Register Login

sloganpng

top title background image

SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe

Status: finished

Submission Time: 2020-11-27 10:41:22 +01:00

Malicious

Trojan

Adware

Evader

AgentTesla

Comments

Tags

Details

Analysis ID:
323672
API (Web) ID:
549132
Analysis Started:

2020-11-27 10:41:26 +01:00
Analysis Finished:

2020-11-27 10:54:28 +01:00
MD5:
9817218c055db1b75d64df2ae2f40f53
SHA1:
c5233c8d5a0973a76186707337a952a73c02b07e
SHA256:
ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8
Technologies:

Engines
IOCs

Joe Sandbox

Engine	Download Report	Detection	Info
		malicious
	Full Report Management Report IOC Report	malicious Score: 100	System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report

malicious

Score: 27/71

Open Full Report

malicious

Score: 5/37

malicious

Score: 14/48

IPs

IP	Country	Detection
104.23.98.190	United States

Domains

Name	IP	Detection
pastebin.com	104.23.98.190

URLs

Name	Detection
http://schemas.xmlsoap.org/wsdl/
http://www.apache.org/licenses/LICENSE-2.0.html8
https://api.ipify.orgGETMozilla/5.0
Click to see the 15 hidden entries
https://github.com/Pester/Pester8
http://pesterbdd.com/images/Pester.png8
https://github.com/Pester/Pester
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://gypycQ.com
https://api.telegram.org/bot%telegramapi%/
http://www.apache.org/licenses/LICENSE-2.0.html
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://schemas.xmlsoap.org/soap/encoding/
http://pesterbdd.com/images/Pester.png
http://crl.m
http://DynDns.comDynDNS
http://127.0.0.1:HTTP/1.1

Dropped files

Name	File Type	Hashes	Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe.log	ASCII text, with CRLF line terminators	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe:Zone.Identifier	ASCII text, with CRLF line terminators	#
Click to see the 13 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3i44lw5f.d2x.ps1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_divrs4p2.qmp.psm1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3yslelb.mfk.ps1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0cgkrpy.lx1.psm1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2jlipkf.1y1.ps1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mufbm2g2.2lz.psm1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xk5gz5yj.lnm.ps1	very short file (no magic)	#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5ws434f.y2b.psm1	very short file (no magic)	#
C:\Users\user\Documents\20201127\PowerShell_transcript.849224.+lqbRRN1.20201127104302.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	#
C:\Users\user\Documents\20201127\PowerShell_transcript.849224.E60ONHS3.20201127104300.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	#
C:\Users\user\Documents\20201127\PowerShell_transcript.849224.VosWW7ND.20201127104259.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	#
C:\Users\user\Documents\20201127\PowerShell_transcript.849224.e7cWhL8o.20201127104302.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	#