top title background image
flash

PAGO.xlsx

Status: finished
Submission Time: 2021-04-08 12:33:12 +02:00
Malicious
Trojan
Spyware
Exploiter
Evader
AgentTesla

Comments

Tags

  • AgentTesla
  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    383929
  • API (Web) ID:
    669968
  • Analysis Started:
    2021-04-08 12:39:17 +02:00
  • Analysis Finished:
    2021-04-08 12:49:18 +02:00
  • MD5:
    db190ad25a453084bc89ecb5d46d6e0a
  • SHA1:
    999aacfcfee17aaa6231cf858af787d5ddce8774
  • SHA256:
    4273c2c75793063754de785ea06da2e149f8e659db159e94e73be5b23abdd3a7
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

malicious
Score: 20/60
malicious
Score: 16/48
malicious

IPs

IP Country Detection
5.10.29.169
United Kingdom
103.153.76.181
unknown
104.25.234.53
United States

Domains

Name IP Detection
wsdysuresbonescagegp.dns.army
103.153.76.181
smtp.lpsinvest.com
5.10.29.169
is.gd
104.25.234.53

URLs

Name Detection
http://wsdysuresbonescagegp.dns.army/documenpt/svchost.exe
https://api.ipify.org%GETMozilla/5.0
https://x8nMk45g8ETcNqX.org
Click to see the 14 hidden entries
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://api.ipify.org%
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://github.com/Spegeli/Pokemon-Go-Rocket-API/archive/master.zip
http://www.%s.comPA
http://127.0.0.1:HTTP/1.1
http://AFplKq.com
https://github.com/d-haxton/HaxtonBot/archive/master.zip
https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
http://smtp.lpsinvest.com
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
http://DynDns.comDynDNS

Dropped files

Name File Type Hashes Detection
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\Desktop\~$PAGO.xlsx
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\svchost[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 21 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8299D048.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 88x89, frames 3
#
C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DD298C7E.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C43329EC.png
PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B982CC9F.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B2AC4F99.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A1EB740D.png
PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\91086113.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 178x124, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\863DC596.png
PNG image data, 992 x 192, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\84B2BE14.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\806800C6.jpeg
gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\715928FD.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6CA41431.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\696809D7.png
PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5E7712AA.png
PNG image data, 1268 x 540, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4B3408F0.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4890E2DA.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 88x89, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\41D443A9.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 178x124, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2EF57FF8.png
PNG image data, 992 x 192, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1015AEA3.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\3F6ihf[1].htm
ASCII text, with CRLF line terminators
#