File name: | PAYMENT ADVICE.ace |
Full analysis: | https://app.any.run/tasks/2a0eed32-afb4-4a98-96d9-77f7d915ea59 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | July 17, 2019, 16:15:04 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/octet-stream |
File info: | ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid |
MD5: | 5F28BB59BEBF93D14A8C407B8EC4E120 |
SHA1: | DA1A5A9D5ECC23EAEE60C93C237EF60553AAF696 |
SHA256: | 7693CD2E495696497E5CD55BCD6325FE128A06221B12DDE5173A8512C546A14D |
SSDEEP: | 6144:k8iLnAB4JyMOxGBU8o/thBej/kr9w1Kb9i3wt9BIKWukz4b/fC1/lJOeGYrpSe:krLAB4J5OEpMLBAEb9oyEIg4zfChO5YX |
.ace | | | ACE compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2828 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PAYMENT ADVICE.ace" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3552 | "C:\Users\admin\Desktop\starrrrr0000.exe" | C:\Users\admin\Desktop\starrrrr0000.exe | explorer.exe | |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
3492 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\subfolder\filename.vbs" | C:\Windows\System32\WScript.exe | starrrrr0000.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3684 | "C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | — | starrrrr0000.exe |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
2320 | C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | filename.exe | |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 4294967295 Version: 8.07.0008 | ||||
3048 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3480 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\subfolder\filename.vbs" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | |
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Version: 7.51 | ||||
2708 | "C:\Program Files\Notepad++\updater\gup.exe" -v7.51 | C:\Program Files\Notepad++\updater\gup.exe | notepad++.exe | |
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: GUP : a free (LGPL) Generic Updater Exit code: 0 Version: 4.1 | ||||
1568 | "C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | — | explorer.exe |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
3372 | C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | filename.exe | |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 3221225477 Version: 8.07.0008 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1568 | filename.exe | C:\Users\admin\AppData\Local\Temp\~DF4150C076B19A4A8A.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD | |||
3076 | dw20.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_filename.exe_57a4b54f8e8471a861ae7335ca6df9901ff37a_0c10dc55\Report.wer | binary | |
MD5:33A5B0087F569CFD5328D5C153737689 | SHA256:034537E696294E10B64BCF55877AFFA832B6CFB5A5A28423ECAA9FEE3AE11354 | |||
3552 | starrrrr0000.exe | C:\Users\admin\subfolder\filename.vbs | text | |
MD5:28CCC5014300EF75E2038CDBDCB1F0C8 | SHA256:5C43264EAE271C2309DD1399B2AD54239C86305C92AA1A7C6610E46648A11EC7 | |||
3372 | filename.exe | C:\Users\admin\AppData\Local\Temp\636989807124890625_6b31384e-0958-4f35-84cc-c008f514c3c5.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
3480 | notepad++.exe | C:\Users\admin\AppData\Roaming\Notepad++\plugins\Config\converter.ini | text | |
MD5:F70F579156C93B097E656CABA577A5C9 | SHA256:B926498A19CA95DC28964B7336E5847107DD3C0F52C85195C135D9DD6CA402D4 | |||
3480 | notepad++.exe | C:\Users\admin\AppData\Roaming\Notepad++\langs.xml | xml | |
MD5:E792264BEC29005B9044A435FBA185AB | SHA256:5298FD2F119C43D04F6CF831F379EC25B4156192278E40E458EC356F9B49D624 | |||
2320 | filename.exe | C:\Users\admin\AppData\Local\Temp\636989806403171875_02cdef28-e3d9-477b-b94d-85736056b16a.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
3552 | starrrrr0000.exe | C:\Users\admin\AppData\Local\Temp\~DFA0358EE2B98FC5D6.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD | |||
2828 | WinRAR.exe | C:\Users\admin\Desktop\starrrrr0000.exe | executable | |
MD5:1BA70577C7AC8D46A75B58D300F6095E | SHA256:1F8F1A3D8017C65195BF4206EEDF17F0FCD344FA11BB01889426A4E2C5863653 | |||
3684 | filename.exe | C:\Users\admin\AppData\Local\Temp\~DF00A9F42BDF756C51.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3372 | filename.exe | GET | 200 | 52.202.139.131:80 | http://checkip.amazonaws.com/ | US | text | 12 b | shared |
2320 | filename.exe | GET | 200 | 52.6.79.229:80 | http://checkip.amazonaws.com/ | US | text | 12 b | shared |
— | — | GET | 200 | 2.21.242.197:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | NL | der | 1.36 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 2.21.242.197:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | NL | whitelisted |
2320 | filename.exe | 52.6.79.229:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
2320 | filename.exe | 202.146.241.47:587 | mail.hervitama.co.id | PT Centrin Utama | ID | malicious |
2708 | gup.exe | 37.59.28.236:443 | notepad-plus-plus.org | OVH SAS | FR | whitelisted |
3372 | filename.exe | 52.202.139.131:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
3372 | filename.exe | 202.146.241.47:587 | mail.hervitama.co.id | PT Centrin Utama | ID | malicious |
Domain | IP | Reputation |
---|---|---|
notepad-plus-plus.org |
| whitelisted |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
checkip.amazonaws.com |
| shared |
mail.hervitama.co.id |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
2320 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
2320 | filename.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2320 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Keylogger.AgentTesla Exfiltration by SMTP |
3372 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
3372 | filename.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
3372 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Keylogger.AgentTesla Exfiltration by SMTP |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|