Edit tour
Windows
Analysis Report
172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe
Overview
General Information
| Sample name: | 172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe |
| Analysis ID: | 1499569 |
| MD5: | 0c5a0857966d223e9a72bf6273d520a0 |
| SHA1: | 7d01ea6a0a512d04fea2f1a75bc26545ba9d86ca |
| SHA256: | 0f370075b9fe97932babb0bb6be981553ded7d8dcc02ed82ee9afb2964a5b282 |
| Tags: | base64-decodedexe |
| Infos: |   |
 | |
Detection
AgentTesla
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
AI detected suspicious sample
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe (PID: 7768 cmdline: "C:\Users\ user\Deskt op\1724738 34493f9dd4 c11e505629 bd9b8efb59 32f698a99a cd495429ea 8dcfe99eff c6f3741352 .dat-decod ed.exe" MD5: 0C5A0857966D223E9A72BF6273D520A0)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Agent Tesla, AgentTesla | A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel. |
{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_AgentTesla_1 | Yara detected AgentTesla | Joe Security | ||
| INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID | Detects executables referencing Windows vault credential objects. Observed in infostealers | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_AgentTesla_1 | Yara detected AgentTesla | Joe Security | ||
| JoeSecurity_AgentTesla_1 | Yara detected AgentTesla | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_AgentTesla_1 | Yara detected AgentTesla | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| Click to see the 3 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_AgentTesla_1 | Yara detected AgentTesla | Joe Security | ||
| INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID | Detects executables referencing Windows vault credential objects. Observed in infostealers | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: frack113: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Networking | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing | |
|---|
| Source: | .Net Code: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 0_2_01664AC0 | |
| Source: | Code function: | 0_2_0166EE00 | |
| Source: | Code function: | 0_2_01663EA8 | |
| Source: | Code function: | 0_2_0166DE90 | |
| Source: | Code function: | 0_2_016641F0 | |
| Source: | Code function: | 0_2_069D2428 | |
| Source: | Code function: | 0_2_069DE048 | |
| Source: | Code function: | 0_2_069E66C0 | |
| Source: | Code function: | 0_2_069EB2F2 | |
| Source: | Code function: | 0_2_069E5258 | |
| Source: | Code function: | 0_2_069EC250 | |
| Source: | Code function: | 0_2_069E3120 | |
| Source: | Code function: | 0_2_069E7E50 | |
| Source: | Code function: | 0_2_069E7770 | |
| Source: | Code function: | 0_2_069E2421 | |
| Source: | Code function: | 0_2_069EE470 | |
| Source: | Code function: | 0_2_069E0040 | |
| Source: | Code function: | 0_2_069E0006 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_01666C02 | |
| Source: | Code function: | 0_2_069D9170 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | HTTP traffic detected: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Binary or memory string: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Code function: | 0_2_016670B0 | |
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 231 Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Disable or Modify Tools | 2 OS Credential Dumping | 531 Security Software Discovery | Remote Services | 1 Email Collection | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 261 Virtualization/Sandbox Evasion | 1 Input Capture | 1 Process Discovery | Remote Desktop Protocol | 1 Input Capture | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Deobfuscate/Decode Files or Information | 1 Credentials in Registry | 261 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | 11 Archive Collected Data | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 Application Window Discovery | Distributed Component Object Model | 2 Data from Local System | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 System Network Configuration Discovery | SSH | Keylogging | 12 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 34 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 71% | Virustotal | Browse | ||
| 76% | ReversingLabs | ByteCode-MSIL.Trojan.AgentTesla | ||
| 100% | Avira | TR/Spy.Gen8 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| smtp.zoho.eu | 185.230.212.164 | true | true |
| unknown |
| ip-api.com | 208.95.112.1 | true | true |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 208.95.112.1 | ip-api.com | United States | 53334 | TUT-ASUS | true | |
| 185.230.212.164 | smtp.zoho.eu | Netherlands | 41913 | COMPUTERLINEComputerlineSchlierbachSwitzerlandCH | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1499569 |
| Start date and time: | 2024-08-27 08:01:05 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 23s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 9 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@1/0@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, UsoClient.exe
- Excluded IPs from analysis (whitelisted): 20.190.159.64, 20.190.159.4, 20.190.159.73, 20.190.159.0, 20.190.159.2, 20.190.159.68, 40.126.31.67, 40.126.31.73, 20.190.159.71, 40.126.31.71
- Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, settings-win.data.microsoft.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 02:01:57 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 208.95.112.1 | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| Get hash | malicious | Blank Grabber, Umbral Stealer | Browse |
| ||
| Get hash | malicious | RMSRemoteAdmin, RDPWrap Tool, xRAT | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| 185.230.212.164 | Get hash | malicious | AgentTesla | Browse | ||
| Get hash | malicious | DarkTortilla, Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse | |||
| Get hash | malicious | AgentTesla | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ip-api.com | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| Get hash | malicious | Blank Grabber, Umbral Stealer | Browse |
| ||
| Get hash | malicious | RMSRemoteAdmin, RDPWrap Tool, xRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| smtp.zoho.eu | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | DarkTortilla, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| COMPUTERLINEComputerlineSchlierbachSwitzerlandCH | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | AsyncRAT, DcRat, PureLog Stealer, XWorm, zgRAT | Browse |
| ||
| Get hash | malicious | DarkTortilla, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| TUT-ASUS | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| Get hash | malicious | Blank Grabber, Umbral Stealer | Browse |
