Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
Deep Malware Analysis
top title background image
flash

Ordine di acquisto_(PO102429)_OFT_PUMPS.exe

Status: finished
Submission Time: 2025-02-17 12:41:53 +01:00
Malicious
Trojan
Spyware
Evader
Lokibot, PureLog Stealer, zgRAT

Comments

Tags

  • exe

Details

  • Analysis ID:
    1617040
  • API (Web) ID:
    1617040
  • Analysis Started:
    2025-02-17 13:15:50 +01:00
  • Analysis Finished:
    2025-02-17 13:21:36 +01:00
  • MD5:
    f04e54b14850e86d7079e75f9212d0af
  • SHA1:
    f9ac755df86475a7bd6ec258f906df7bbaa5420b
  • SHA256:
    ee8578ebf209462c50f37d8fceb524db53b5b97078aa0995c775133b8d3f9d64
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 39/66
malicious
Score: 27/37
malicious

IPs

IP Country Detection
188.114.97.3
 European Union

Domains

Name IP Detection
ddrtot.shop
 188.114.97.3

URLs

Name Detection
http://ddrtot.shop/New/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.win/alien/fre.php
Click to see the 4 hidden entries
http://alphastand.trade/alien/fre.php
http://alphastand.top/alien/fre.php
http://www.ibsensoftware.com/
https://ddrtot.shop/New/PWS/fre.php

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ordine di acquisto_(PO102429)_OFT_PUMPS.exe.log
 CSV text
 #