top title background image
flash

RFQ10675000162.exe

Status: finished
Submission Time: 2024-05-15 16:38:08 +02:00
Malicious
Spreader
Trojan
Spyware
Evader
AgentTesla, PureLog Stealer

Comments

Tags

  • exe

Details

  • Analysis ID:
    1442078
  • API (Web) ID:
    1442078
  • Analysis Started:
    2024-05-15 16:38:09 +02:00
  • Analysis Finished:
    2024-05-15 16:49:26 +02:00
  • MD5:
    bdac6ecf5c7f3ae57414eb01e643f96b
  • SHA1:
    a931d7d7b4471c39e37c14369373aa0bc4d5ad2e
  • SHA256:
    50e845d9eb8b8a08f77da69556c94958265cb875129a41177c60094b71434e9a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 12/38
malicious

IPs

IP Country Detection
208.95.112.1
United States
66.29.151.236
United States
104.26.12.205
United States

Domains

Name IP Detection
ip-api.com
208.95.112.1
api.ipify.org
104.26.12.205

URLs

Name Detection
https://stackoverflow.com/q/11564914/23354;
http://ip-api.com/line/?fields=hosting
http://go.mic
Click to see the 17 hidden entries
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://api.ipify.org/t
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
https://github.com/mgravell/protobuf-net
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
http://ip-api.com
https://stackoverflow.com/q/2152978/23354
https://api.ipify.org/
http://ocsp.sectigo.com0
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
https://github.com/mgravell/protobuf-netJ
https://account.dyn.com/
https://stackoverflow.com/q/14436606/23354
https://github.com/mgravell/protobuf-neti
https://sectigo.com/CPS0
https://api.ipify.org

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\oouvef.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#