top title background image
flash

ELsb0Wg55V.exe

Status: finished
Submission Time: 2024-11-29 12:05:13 +01:00
Malicious
Trojan
Evader
DcRat

Comments

Tags

  • exe
  • virustotal-vm-blacklist

Details

  • Analysis ID:
    1565187
  • API (Web) ID:
    1565187
  • Original Filename:
    a2a7dcce330cf557b3cf155d73c2e4369ddddd30433e9b070307b78246df9ab3.exe
  • Analysis Started:
    2024-11-29 12:05:13 +01:00
  • Analysis Finished:
    2024-11-29 12:12:07 +01:00
  • MD5:
    5c1d64f64d399812bea9c81f82a61844
  • SHA1:
    7bbe3c4f4876afc40b7516f50d263a3f15adb9e4
  • SHA256:
    a2a7dcce330cf557b3cf155d73c2e4369ddddd30433e9b070307b78246df9ab3
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 18/38
malicious

IPs

IP Country Detection
34.160.111.145
United States
20.233.83.145
United States
185.254.75.23
France

Domains

Name IP Detection
ipecho.net
34.160.111.145
github.com
20.233.83.145

URLs

Name Detection
https://github.githubassets.com/assets/ui_packages_code-view-shared_utilities_web-worker_ts-ui_packa
https://ipecho.net/plain
https://github.githubassets.com/assets/ui_packages_code-view-shared_hooks_use-canonical-object_ts-ui
Click to see the 97 hidden entries
https://github.com/topics
https://docs.github.com/site-policy/github-terms/github-terms-of-service
https://github.com/features/discussions
https://docs.github.com/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-
https://github.githubassets.com/assets/light-3e154969b9f9.css
https://api.github.com/_private/browser/errors
https://github.githubassets.com/assets/vendors-node_modules_color-convert_index_js-0e07cc183eed.js
https://github.githubassets.com/assets/primer-af846850481e.css
https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-4aa4
https://github.com/enterprise/advanced-security
https://avatars.githubusercontent.com/u/74118308?v=4
https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-93b6a0551aa9.js
https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-b73fdff77a4e.js
https://github.com/trending
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover_js
https://github.githubassets.com/assets/notifications-subscriptions-menu.1bcff9205c241e99cff2.module.
https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_j
https://github.githubassets.com/assets/environment-cd35650c2e9c.js
https://resources.github.com/learn/pathways
https://github.githubassets.com/assets/dark-9c5b7a476542.css
https://github.com/6nz/virustotal-vm-blacklist/blob/main/pc_name_list.txt"
https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modu
https://github.githubassets.com/assets/repository-9c77ed90200e.css
https://github.githubassets.com/assets/vendors-node_modules_lodash-es__Stack_js-node_modules_lodash-
https://support.github.com?tags=dotcom-footer
https://github.com/features/copilot
https://www.githubstatus.com/
https://github.com/features/actions
https://github.githubassets.com/assets/dark_colorblind-56fff47acadc.css
https://github.githubassets.com/assets/code-menu-13971a40799a.js
https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_
http://github.com
https://github.githubassets.com/assets/element-registry-e3ab8405ef80.js
https://github.com/6nz/virustotal-vm-blacklist/blob/main/hwid_list.txt
https://github.githubassets.com/
https://github.com/6nz/virustotal-vm-blacklist/blob/main/gpu_list.txt?raw=true
https://github.githubassets.com/assets/primer-primitives-4cf0d59ab51a.css
https://github.com/6nz/virustotal-vm-blacklist/blob/main/gpu_list.txt
https://github.githubassets.com/favicons/favicon.png
https://github.githubassets.com/assets/react-code-view-14a709e0fc35.js
https://github.com/fluidicon.png
https://github.githubassets.com/assets/global-8b10f05a77e6.css
https://partner.github.com
https://github.githubassets.com/assets/light_high_contrast-fd5499848985.css
https://github.githubassets.com/assets/dark_tritanopia-68d6b2c79663.css
https://github.com
https://github.com/enterprise/startups
https://github.com/features/issues
https://github.com/6nz/virustotal-vm-blacklist/blob/main/ip_list.txt
https://api.github.com/_private/browser/stats
https://github.githubassets.com/assets/vendors-node_modules_github_arianotify-polyfill_ariaNotify-po
https://github.com/6nz/virustotal-vm-blacklist/blob/main/hwid_li
https://github.cLR
https://github.githubassets.com/assets/dark_high_contrast-2494e44ccdc5.css
https://skills.github.com
https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_
https://github.githubassets.com/assets/ui_packages_code-view-shared_hooks_use-file-page-payload_ts-u
https://github.com/6nz/virustotal-vm-blacklist/raw/refs/heads/main/gpu_list.txt
https://repository-images.githubusercontent.com/421457018/69cb759a-2fb8-44f4-a1e2-69756adad8dd
https://user-images.githubusercontent.com/
https://github.githubassets.com/assets/ui_packages_hydro-analytics_hydro-analytics_ts-ui_packages_ve
https://github.com/features
https://github.com/features/code-review
https://github.com/readme
https://github.com/customer-stories
https://github.com/6nz/virustotal-vm-blacklist/blob/main/gpu_list.txt"
https://github.githubassets.com/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-85
https://github.githubassets.com/assets/light_colorblind-71cd4cc132ec.css
https://github.githubassets.com/assets/github-2f6e722088eb.css
https://github.com/6nz/virustotal-vm-blacklist/blob/main/pc_name_list.txt
https://github.com/6nz/virustotal-vm-blacklist/blob/main/gpu_list.txtd
https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_mo
https://github.githubassets.com/assets/ui_packages_paths_index_ts-c733d4a976df.js
https://github.com/6nz/virustotal-vm-blacklist/blob/main/pc_username_list.txt
https://github.githubassets.com/assets/behaviors-a6e4c4c86bfa.js
https://github.com/features/code-search
https://docs.github.com/get-started/accessibility/keyboard-shortcuts
https://github.githubassets.com/assets/primer-react.9fa170e9435ed4b922b9.module.css
https://github.githubassets.com/favicons/favicon
https://github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_e
https://ipecho.nettw
https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_
https://docs.github.com/site-policy/privacy-policies/github-privacy-statement
https://github.githubassets.com/assets/app_assets_modules_github_sticky-scroll-into-view_ts-7cbef09a
https://github.com/6nz/virustotal-vm-blacklist/blob/main/pc_name_lis
https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser
https://github.githubassets.com/assets/notifications-subscriptions-menu-3eda30673b32.js
https://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
https://github.com/6nz/virustotal-vm-blacklist/blob/main/hwid_list.txt"
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-ui_packages_code-nav
https://github.githubassets.com/assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_m
https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_
https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn
https://github.com/6nz/virustotal-vm-blacklist/blob/main/pc_username_list.txt"
https://github.githubassets.com/assets/dark_dimmed-afda8eb0fb33.css
https://github.com/6nz/virustotal-vm-blacklist/blob/main/pc_username_lis

Dropped files

Name File Type Hashes Detection
C:\ProgramData\MicrosoftDeviceDriversx64\AgileDotNet.VMRuntime.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\ProgramData\MicrosoftDeviceDriversx64\ShellInfrastructureHost.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ELsb0Wg55V.exe.log
CSV text
#