| ||
| Get hash | malicious | RMSRemoteAdmin, RDPWrap Tool, xRAT | Browse |
| ||
| Get hash | malicious | AgentTesla, DarkTortilla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
|
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 5.001260447885727 |
| TrID: |
|
| File name: | 172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe |
| File size: | 250'880 bytes |
| MD5: | 0c5a0857966d223e9a72bf6273d520a0 |
| SHA1: | 7d01ea6a0a512d04fea2f1a75bc26545ba9d86ca |
| SHA256: | 0f370075b9fe97932babb0bb6be981553ded7d8dcc02ed82ee9afb2964a5b282 |
| SHA512: | d37d7777285595b0a0f1cd267e843ea08214c62b3c12fce7470c7f5cce70f5969bc758ebc410e357bdc0c2564f1f78ef7725db8ed1d05648e5d773c187ccbc73 |
| SSDEEP: | 3072:flqf9dME0sMkhJF1+t+AxkhSaPgu5af1KWo5:fs9dME0sMkhJF1rhSvP1F |
| TLSH: | 9E341F037E88EB15E5A87E3782EF2C2413F2B0C70673D60B6F49AE6518516526C7E72D |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8?f................................. ........@.. .......................@............@................................ |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x43e82e |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x663F3889 [Sat May 11 09:21:13 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x3e7d8 | 0x53 | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x40000 | 0x546 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x42000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0x3c834 | 0x3ca00 | 045e3a239c669ff9d062b32436988aa6 | False | 0.35756282216494845 | data | 5.0123639514958525 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x40000 | 0x546 | 0x600 | a2802022c10bcf4fc6a619c6bc05aec4 | False | 0.3997395833333333 | data | 4.002728308980721 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x42000 | 0xc | 0x200 | e623dfb8e4b9fad79df479e88ee1050e | False | 0.044921875 | data | 0.10191042566270775 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x400a0 | 0x2bc | data | 0.44142857142857145 | ||
| RT_MANIFEST | 0x4035c | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5469387755102041 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 27, 2024 08:01:56.281346083 CEST | 49711 | 80 | 192.168.2.9 | 208.95.112.1 |
| Aug 27, 2024 08:01:56.286773920 CEST | 80 | 49711 | 208.95.112.1 | 192.168.2.9 |
| Aug 27, 2024 08:01:56.286837101 CEST | 49711 | 80 | 192.168.2.9 | 208.95.112.1 |
| Aug 27, 2024 08:01:56.287821054 CEST | 49711 | 80 | 192.168.2.9 | 208.95.112.1 |
| Aug 27, 2024 08:01:56.292988062 CEST | 80 | 49711 | 208.95.112.1 | 192.168.2.9 |
| Aug 27, 2024 08:01:56.765392065 CEST | 80 | 49711 | 208.95.112.1 | 192.168.2.9 |
| Aug 27, 2024 08:01:56.819317102 CEST | 49711 | 80 | 192.168.2.9 | 208.95.112.1 |
| Aug 27, 2024 08:01:57.472018003 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:57.479127884 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:57.479195118 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.065874100 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.066152096 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.071069956 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.465743065 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.506791115 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.597659111 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.597877026 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.603697062 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.777204990 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.789537907 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.794358015 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.969286919 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.969299078 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.969310045 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.969321012 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:58.969366074 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.969410896 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.972224951 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:58.977072954 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.153434992 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.190762997 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:59.195945024 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.369256973 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.370420933 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:59.375852108 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.549410105 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.563057899 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:59.572128057 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.758326054 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.783526897 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:59.788352966 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.961997032 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:01:59.967814922 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:01:59.972799063 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.148310900 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.151751041 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:00.156927109 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.330704927 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.331381083 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:00.331451893 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:00.331509113 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:00.331533909 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:00.337297916 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.337308884 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.337366104 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:00.337376118 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.050133944 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.050204039 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.050251961 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.140005112 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.144870996 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.318278074 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.318428993 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.318692923 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.318716049 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.318747044 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.322158098 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.323203087 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.328078985 