flash

Stament of accounts000003456.exe

Status: finished
Submission Time: 17.10.2020 08:32:57
Malicious
Trojan
Evader
AgentTesla

Comments

Tags

  • AgentTesla
  • exe

Details

  • Analysis ID:
    299583
  • API (Web) ID:
    494265
  • Analysis Started:
    17.10.2020 08:32:58
  • Analysis Finished:
    17.10.2020 08:39:10
  • MD5:
    530c77f91f25e8bbfabe3fda6b152186
  • SHA1:
    c76f26963b4243393ef3faa19e6a7589ca3f0552
  • SHA256:
    1c64da703977c94a7f140c37efa896abc2ecb880a9f66588c98d0120ac5e0a82
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
18/71

malicious
14/29

URLs

Name Detection
https://7TBbRyvIwRJnNxdknuY7.org
http://127.0.0.1:HTTP/1.1
http://DynDns.comDynDNS
Click to see the 10 hidden entries
https://7TBbRyvIwRJnNxdknuY7.orgscServer32
https://7TBbRyvIwRJnNxdknuY7.orgscServer32C:
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
https://api.telegram.org/bot%telegramapi%/
http://lVFsbt.com
http://mail.privateemail.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://api.ipify.orgGETMozilla/5.0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_345iowkj.2du.psm1
very short file (no magic)
#
Click to see the 3 hidden entries
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ia0alor0.5nj.ps1
very short file (no magic)
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\Documents\20201017\PowerShell_transcript.715575.ViiLAbu7.20201017083422.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#