Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe
Analysis ID:	756003
MD5:	f64f729e0ba974c578afaac25665e067
SHA1:	d1225322fd5f16eb18a90ec4a4b007a010e2d51a
SHA256:	680f16527c5dc7e7e32bb27b99dcbc85c75282d853cb9a27c186963dae883d2e
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for dropped file

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Adds a directory exclusion to Windows Defender

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe (PID: 5644 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe MD5: F64F729E0BA974C578AFAAC25665E067)

powershell.exe (PID: 3216 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\UmpBcHBDbXhaX.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 3644 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UmpBcHBDbXhaX" /XML "C:\Users\user\AppData\Local\Temp\tmp4E8A.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe (PID: 5340 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe MD5: F64F729E0BA974C578AFAAC25665E067)

UmpBcHBDbXhaX.exe (PID: 624 cmdline: C:\Users\user\AppData\Roaming\UmpBcHBDbXhaX.exe MD5: F64F729E0BA974C578AFAAC25665E067)

schtasks.exe (PID: 3540 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UmpBcHBDbXhaX" /XML "C:\Users\user\AppData\Local\Temp\tmp8847.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

UmpBcHBDbXhaX.exe (PID: 5468 cmdline: C:\Users\user\AppData\Roaming\UmpBcHBDbXhaX.exe MD5: F64F729E0BA974C578AFAAC25665E067)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5796842243:AAESM2w0ubqts6zEsE_xN4PZ56pLfxQ9e7M/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5796842243:AAESM2w0ubqts6zEsE_xN4PZ56pLfxQ9e7M/sendMessage?chat_id=5733364805"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000000.363415114.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000000.363415114.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000006.00000000.363415114.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31883:$a13: get_DnsResolver 0x2ff53:$a20: get_LastAccessed 0x322b1:$a27: set_InternalServerPort 0x325e6:$a30: set_GuidMasterKey 0x30065:$a33: get_Clipboard 0x30073:$a34: get_Keyboard 0x3147d:$a35: get_ShiftKeyDown 0x3148e:$a36: get_AltKeyDown 0x30080:$a37: get_Password 0x30bd8:$a38: get_PasswordHash 0x31ce5:$a39: get_DefaultCredentials
0000000A.00000002.592547674.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.592981435.0000000002BF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.368700625.0000000002D78000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.370626906.0000000003E1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.370626906.0000000003E1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.370626906.0000000003E1E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x154b83:$a13: get_DnsResolver 0x18ada3:$a13: get_DnsResolver 0x1c0dc3:$a13: get_DnsResolver 0x153253:$a20: get_LastAccessed 0x189473:$a20: get_LastAccessed 0x1bf493:$a20: get_LastAccessed 0x1555b1:$a27: set_InternalServerPort 0x18b7d1:$a27: set_InternalServerPort 0x1c17f1:$a27: set_InternalServerPort 0x1558e6:$a30: set_GuidMasterKey 0x18bb06:$a30: set_GuidMasterKey 0x1c1b26:$a30: set_GuidMasterKey 0x153365:$a33: get_Clipboard 0x189585:$a33: get_Clipboard 0x1bf5a5:$a33: get_Clipboard 0x153373:$a34: get_Keyboard 0x189593:$a34: get_Keyboard 0x1bf5b3:$a34: get_Keyboard 0x15477d:$a35: get_ShiftKeyDown 0x18a99d:$a35: get_ShiftKeyDown 0x1c09bd:$a35: get_ShiftKeyDown
