flash

K0bg9rZl2L.exe

Status: finished
Submission Time: 22.07.2021 19:25:27
Malicious
Trojan
Spyware
Exploiter
Evader
AgentTesla

Comments

Tags

  • 32
  • exe
  • trojan

Details

  • Analysis ID:
    452750
  • API (Web) ID:
    820338
  • Analysis Started:
    22.07.2021 19:34:54
  • Analysis Finished:
    22.07.2021 19:47:34
  • MD5:
    699e56ea4da0b0865fc33308a8b09df9
  • SHA1:
    c32dff686616f747f808a5c0bc67484d4755f568
  • SHA256:
    e5805ba9f9119986eb49be00972cb30d5249f8c19c872c4daacb2ad67a157bb5
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
25/68

malicious
10/46

IPs

IP Country Detection
172.67.156.203
United States
103.18.109.159
Australia

Domains

Name IP Detection
simpleitalian.com.au
103.18.109.159
bakercost.gq
172.67.156.203
mail.simpleitalian.com.au
0.0.0.0

URLs

Name Detection
https://bakercost.gq/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-DA64E
https://s2-prod.liverpool.com/
https://www.liverpool.com/liverpool-fc-news/features/liverpool-champions-league-jurgen-klopp-1996194
Click to see the 97 hidden entries
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s458/0_GettyImages-1302496803.
https://felix.data.tm-awx.com/ampconfig.json"
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s615/0_Salah-Goal-vs-Leeds.jpg
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg
https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946
https://yBn4IuANygFMcOSp.com
https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg
http://schema.org/ListItem
https://www.liverpool.com/all-about/georginio-wijnaldum
https://mab.data.tm-awx.com/rhs"
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.
https://felix.data.tm-awx.com
http://crl.comodoN
https://www.liverpool.com/all-about/andrew-robertson
https://i2-prod.liverpool.com/incoming/article17166876.ece/ALTERNATES/s615/0_GettyImages-1175998874.
https://api.ipify.org%GETMozilla/5.0
https://www.liverpool.com/liverpool-fc-news/features/liverpool-gini-wijnaldum-rumours-fitness-199533
https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s180/0_GettyImages-1304940818.
https://www.liverpool.com/
https://www.liverpool.com/cookie-policy/
https://www.liverpool.com/all-about/transfers
https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763&
http://DynDns.comDynDNS
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s615/1_FreeAgentPlayers.jpg
https://sectigo.com/CPS0
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s180/1_FreeAgentPlayers.jpg
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
https://reach-id.orbit.tm-awx.com/analytics.js.gz
http://127.0.0.1:HTTP/1.1
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg
https://c.amazon-adsystem.com/aax2/apstag.js
https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-
https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.
https://reachplc.hub.loginradius.com
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
https://www.liverpool.com/all-about/premier-league
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-
https://www.liverpool.com/liverpool-fc-news/
https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.
https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02
http://simpleitalian.com.au
https://mab.data.tm-awx.com/rhs
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg
https://ads.pubmatic.com/AdServer/js/pwt/156997/3236/pwt.js
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
https://go.micro
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166
https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst
https://reachplc.hub.loginradius.com"
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690
https://s2-prod.liverpool.com
https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837
https://i2-prod.liverpool.com
https://felix.data.tm-awx.com/felix.min.js
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s180/0_Salah-Goal-vs-Leeds.jpg
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.
https://www.liverpool.com/all-about/ozan-kabak
https://s2-prod.mirror.co.uk/
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-
https://www.liverpool.com/all-about/champions-league
https://www.liverpool.com/all-about/curtis-user
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
https://www.liverpool.com/all-about/steven-gerrard
https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-
https://www.liverpool.com/liverpool-fc-news/features/liverpool-penalties-premier-league-var-17171391
http://schema.org/NewsArticle
https://www.liverpool.com/schedule/
http://schema.org/BreadcrumbList
https://securepubads.g.doubleclick.net/tag/js/gpt.js
http://ocsp.comodt

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\K0bg9rZl2L.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
Click to see the 5 hidden entries
C:\Users\user\AppData\Local\Temp\14906059cf1d40cd99ff18e182ff171d
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_liycv4ep.1cw.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m33dr320.qvb.psm1
very short file (no magic)
#
C:\Users\user\Desktop\dedd659c48564f729136e943657b6aef.dll
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\Documents\20210722\PowerShell_transcript.642294.pSUMO4EI.20210722193552.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#