Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

5641e24e22ccd259f18585ed2cbbaf6be3b39a04b3c7e.exe

Status: finished
Submission Time: 2022-01-14 19:10:31 +01:00
Malicious
Trojan
Adware
Evader

Comments

Tags

  • exe
  • RedLineStealer

Details

  • Analysis ID:
    553368
  • API (Web) ID:
    920890
  • Analysis Started:
    2022-01-14 19:10:32 +01:00
  • Analysis Finished:
    2022-01-14 19:23:43 +01:00
  • MD5:
    8fb77edbae0c40e1e19d82a406b7615a
  • SHA1:
    0d1580519970aadaae7a4771bba39668ac0c583f
  • SHA256:
    5641e24e22ccd259f18585ed2cbbaf6be3b39a04b3c7e170063a684e21bcf078
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 14/68
malicious
Score: 17/43
malicious

IPs

IP Country Detection
185.112.83.96
 Russian Federation

URLs

Name Detection
http://185.112.83.96:20000/callback
http://185.112.83.96:20000/callbackmheap.freeSpanLocked

Dropped files

Name File Type Hashes Detection
C:\Windows\System32\drivers\etc\hosts
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kzwl01ox.zis.ps1
 very short file (no magic)
 #
\Device\Null
 ASCII text, with CRLF line terminators
 #
Click to see the 19 hidden entries
C:\Users\user\Documents\20220114\PowerShell_transcript.358075.modYJzHz.20220114191155.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20220114\PowerShell_transcript.358075._bhdDFjc.20220114191205.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20220114\PowerShell_transcript.358075.PhAlNio2.20220114191140.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20220114\PowerShell_transcript.358075.IZ24yRiA.20220114191200.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20220114\PowerShell_transcript.358075.Gl0sshOE.20220114191151.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20220114\PowerShell_transcript.358075.9GYwnzwR.20220114191133.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Desktop\hosts.bak. (copy)
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgos0k0z.2gr.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
 data
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwaaxnaf.rts.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iaxyhgqf.de5.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hm5i3shc.tba.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eovqy115.iwl.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drkkekrp.vde.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amblrihn.2wj.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ab5jticm.dks.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5uqrqs4k.34i.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4pie02pg.wgf.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fx1ezon.lgh.psm1
 very short file (no magic)
 #