top title background image
flash

LzbZ4T1iV8.exe

Status: finished
Submission Time: 2021-08-02 21:08:11 +02:00
Malicious
Trojan
Evader
Spyware
GuLoader, GuLoader Remcos

Comments

Tags

  • exe

Details

  • Analysis ID:
    458125
  • API (Web) ID:
    825714
  • Analysis Started:
    2021-08-02 21:08:12 +02:00
  • Analysis Finished:
    2021-08-02 21:28:27 +02:00
  • MD5:
    41e1bc9de5f3b61639fb88143e933ff8
  • SHA1:
    432531c5a0f7f82b8ec10e7f3fde1b51ebd3d0e8
  • SHA256:
    d32cf33f8f64824f799ca44e9988ddc517e88db1235f93792d3ed2ddaa48e35f
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 84
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Suspected Instruction Hammering Hide Perf

Third Party Analysis Engines

malicious
Score: 12/68
malicious
Score: 8/45

IPs

IP Country Detection
194.5.97.128
Netherlands
101.99.94.119
Malaysia

Domains

Name IP Detection
wealthyrem.ddns.net
194.5.97.128

URLs

Name Detection
http://101.99.94.119/WEALTH_PRUuqVZw139.bin
http://101.99.94.119/WEALTH_PRUuqVZw139.bin^
http://101.99.94.119/WEALTH_PRUuqVZw139.binwininet.dllMozilla/5.0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\remcos\logs.dat
data
#