File name: | PO 890.zip |
Full analysis: | https://app.any.run/tasks/92a0313e-0504-45d3-b1ec-26fac1ecdbf6 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | October 20, 2020, 11:15:59 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | A17670EF095C27AE65964621C0C96F8B |
SHA1: | 923FC6B9AFC95A2578BDB79996A14B3D12F21546 |
SHA256: | 5DD5BE128E8868AB9440F08645E7E3DC8E96AC01E53AED9C694E64ABEEF081F0 |
SSDEEP: | 12288:XwoPLRmjBTdpTB6P6nVYvWRY2qIXgp91SVyRi8OnrCTwaG2ag46Bs2Nq+ZF:XwwkTdpqEKWRvqoO1SVIijatagLqc |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | PO 890.exe |
---|---|
ZipUncompressedSize: | 871424 |
ZipCompressedSize: | 659276 |
ZipCRC: | 0x552774fe |
ZipModifyDate: | 2020:10:20 09:59:14 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2964 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PO 890.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
1476 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | explorer.exe | |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: HIGH Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 0 Version: 3.0.0.0 | ||||
3044 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | explorer.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: MEDIUM Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 0 Version: 3.0.0.0 | ||||
3340 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: HIGH Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 | ||||
3444 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: HIGH Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 | ||||
3496 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: HIGH Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 | ||||
3552 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: HIGH Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 | ||||
3800 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: HIGH Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 | ||||
2956 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: MEDIUM Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 | ||||
3072 | "C:\Users\admin\Desktop\PO 890.exe" | C:\Users\admin\Desktop\PO 890.exe | — | PO 890.exe |
User: admin Company: AsIaNHaWk™ Creations Integrity Level: MEDIUM Description: PAYROLL MANAGEMENT SOFTWARE Exit code: 4294967295 Version: 3.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2964 | WinRAR.exe | C:\Users\admin\Desktop\PO 890.exe | executable | |
MD5:441136B259F060A27CE8CDE0199C7CFB | SHA256:2AF8F8FE5B282503E0E1E5DC6465A6EF9FD3441BD2D13D1E21A07041D4BE5518 |