flash

zrvAIscZsc.exe

Status: finished
Submission Time: 22.07.2021 18:03:28
Malicious
Trojan
Evader
AgentTesla

Comments

Tags

  • 32
  • exe

Details

  • Analysis ID:
    452693
  • API (Web) ID:
    820282
  • Analysis Started:
    22.07.2021 18:11:41
  • Analysis Finished:
    22.07.2021 18:21:46
  • MD5:
    e85a0e1e81acbcea6a0e10eeedf32f6d
  • SHA1:
    3c613a4d232645cccbc7c1d8a3a8afb54cd2d56c
  • SHA256:
    ae7399822ad5ef4d9bd2690df74f6f1b472103380be74fca33611ce7265ebc01
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
19/70

malicious
11/46

URLs

Name Detection
http://127.0.0.1:HTTP/1.1
http://ocsp.sectigo.com0
http://www.jiyu-kobo.co.jp//b
Click to see the 55 hidden entries
http://api.twitter.com/1/direct_messages.xml?since_id=
http://www.jiyu-kobo.co.jp/Lb
http://www.jiyu-kobo.co.jp/tend~b
http://79RmqEvtn7PDwz03.net
http://twitter.com/statuses/user_timeline.xml?screen_name=
http://IXudBJ.com
http://www.founder.com.cn/cn(j
http://www.sajatypeworks.com
http://www.fontbureau.comony
http://www.galapagosdesign.com/staff/dennis.htm
http://www.jiyu-kobo.co.jp/8
http://www.jiyu-kobo.co.jp/6b
http://www.jiyu-kobo.co.jp/jp/Sb
http://www.fontbureau.comwbb
http://www.jiyu-kobo.co.jp//
http://www.sakkal.comh
http://www.founder.com.cn/cnt
http://www.galapagosdesign.com/OG
http://www.ascendercorp.com/typedesigners.html
http://www.fonts.com
http://www.urwpp.de
http://www.sajatypeworks.come
http://www.sakkal.com
http://www.fontbureau.com.TTF
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
http://www.sajatypeworks.comnoVq7
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
http://www.fontbureau.com
http://DynDns.comDynDNS
https://sectigo.com/CPS0
http://www.monotype.pF
http://www.jiyu-kobo.co.jp/Y0oZb7
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://www.founder.com.cn/cn:k
http://www.fontbureau.co
http://www.founder.com.cn/cn.k
http://mail.privateemail.com
http://www.jiyu-kobo.co.jp/jp/
http://www.galapagosdesign.com/=bX
http://www.founder.com.cn/cn/
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-jones.html
http://www.jiyu-kobo.co.jp/:cT
http://www.jiyu-kobo.co.jp/jp/=bX
http://www.jiyu-kobo.co.jp/Y0/
http://www.galapagosdesign.com/UG
http://www.jiyu-kobo.co.jp/
http://www.jiyu-kobo.co.jp/k
http://www.fontbureau.com/Eb
http://www.fontbureau.comalic
http://www.fontbureau.com/designers/
http://www.jiyu-kobo.co.jp/Eb
http://www.sajatypeworks.com(
http://www.jiyu-kobo.co.jp/jp//b
http://www.founder.com.c0n

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\tmp3A6D.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\JxCmQoa.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\JxCmQoa.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
Click to see the 1 hidden entries
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zrvAIscZsc.exe.log
ASCII text, with CRLF line terminators
#