top title background image
flash

Swift_Copy.exe

Status: finished
Submission Time: 2021-04-12 15:20:23 +02:00
Malicious
Trojan
Spyware
Evader
AgentTesla

Comments

Tags

  • exe

Details

  • Analysis ID:
    385478
  • API (Web) ID:
    673061
  • Analysis Started:
    2021-04-12 15:20:24 +02:00
  • Analysis Finished:
    2021-04-12 15:30:03 +02:00
  • MD5:
    7c315e5221144ebe207421fcf5578985
  • SHA1:
    2d337a4c65ef709607da501c87f3127e61356e2f
  • SHA256:
    c9cf74378c0ab6240ef866be3673dd54a46b36ccf58a7c9036344f96fb812aee
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 22/69
malicious
Score: 15/48

IPs

IP Country Detection
77.88.21.158
Russian Federation

Domains

Name IP Detection
smtp.yandex.ru
77.88.21.158

URLs

Name Detection
http://www.galapagosdesign.com/
http://www.fonts.comX
http://www.fontbureau.comd
Click to see the 72 hidden entries
http://www.carterandcone.comfachUD
http://www.founder.com.cn/cnu-r
http://www.tiro.comn
http://www.carterandcone.comTC
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://www.fontbureau.comr=
http://DynDns.comDynDNS
http://www.carterandcone.comonaEUo
http://www.fontbureau.com
http://www.apache.org/licenses/LICENSE-2.0
http://www.sajatypeworks.comn
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://api.ipify.org%
http://www.sakkal.com
http://www.fontbureau.com/designersp
http://www.zhongyicts.com.cn
http://Mjyucn.com
http://www.fontbureau.comE.TTF
http://www.tiro.comh
http://www.fontbureau.com/designers:
http://www.carterandcone.comncy
http://www.fontbureau.com/designers/o
http://www.fontbureau.com/designers8
http://www.jiyu-kobo.co.jp/
http://www.founder.com.cn/cn/$
http://www.carterandcone.comy
http://www.urwpp.deDPlease
http://www.carterandcone.comypol;
http://www.fontbureau.commr=
http://www.fontbureau.com/designers/frere-user.html
http://www.founder.com.cn/cn
http://www.carterandcone.comint
http://www.founder.com.cn/cn.
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.carterandcone.coml
http://www.fontbureau.com/designersuR
http://www.founder.com.cn/cn/TS
http://www.fontbureau.comak=
http://www.carterandcone.com
http://www.goodfont.co.kr
http://www.carterandcone.comypooo
http://www.fontbureau.com/designers
http://www.carterandcone.comlaywU
http://www.tiro.com
http://www.fontbureau.comituF$=
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
http://www.carterandcone.comams
http://www.fontbureau.com/designers?
http://M7Hwvg39EZsNS3.net
http://www.fontbureau.com/designers.R
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.comO=
http://www.fontbureau.com/designers/?
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designersORe
http://www.sajatypeworks.comd
http://www.sandoll.co.kr
http://www.fonts.com
http://www.fontbureau.comessed3=
https://api.ipify.org%GETMozilla/5.0
http://www.galapagosdesign.com/DPlease
http://www.sajatypeworks.comriwnD
http://www.fontbureau.comB.TTF
http://127.0.0.1:HTTP/1.1
http://www.founder.com.cn/cnj
http://fontfabrik.com
http://www.galapagosdesign.com/staff/dennis.htm
http://www.founder.com.cn/cn/cThe
http://www.typography.netD
http://www.sajatypeworks.com
http://www.fontbureau.com/designersR
http://www.carterandcone.comypo

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Swift_Copy.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmp6587.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\NiUISpmncyqd.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 1 hidden entries
C:\Users\user\AppData\Roaming\NiUISpmncyqd.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#