00000005.00000002.406721462.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000002.592124173.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.592124173.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.592099137.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000A.00000002.592099137.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.367157703.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000002.405119003.00000000029E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5644	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5644	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5644	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x68486:$a13: get_DnsResolver 0x67434:$a20: get_LastAccessed 0x68b28:$a27: set_InternalServerPort 0x68d0f:$a30: set_GuidMasterKey 0x6751a:$a33: get_Clipboard 0x67528:$a34: get_Keyboard 0x68203:$a35: get_ShiftKeyDown 0x68214:$a36: get_AltKeyDown 0x67535:$a37: get_Password 0x67c89:$a38: get_PasswordHash 0x68746:$a39: get_DefaultCredentials
Process Memory Space: UmpBcHBDbXhaX.exe PID: 624	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5340	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5340	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe PID: 5340	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x477e:$a13: get_DnsResolver 0x30ae:$a20: get_LastAccessed 0x515b:$a27: set_InternalServerPort 0x53c2:$a30: set_GuidMasterKey 0x31a9:$a33: get_Clipboard 0x31b7:$a34: get_Keyboard 0x4414:$a35: get_ShiftKeyDown 0x4425:$a36: get_AltKeyDown 0x31c4:$a37: get_Password 0x3c78:$a38: get_PasswordHash 0x4bb4:$a39: get_DefaultCredentials
Process Memory Space: UmpBcHBDbXhaX.exe PID: 5468	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: UmpBcHBDbXhaX.exe PID: 5468	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: UmpBcHBDbXhaX.exe PID: 5468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x327c4:$s10: logins 0x3223e:$s11: credential 0x2e465:$g1: get_Clipboard 0x2e473:$g2: get_Keyboard 0x2e480:$g3: get_Password 0x2f86d:$g4: get_CtrlKeyDown 0x2f87d:$g5: get_ShiftKeyDown 0x2f88e:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2fc83:$a13: get_DnsResolver 0x2e353:$a20: get_LastAccessed 0x306b1:$a27: set_InternalServerPort 0x309e6:$a30: set_GuidMasterKey 0x2e465:$a33: get_Clipboard 0x2e473:$a34: get_Keyboard 0x2f87d:$a35: get_ShiftKeyDown 0x2f88e:$a36: get_AltKeyDown 0x2e480:$a37: get_Password 0x2efd8:$a38: get_PasswordHash 0x300e5:$a39: get_DefaultCredentials
6.0.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.0.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
6.0.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x345c4:$s10: logins 0x3403e:$s11: credential 0x30265:$g1: get_Clipboard 0x30273:$g2: get_Keyboard 0x30280:$g3: get_Password 0x3166d:$g4: get_CtrlKeyDown 0x3167d:$g5: get_ShiftKeyDown 0x3168e:$g6: get_AltKeyDown
6.0.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31a83:$a13: get_DnsResolver 0x30153:$a20: get_LastAccessed 0x324b1:$a27: set_InternalServerPort 0x327e6:$a30: set_GuidMasterKey 0x30265:$a33: get_Clipboard 0x30273:$a34: get_Keyboard 0x3167d:$a35: get_ShiftKeyDown 0x3168e:$a36: get_AltKeyDown 0x30280:$a37: get_Password 0x30dd8:$a38: get_PasswordHash 0x31ee5:$a39: get_DefaultCredentials
