top title background image
flash

SkB6zJ6H3N.exe

Status: finished
Submission Time: 2021-10-29 15:28:08 +02:00
Malicious
Trojan
Spyware
Evader
Raccoon SmokeLoader Vidar

Comments

Tags

  • exe
  • RedLineStealer

Details

  • Analysis ID:
    511734
  • API (Web) ID:
    879300
  • Analysis Started:
    2021-10-29 15:28:09 +02:00
  • Analysis Finished:
    2021-10-29 15:44:09 +02:00
  • MD5:
    b8d2d644a3ac5df8af9b3aff803f3347
  • SHA1:
    062e29d59604956a4cffd64fc81cd1c3f72b0ff3
  • SHA256:
    c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
clean
0/100

Third Party Analysis Engines

malicious
Score: 11/91
malicious
Score: 35/44
malicious

IPs

IP Country Detection
81.177.141.36
Russian Federation
116.121.62.237
Korea Republic of
194.180.174.181
unknown
Click to see the 8 hidden entries
216.128.137.31
United States
185.98.87.159
Russian Federation
45.141.84.21
Russian Federation
193.56.146.214
unknown
172.67.160.46
United States
162.159.135.233
United States
93.115.20.139
Romania
162.159.133.233
United States

Domains

Name IP Detection
privacytoolzforyou-6000.top
185.98.87.159
iyc.jelikob.ru
81.177.141.36
znpst.top
116.121.62.237
Click to see the 9 hidden entries
nusurtal4f.net
45.141.84.21
hajezey1.top
185.98.87.159
sysaheu90.top
185.98.87.159
telegalive.top
0.0.0.0
xacokuo8.top
0.0.0.0
toptelete.top
172.67.160.46
mas.to
88.99.75.82
cdn.discordapp.com
162.159.135.233
api.2ip.ua
77.123.139.190

URLs

Name Detection
http://sysaheu90.top/game.exe
http://hajezey1.top/
http://xacokuo8.top/
Click to see the 40 hidden entries
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9
http://znpst.top/dl/buildz.exe
http://toptelete.top/agrybirdsgamerept
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf
http://194.180.174.181/
http://www.nirsoft.net/
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
https://sectigo.com/CPS0C
https://sectigo.com/CPS0D
https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg
https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg
http://193.56.146.214/
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
http://www.sqlite.org/copyright.html.
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
http://tempuri.org/DetailsDataSet1.xsd
http://fontello.com
http://www.autoitscript.com/autoit3/J
https://duckduckgo.com/chrome_newtab
https://duckduckgo.com/ac/?q=
https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
http://ocsp.sectigo.com0
https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg
https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg
https://ac.ecosia.org/autocomplete?q=
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://nusurtal4f.net/
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\8746.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\sfiueca
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\eviueca
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 15 hidden entries
C:\Users\user\AppData\Roaming\cviueca:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\cviueca
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\EDD.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\97A5.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\8E8B.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\89D7.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\192F.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\86B8.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\75B0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\7428.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\6DDE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\69B5.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\5D4.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\32BC.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\319A.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#