Create Interactive Tour

Windows Analysis Report
https://ruggessd.de/Cppss/inc/Odrivex

Overview

Sample URL:	https://ruggessd.de/Cppss/inc/Odrivex
Analysis ID:	1645308
Infos:

HTMLPhisher

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected HtmlPhish10

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

chrome.exe (PID: 2232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2116,i,9261609892937432583,7352456654750198233,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ruggessd.de/Cppss/inc/Odrivex" MD5: E81F54E6C1129887AEA47E7D092680BF)

Source	Rule	Description	Author	Strings
dropped/chromecache_80	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Source	Rule	Description	Author
3.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.9.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-21T16:19:53.827385+0100	2037788	1	Successful Credential Theft Detected	104.21.73.11	443	192.168.2.6	49758	TCP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-21T16:19:53.826797+0100	2847819	1	Successful Credential Theft Detected	192.168.2.6	49758	104.21.73.11	443	TCP

Click to jump to signature section

Show All Signature Results

Phishing

Source: https://ruggessd.de/Cppss/inc/Odrivex/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL 'ruggessd.de' does not match the legitimate domain 'microsoft.com'., The domain 'ruggessd.de' does not have any recognizable association with Microsoft., The use of a '.de' domain extension is unusual for Microsoft, which typically uses '.com'., The URL does not contain any recognizable Microsoft-related keywords or subdomains., The presence of an input field asking for an email is common in phishing attempts targeting Microsoft accounts. DOM: 3.6.pages.csv
Source: https://ruggessd.de/Cppss/inc/Odrivex/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'ruggessd.de' does not match the legitimate domain 'microsoft.com'., The domain 'ruggessd.de' does not have any recognizable association with Microsoft., The domain uses a '.de' extension which is not typically associated with Microsoft., There are no subdomains or recognizable Microsoft-related terms in the URL., The URL does not contain any direct reference to Microsoft, which is suspicious. DOM: 3.7.pages.csv

Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_80, type: DROPPED