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.328142881 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.903390884 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:01.909234047 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:01.914088011 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.087750912 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.087960958 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.092873096 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.264161110 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.270981073 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.275866032 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.448168993 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.448195934 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.448208094 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.448281050 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.450624943 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.455451012 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.626956940 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.639014006 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.644695997 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.815757990 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.818384886 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.823555946 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.994764090 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:02.995131016 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:02.999847889 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.182254076 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.182451963 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.187383890 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.361043930 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.361270905 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.366925001 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.538156986 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.538407087 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.543765068 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.714961052 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.720491886 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720572948 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720624924 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720655918 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720736027 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720766068 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720792055 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720900059 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720946074 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.720974922 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:03.725563049 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.725667953 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.725680113 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.725779057 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:03.725816011 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:04.201456070 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:02:04.241178989 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:02:47.460402966 CEST | 49711 | 80 | 192.168.2.9 | 208.95.112.1 |
| Aug 27, 2024 08:02:47.465679884 CEST | 80 | 49711 | 208.95.112.1 | 192.168.2.9 |
| Aug 27, 2024 08:02:47.465780020 CEST | 49711 | 80 | 192.168.2.9 | 208.95.112.1 |
| Aug 27, 2024 08:03:37.475914955 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:03:37.481949091 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:03:37.655179977 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:03:37.655196905 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:03:37.655294895 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 |
| Aug 27, 2024 08:03:37.655417919 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:03:37.655530930 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Aug 27, 2024 08:03:37.656609058 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 27, 2024 08:01:56.223882914 CEST | 49448 | 53 | 192.168.2.9 | 1.1.1.1 |
| Aug 27, 2024 08:01:56.273240089 CEST | 53 | 49448 | 1.1.1.1 | 192.168.2.9 |
| Aug 27, 2024 08:01:57.451611042 CEST | 62113 | 53 | 192.168.2.9 | 1.1.1.1 |
| Aug 27, 2024 08:01:57.471352100 CEST | 53 | 62113 | 1.1.1.1 | 192.168.2.9 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Aug 27, 2024 08:01:56.223882914 CEST | 192.168.2.9 | 1.1.1.1 | 0x8598 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Aug 27, 2024 08:01:57.451611042 CEST | 192.168.2.9 | 1.1.1.1 | 0x998b | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Aug 27, 2024 08:01:56.273240089 CEST | 1.1.1.1 | 192.168.2.9 | 0x8598 | No error (0) | 208.95.112.1 | A (IP address) | IN (0x0001) | false | ||
| Aug 27, 2024 08:01:57.471352100 CEST | 1.1.1.1 | 192.168.2.9 | 0x998b | No error (0) | 185.230.212.164 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.9 | 49711 | 208.95.112.1 | 80 | 7768 | C:\Users\user\Desktop\172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Aug 27, 2024 08:01:56.287821054 CEST | 80 | OUT | |
| Aug 27, 2024 08:01:56.765392065 CEST | 175 | IN |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP | Commands |
|---|---|---|---|---|---|
| Aug 27, 2024 08:01:58.065874100 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 | 220 mx.zoho.eu SMTP Server ready August 27, 2024 8:01:57 AM CEST |
| Aug 27, 2024 08:01:58.066152096 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 | EHLO 216041 |
| Aug 27, 2024 08:01:58.465743065 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 | 250-mx.zoho.eu Hello 216041 (8.46.123.33 (8.46.123.33)) |
| Aug 27, 2024 08:01:58.597659111 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 | 250-STARTTLS 250 SIZE 53477376 |
| Aug 27, 2024 08:01:58.597877026 CEST | 49714 | 587 | 192.168.2.9 | 185.230.212.164 | STARTTLS |
| Aug 27, 2024 08:01:58.777204990 CEST | 587 | 49714 | 185.230.212.164 | 192.168.2.9 | 220 Ready to start TLS. |
| Aug 27, 2024 08:02:01.903390884 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 | 220 mx.zoho.eu SMTP Server ready August 27, 2024 8:02:01 AM CEST |
| Aug 27, 2024 08:02:01.909234047 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 | EHLO 216041 |
| Aug 27, 2024 08:02:02.087750912 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 | 250-mx.zoho.eu Hello 216041 (8.46.123.33 (8.46.123.33)) 250-STARTTLS 250 SIZE 53477376 |
