top title background image
flash

lpHBYIrM62.exe

Status: finished
Submission Time: 2024-01-28 21:21:05 +01:00
Malicious
Trojan
Evader
BitRAT, PureLog Stealer

Comments

Tags

  • BitRAT
  • exe
  • RAT

Details

  • Analysis ID:
    1382367
  • API (Web) ID:
    1382367
  • Original Filename:
    D3E0800E550889AD45270980CA5D31D2.exe
  • Analysis Started:
    2024-01-28 21:21:05 +01:00
  • Analysis Finished:
    2024-01-28 21:30:18 +01:00
  • MD5:
    d3e0800e550889ad45270980ca5d31d2
  • SHA1:
    3cc43700ce7b812c3c90d74b1fb7757cc14dd026
  • SHA256:
    41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 48/71
malicious
Score: 25/38
malicious
malicious

IPs

IP Country Detection
147.78.241.56
Norway
162.159.135.233
United States

Domains

Name IP Detection
pradeepprabhu705.ddns.net
147.78.241.56
cdn.discordapp.com
162.159.135.233

URLs

Name Detection
pradeepprabhu705.ddns.net
https://github.com/mgravell/protobuf-net
https://github.com/mgravell/protobuf-neti
Click to see the 9 hidden entries
https://stackoverflow.com/q/14436606/23354
https://cdn.discordapp.com
https://github.com/mgravell/protobuf-netJ
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://stackoverflow.com/q/11564914/23354;
https://stackoverflow.com/q/2152978/23354
https://curl.haxx.se/docs/http-cookies.html
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat?ex=65b6f023&is=65a47b23&hm=d10599d908faa98f4e38c8fa05f7618af09346cf599dade55a0c93fb6feff152&
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat?ex=65

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local:28-01-2024
HTML document, ASCII text, with no line terminators
#
C:\Users\user\AppData\Roaming\juygh.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#