IOC Report
MDE_File_Sample_e884aa3aef73b565a49bf50b5026f03df0b71867.zip

loading gifFilesURLsDomainsIPs432101032Label

Files

File Path
Type
Category
Malicious
Download
MDE_File_Sample_e884aa3aef73b565a49bf50b5026f03df0b71867.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aivxhtbin
Unknown
dropped
 malicious
C:\Users\user\AppData\Local\Temp\is-PM0GR.tmp\0krpbkkrhv.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\KBDTAILE\chrome.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\d.cmd
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\e2413cf1
data
dropped
C:\Users\user\AppData\Local\Temp\is-BP6JL.tmp\App_version 13.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\is-EICU6.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\is-PM0GR.tmp\idp.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\joot
Unknown
dropped
C:\Users\user\AppData\Local\Temp\~DFB7F108AF5AE974DE.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Users\user\AppData\Roaming\KBDTAILE\115.0.5790.110.manifest
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\KBDTAILE\chrome_elf.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Roaming\KBDTAILE\tyranny.vhd
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Roaming\YCCKDJWTATR\AKXXALPGLVKPJCJY
data
dropped
There are 5 hidden files, click here to show them.

URLs

Name
IP
Malicious
http://ip-api.com/line/?fields=hosting
208.95.112.1

Domains

Name
IP
Malicious
textbin.net
148.72.177.212
edge-block-www-env.dropbox-dns.com
162.125.1.15
archive.org
207.241.224.2
www-env.dropbox-dns.com
162.125.1.18
ip-api.com
208.95.112.1
pastebin.com
104.20.68.143
i.ibb.co
172.96.160.210
ucd55bcbcc16cc3ee1604436751a.dl.dropboxusercontent.com
unknown
www.dropbox.com
unknown
uc36ea308d0c0c7111ad797123a0.dl.dropboxusercontent.com
unknown

IPs

IP
Domain
Country
Malicious
62.182.156.148
unknown
Russian Federation
malicious
212.109.194.100
unknown
Russian Federation
malicious
208.95.112.1
ip-api.com
United States
148.72.177.212
textbin.net
United States
104.20.68.143
pastebin.com
United States
207.241.224.2
archive.org
United States
172.96.160.210
i.ibb.co
United States
162.125.1.18
www-env.dropbox-dns.com
United States
162.125.1.15
edge-block-www-env.dropbox-dns.com
United States