Statement of Account.exe

Options

Comments

Tags

• AgentTesla
• exe

AgentTesla exe

Add new tag

Available tags:

No tags available...

• Engines
• IOCs

Full Report	Management Report	IOC Report	Engine	Info	Verdict	Score	Reports
		New		System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211		100/100
						18/71
						5/44

IPs

IP	Country	Detection
23.254.244.17	United States

Domains

Name	IP	Detection
chestronic.com	23.254.244.17
mail.chestronic.com	0.0.0.0

URLs

Name	Detection
http://cV9LNZgDQeR7CK6z.org
https://api.ipify.org/
http://127.0.0.1:HTTP/1.1
Click to see the 12 hidden entries
https://api.ipify.org
http://DynDns.comDynDNS
https://sectigo.com/CPS0
http://sjSmfS.com
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
https://api.telegram.org/bot%telegramapi%/
http://chestronic.com
http://mail.chestronic.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://api.ipify.orgGETMozilla/5.0

Dropped files

Name	File Type	Hashes	Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Statement of Account.exe.log	ASCII text, with CRLF line terminators	#
C:\Users\user\AppData\Local\Temp\tmpBACF.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\Users\user\AppData\Roaming\eRwRffX.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	#
Click to see the 2 hidden entries
C:\Users\user\AppData\Roaming\eRwRffX.exe:Zone.Identifier	ASCII text, with CRLF line terminators	#
C:\Users\user\AppData\Roaming\sh0vu41c.d1k\Chrome\Default\Cookies	SQLite 3.x database, last written using SQLite version 3032001	#