top title background image
flash

Doc-94.vbs

Status: finished
Submission Time: 2023-10-13 13:16:07 +02:00
Malicious
Ransomware
Trojan
Spyware
Evader
DarkGate, MailPassView

Comments

Tags

  • vbs

Details

  • Analysis ID:
    1325231
  • API (Web) ID:
    1325231
  • Analysis Started:
    2023-10-13 13:16:08 +02:00
  • Analysis Finished:
    2023-10-13 13:21:22 +02:00
  • MD5:
    d050315ff65ebef0ba1352167126592f
  • SHA1:
    e2009bb0ccae9b82d57c45d7b6c39d76faded05d
  • SHA256:
    1e8a6d34c0fe5a5ad2fc1d6ff7000bcf8efa0704c397cb6ef021c2692bf17fe6
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
212.113.118.178
Russian Federation
0.0.0.0
unknown

Domains

Name IP Detection
whoernet.co.com
212.113.118.178

URLs

Name Detection
http://whoernet.co.com:80/sbhbrq;
http://whoernet.co.com/msifvwjscyk
https://www.autoitscript.com/autoit3/
Click to see the 21 hidden entries
https://mail.google.com/mail/u/0/#inbox
http://whoernet.co.com:80ing
http://whoernet.co.com:80/msifvwjscykP
http://whoernet.co.com:80am
http://whoernet.co.com/sbhbrqOOC:
http://whoernet.co.com:80ntm
http://whoernet.co.com:80/msifvwjscykem32
http://whoernet.co.com/
http://whoernet.co.com:80/sbhbrqc:
http://whoernet.co.com:80
http://whoernet.co.com:80/msifvwjscykw
http://whoernet.co.com/sbhbrq
http://whoernet.co.com:80/msifvwjscykx
http://whoernet.co.com:80/msifvwjscyk8
http://whoernet.co.com:80/msifvwjscyk
http://whoernet.co.com/sbhbrqC:
http://whoernet.co.com:80/sbhbrq
http://whoernet.co.com/sbhbrqo
http://whoernet.co.com:80space2u
http://whoernet.co.com/sbhbrqLMEM
http://www.autoitscript.com/autoit3/J

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\Autoit3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#