcone.com8Fr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://www.sakkal.com
http://www.jiyu-kobo.co.jp/jp/rIFF
http://www.fontbureau.comiI-F
http://www.jiyu-kobo.co.jp/EIIFy
http://www.tiro.com
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.fontbureau.com/designersG
http://www.jiyu-kobo.co.jp/.IbFy
http://www.jiyu-kobo.co.jp/do
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
http://www.jiyu-kobo.co.jp/jp/.IbFy
http://www.carterandcone.comTC
http://www.fontbureau.com/designers?
http://www.jiyu-kobo.co.jp/4H
http://www.jiyu-kobo.co.jp/rz
http://www.fontbureau.com/designers
http://www.goodfont.co.kr
http://www.carterandcone.com
http://www.jiyu-kobo.co.jp/jp/
http://www.fontbureau.com/designersico
http://www.jiyu-kobo.co.jp/iI-F
http://www.fontbureau.comdiaa.IbFy
http://www.carterandcone.coml
http://www.sajatypeworks.com
http://www.founder.com.cn/cn/
http://www.typography.netD

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\#U0111i#U1ec7n chuy#U1ec3n ti#U1ec1n 2002-Sacombank.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmpB13C.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
Non-ISO extended-ASCII text, with no line terminators
#
Click to see the 53 hidden entries
C:\Users\user\AppData\Roaming\HzzWxAPgBBRCvn.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\HzzWxAPgBBRCvn.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1qr5jwh.kmk.psm1
very short file (no magic)
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.xG_nQ6Eb.20200921152721.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yevlhgzu.mo0.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxunozaq.hxr.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\tmp43F.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmpF71F.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
data
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
data
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
data
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat
ASCII text, with no line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.176wagTk.20200921152722.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.1_Wigw85.20200921152716.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.2emsqsv3.20200921152729.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.3IbsYZA6.20200921152726.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.MLwPu2mh.20200921152728.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.Oemh9a_8.20200921152706.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.PRn9E2kF.20200921152725.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.XziddB_Q.20200921152723.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.e_EYfIGp.20200921152725.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.enwjZq+Y.20200921152718.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.guJekrfy.20200921152718.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.qDsGFjBp.20200921152713.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200921\PowerShell_transcript.675052.r_JUabaf.20200921152725.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bq2k1a50.1re.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14ph4cbz.1w1.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14z1xds1.1qh.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jajmcb1.zik.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vivlpo0.gjo.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jch5m1f.2t4.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3btktcnd.hdy.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vstegdk.5vp.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_53gynxxs.kzs.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a4eljozl.ir5.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bgatkb0k.po4.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bkjsn51k.dew.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uql3bgsx.qfp.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmgutvcb.dhe.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i25yanyf.b0i.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4lkg55j.sut.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lw2qagyg.0ie.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyxyhnk5.ptl.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nowl3nhu.mhu.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ow4zx5nf.ucy.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqv0eh4r.t3k.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsyzqm3t.wxi.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rk4x0tk3.k4w.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_si5sc0al.yzn.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_srwwszoe.4sk.ps1
very short file (no magic)
#