top title background image
flash

vXVHRRGG7c.exe

Status: finished
Submission Time: 2021-09-25 10:15:43 +02:00
Malicious
Trojan
Evader
TrickBot

Comments

Tags

  • exe
  • TrickBot

Details

  • Analysis ID:
    490261
  • API (Web) ID:
    857831
  • Analysis Started:
    2021-09-25 10:22:00 +02:00
  • Analysis Finished:
    2021-09-25 10:30:53 +02:00
  • MD5:
    051c20fd814ac34ffcfadd56ec872be0
  • SHA1:
    6d4d301594ba01b9e4d8eac59dc839090f090fdf
  • SHA256:
    7aa215495949e721b9ae8b3b28cb728ac3b3240438e67f2cc4f3be2711d3d319
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 10/45

IPs

IP Country Detection
179.42.137.102
unknown
179.42.137.105
unknown
59.4.68.75
Korea Republic of
Click to see the 2 hidden entries
171.103.189.118
Thailand
104.18.7.156
United States

Domains

Name IP Detection
icanhazip.com
104.18.7.156
9.52.17.84.dnsbl-1.uceprotect.net
0.0.0.0
9.52.17.84.zen.spamhaus.org
0.0.0.0
Click to see the 3 hidden entries
9.52.17.84.cbl.abuseat.org
0.0.0.0
9.52.17.84.b.barracudacentral.org
0.0.0.0
9.52.17.84.spam.dnsbl.sorbs.net
0.0.0.0

URLs

Name Detection
http://icanhazip.com/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\browDownload3D\vXVHRRGG7c.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\browDownload3D\cmd01.bat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\browDownload3D\settings.ini
ASCII text, with very long lines, with CRLF line terminators
#