top title background image
flash

C9wUCfwfeT.exe

Status: finished
Submission Time: 2024-12-05 18:24:15 +01:00
Malicious
Trojan
Spyware
Evader
Lokibot, PureLog Stealer, zgRAT

Comments

Tags

  • exe

Details

  • Analysis ID:
    1569441
  • API (Web) ID:
    1569441
  • Original Filename:
    d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e.exe
  • Analysis Started:
    2024-12-05 19:11:46 +01:00
  • Analysis Finished:
    2024-12-05 19:17:19 +01:00
  • MD5:
    f2e32e33daa66e9cd593d80b9c40e82f
  • SHA1:
    824c23212249c7fda010e3c5895252f62b1ffdd2
  • SHA256:
    d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 23/38
malicious
malicious

IPs

IP Country Detection
104.21.73.230
United States

Domains

Name IP Detection
ddrtot.shop
104.21.73.230

URLs

Name Detection
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.win/alien/fre.php
http://ddrtot.shop/MV3/PWS/fre.php
Click to see the 5 hidden entries
http://alphastand.trade/alien/fre.php
https://ddrtot.shop/MV3/PWS/fre.php
http://alphastand.top/alien/fre.php
http://www.ibsensoftware.com/
https://ddrtot.shop/MV3/PWS/fre.phpRG

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\C9wUCfwfeT.exe.log
CSV text
#