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3e4f4c0.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3e4f4c0.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3e4f4c0.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x126204:$s10: logins 0x15c424:$s10: logins 0x192444:$s10: logins 0x125c7e:$s11: credential 0x15be9e:$s11: credential 0x191ebe:$s11: credential 0x121ea5:$g1: get_Clipboard 0x1580c5:$g1: get_Clipboard 0x18e0e5:$g1: get_Clipboard 0x121eb3:$g2: get_Keyboard 0x1580d3:$g2: get_Keyboard 0x18e0f3:$g2: get_Keyboard 0x121ec0:$g3: get_Password 0x1580e0:$g3: get_Password 0x18e100:$g3: get_Password 0x1232ad:$g4: get_CtrlKeyDown 0x1594cd:$g4: get_CtrlKeyDown 0x18f4ed:$g4: get_CtrlKeyDown 0x1232bd:$g5: get_ShiftKeyDown 0x1594dd:$g5: get_ShiftKeyDown 0x18f4fd:$g5: get_ShiftKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3e4f4c0.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x34f1b:$s1: file:/// 0x34e2b:$s2: {11111-22222-10009-11112} 0x34eab:$s3: {11111-22222-50001-00000} 0x34071:$s4: get_Module 0x343ec:$s5: Reverse 0x122456:$s5: Reverse 0x158676:$s5: Reverse 0x18e696:$s5: Reverse 0x2f58a:$s6: BlockCopy 0x1244d9:$s6: BlockCopy 0x15a6f9:$s6: BlockCopy 0x190719:$s6: BlockCopy 0x122714:$s7: ReadByte 0x158934:$s7: ReadByte 0x18e954:$s7: ReadByte 0x34f2d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3e4f4c0.6.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x1236c3:$a13: get_DnsResolver 0x1598e3:$a13: get_DnsResolver 0x18f903:$a13: get_DnsResolver 0x121d93:$a20: get_LastAccessed 0x157fb3:$a20: get_LastAccessed 0x18dfd3:$a20: get_LastAccessed 0x1240f1:$a27: set_InternalServerPort 0x15a311:$a27: set_InternalServerPort 0x190331:$a27: set_InternalServerPort 0x124426:$a30: set_GuidMasterKey 0x15a646:$a30: set_GuidMasterKey 0x190666:$a30: set_GuidMasterKey 0x121ea5:$a33: get_Clipboard 0x1580c5:$a33: get_Clipboard 0x18e0e5:$a33: get_Clipboard 0x121eb3:$a34: get_Keyboard 0x1580d3:$a34: get_Keyboard 0x18e0f3:$a34: get_Keyboard 0x1232bd:$a35: get_ShiftKeyDown 0x1594dd:$a35: get_ShiftKeyDown 0x18f4fd:$a35: get_ShiftKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3ee36e0.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3ee36e0.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3ee36e0.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x91fe4:$s10: logins 0xc8204:$s10: logins 0xfe224:$s10: logins 0x91a5e:$s11: credential 0xc7c7e:$s11: credential 0xfdc9e:$s11: credential 0x8dc85:$g1: get_Clipboard 0xc3ea5:$g1: get_Clipboard 0xf9ec5:$g1: get_Clipboard 0x8dc93:$g2: get_Keyboard 0xc3eb3:$g2: get_Keyboard 0xf9ed3:$g2: get_Keyboard 0x8dca0:$g3: get_Password 0xc3ec0:$g3: get_Password 0xf9ee0:$g3: get_Password 0x8f08d:$g4: get_CtrlKeyDown 0xc52ad:$g4: get_CtrlKeyDown 0xfb2cd:$g4: get_CtrlKeyDown 0x8f09d:$g5: get_ShiftKeyDown 0xc52bd:$g5: get_ShiftKeyDown 0xfb2dd:$g5: get_ShiftKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3ee36e0.8.