| Aug 27, 2024 08:02:02.087960958 CEST | 49717 | 587 | 192.168.2.9 | 185.230.212.164 | STARTTLS |
| Aug 27, 2024 08:02:02.264161110 CEST | 587 | 49717 | 185.230.212.164 | 192.168.2.9 | 220 Ready to start TLS. |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 02:01:55 |
| Start date: | 27/08/2024 |
| Path: | C:\Users\user\Desktop\172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xc40000 |
| File size: | 250'880 bytes |
| MD5 hash: | 0C5A0857966D223E9A72BF6273D520A0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 11.4% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 2.7% |
| Total number of Nodes: | 113 |
| Total number of Limit Nodes: | 14 |
Graph
Function 069E5258 Relevance: 1.8, Strings: 1, Instructions: 592COMMON
Download Yara Rule
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 016670B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 01663EA8 Relevance: 1.5, Strings: 1, Instructions: 238COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E2421 Relevance: 1.0, Instructions: 1008COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E66C0 Relevance: .8, Instructions: 817COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EC250 Relevance: .6, Instructions: 645COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0166DE90 Relevance: .6, Instructions: 602COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EB2F2 Relevance: .6, Instructions: 593COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3120 Relevance: .5, Instructions: 545COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E7E50 Relevance: .5, Instructions: 472COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0166EE00 Relevance: .3, Instructions: 342COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 01664AC0 Relevance: .3, Instructions: 266COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069D6E08 Relevance: 6.1, APIs: 4, Instructions: 139threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069D6E18 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069DF218 Relevance: 1.7, APIs: 1, Instructions: 208COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069D7058 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 016670A8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069D7060 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0166F377 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069DF678 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069DE1A0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0166F390 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069DF418 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069D7120 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069ED018 Relevance: .8, Instructions: 798COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EB718 Relevance: .5, Instructions: 468COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EAD98 Relevance: .4, Instructions: 394COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E4F71 Relevance: .2, Instructions: 241COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E9218 Relevance: .2, Instructions: 231COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E5EB8 Relevance: .2, Instructions: 229COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3F59 Relevance: .2, Instructions: 223COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E4274 Relevance: .2, Instructions: 218COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E4288 Relevance: .2, Instructions: 210COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EEBE2 Relevance: .2, Instructions: 202COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EEBF0 Relevance: .2, Instructions: 201COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E4820 Relevance: .2, Instructions: 186COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EFD58 Relevance: .2, Instructions: 177COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EF700 Relevance: .2, Instructions: 175COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E9208 Relevance: .2, Instructions: 171COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EF710 Relevance: .2, Instructions: 163COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E4810 Relevance: .1, Instructions: 131COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EDB85 Relevance: .1, Instructions: 125COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E22A8 Relevance: .1, Instructions: 105COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E2158 Relevance: .1, Instructions: 97COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E2168 Relevance: .1, Instructions: 91COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E50C8 Relevance: .1, Instructions: 87COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3B61 Relevance: .1, Instructions: 80COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3B70 Relevance: .1, Instructions: 78COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0126D044 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E6DE8 Relevance: .1, Instructions: 68COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3C80 Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EA3D1 Relevance: .1, Instructions: 57COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EEE61 Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3C71 Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3EB7 Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0126D03F Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3940 Relevance: .1, Instructions: 52COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3EC8 Relevance: .1, Instructions: 51COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E3939 Relevance: .1, Instructions: 51COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EEE70 Relevance: .0, Instructions: 49COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EA3E0 Relevance: .0, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EAFE8 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EC8A8 Relevance: .0, Instructions: 33COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E6540 Relevance: .0, Instructions: 28COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E4709 Relevance: .0, Instructions: 25COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E0040 Relevance: 2.0, Instructions: 1986COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 016641F0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069EE470 Relevance: .6, Instructions: 586COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069E7770 Relevance: .5, Instructions: 468COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069DE048 Relevance: .3, Instructions: 264COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 069D2428 Relevance: .2, Instructions: 227COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|