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x8f4a3:$a13: get_DnsResolver 0xc56c3:$a13: get_DnsResolver 0xfb6e3:$a13: get_DnsResolver 0x8db73:$a20: get_LastAccessed 0xc3d93:$a20: get_LastAccessed 0xf9db3:$a20: get_LastAccessed 0x8fed1:$a27: set_InternalServerPort 0xc60f1:$a27: set_InternalServerPort 0xfc111:$a27: set_InternalServerPort 0x90206:$a30: set_GuidMasterKey 0xc6426:$a30: set_GuidMasterKey 0xfc446:$a30: set_GuidMasterKey 0x8dc85:$a33: get_Clipboard 0xc3ea5:$a33: get_Clipboard 0xf9ec5:$a33: get_Clipboard 0x8dc93:$a34: get_Keyboard 0xc3eb3:$a34: get_Keyboard 0xf9ed3:$a34: get_Keyboard 0x8f09d:$a35: get_ShiftKeyDown 0xc52bd:$a35: get_ShiftKeyDown 0xfb2dd:$a35: get_ShiftKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x345c4:$s10: logins 0x6a7e4:$s10: logins 0xa0804:$s10: logins 0x3403e:$s11: credential 0x6a25e:$s11: credential 0xa027e:$s11: credential 0x30265:$g1: get_Clipboard 0x66485:$g1: get_Clipboard 0x9c4a5:$g1: get_Clipboard 0x30273:$g2: get_Keyboard 0x66493:$g2: get_Keyboard 0x9c4b3:$g2: get_Keyboard 0x30280:$g3: get_Password 0x664a0:$g3: get_Password 0x9c4c0:$g3: get_Password 0x3166d:$g4: get_CtrlKeyDown 0x6788d:$g4: get_CtrlKeyDown 0x9d8ad:$g4: get_CtrlKeyDown 0x3167d:$g5: get_ShiftKeyDown 0x6789d:$g5: get_ShiftKeyDown 0x9d8bd:$g5: get_ShiftKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.3f41100.7.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31a83:$a13: get_DnsResolver 0x67ca3:$a13: get_DnsResolver 0x9dcc3:$a13: get_DnsResolver 0x30153:$a20: get_LastAccessed 0x66373:$a20: get_LastAccessed 0x9c393:$a20: get_LastAccessed 0x324b1:$a27: set_InternalServerPort 0x686d1:$a27: set_InternalServerPort 0x9e6f1:$a27: set_InternalServerPort 0x327e6:$a30: set_GuidMasterKey 0x68a06:$a30: set_GuidMasterKey 0x9ea26:$a30: set_GuidMasterKey 0x30265:$a33: get_Clipboard 0x66485:$a33: get_Clipboard 0x9c4a5:$a33: get_Clipboard 0x30273:$a34: get_Keyboard 0x66493:$a34: get_Keyboard 0x9c4b3:$a34: get_Keyboard 0x3167d:$a35: get_ShiftKeyDown 0x6789d:$a35: get_ShiftKeyDown 0x9d8bd:$a35: get_ShiftKeyDown
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.2bb0724.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.2bb0724.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd1b6:$v1: SbieDll.dll 0xd1d0:$v2: USER 0xd1dc:$v3: SANDBOX 0xd1ee:$v4: VIRUS 0xd23e:$v4: VIRUS 0xd1fc:$v5: MALWARE 0xd20e:$v6: SCHMIDTI 0xd222:$v7: CURRENTUSER
5.2.UmpBcHBDbXhaX.exe.2a20620.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
5.2.UmpBcHBDbXhaX.exe.2a20620.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd1b6:$v1: SbieDll.dll 0xd1d0:$v2: USER 0xd1dc:$v3: SANDBOX 0xd1ee:$v4: VIRUS 0xd23e:$v4: VIRUS 0xd1fc:$v5: MALWARE 0xd20e:$v6: SCHMIDTI 0xd222:$v7: CURRENTUSER
5.2.UmpBcHBDbXhaX.exe.2a02e50.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
5.2.UmpBcHBDbXhaX.exe.2a02e50.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2a986:$v1: SbieDll.dll 0x2a9a0:$v2: USER 0x2a9ac:$v3: SANDBOX 0x2a9be:$v4: VIRUS 0x2aa0e:$v4: VIRUS 0x2a9cc:$v5: MALWARE 0x2a9de:$v6: SCHMIDTI 0x2a9f2:$v7: CURRENTUSER
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.2b92f54.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe.2b92f54.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2a986:$v1: SbieDll.dll 0x2a9a0:$v2: USER 0x2a9ac:$v3: SANDBOX 0x2a9be:$v4: VIRUS 0x2aa0e:$v4: VIRUS 0x2a9cc:$v5: MALWARE 0x2a9de:$v6: SCHMIDTI 0x2a9f2:$v7: CURRENTUSER
Click to see the 24 entries

Sigma Signatures

Persistence and Installation Behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe