File name: | PAYMENT ADVICE.ace |
Full analysis: | https://app.any.run/tasks/68f15881-62ea-4bfd-bfcb-0a67f28a42df |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | July 17, 2019, 16:09:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/octet-stream |
File info: | ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid |
MD5: | 5F28BB59BEBF93D14A8C407B8EC4E120 |
SHA1: | DA1A5A9D5ECC23EAEE60C93C237EF60553AAF696 |
SHA256: | 7693CD2E495696497E5CD55BCD6325FE128A06221B12DDE5173A8512C546A14D |
SSDEEP: | 6144:k8iLnAB4JyMOxGBU8o/thBej/kr9w1Kb9i3wt9BIKWukz4b/fC1/lJOeGYrpSe:krLAB4J5OEpMLBAEb9oyEIg4zfChO5YX |
.ace | | | ACE compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3168 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PAYMENT ADVICE.ace" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3296 | "C:\Users\admin\Desktop\starrrrr0000.exe" | C:\Users\admin\Desktop\starrrrr0000.exe | explorer.exe | |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
356 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\subfolder\filename.vbs" | C:\Windows\System32\WScript.exe | starrrrr0000.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2384 | "C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | — | starrrrr0000.exe |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
3304 | C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | filename.exe | |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 4294967295 Version: 8.07.0008 | ||||
3448 | "C:\Users\admin\Desktop\starrrrr0000.exe" | C:\Users\admin\Desktop\starrrrr0000.exe | — | explorer.exe |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
3572 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\subfolder\filename.vbs" | C:\Windows\System32\WScript.exe | starrrrr0000.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3728 | "C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | — | starrrrr0000.exe |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 | ||||
476 | C:\Users\admin\subfolder\filename.exe" | C:\Users\admin\subfolder\filename.exe | filename.exe | |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Version: 8.07.0008 | ||||
2264 | "C:\Users\admin\Desktop\starrrrr0000.exe" | C:\Users\admin\Desktop\starrrrr0000.exe | — | explorer.exe |
User: admin Company: Collapseremonstratively3 Integrity Level: MEDIUM Description: CollapseUNSEVERED9 Exit code: 0 Version: 8.07.0008 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3168 | WinRAR.exe | C:\Users\admin\Desktop\starrrrr0000.exe | executable | |
MD5:1BA70577C7AC8D46A75B58D300F6095E | SHA256:1F8F1A3D8017C65195BF4206EEDF17F0FCD344FA11BB01889426A4E2C5863653 | |||
3296 | starrrrr0000.exe | C:\Users\admin\subfolder\filename.exe | executable | |
MD5:1BA70577C7AC8D46A75B58D300F6095E | SHA256:1F8F1A3D8017C65195BF4206EEDF17F0FCD344FA11BB01889426A4E2C5863653 | |||
2264 | starrrrr0000.exe | C:\Users\admin\AppData\Local\Temp\~DF879FEC08DA52EDE5.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD | |||
3728 | filename.exe | C:\Users\admin\AppData\Local\Temp\~DF621A295E2EBCB479.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD | |||
1188 | starrrrr0000.exe | C:\Users\admin\subfolder\filename.vbs | text | |
MD5:28CCC5014300EF75E2038CDBDCB1F0C8 | SHA256:5C43264EAE271C2309DD1399B2AD54239C86305C92AA1A7C6610E46648A11EC7 | |||
3736 | filename.exe | C:\Users\admin\AppData\Local\Temp\~DFDCC657A847FE2A22.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD | |||
476 | filename.exe | C:\Users\admin\AppData\Local\Temp\636989803290370000_7d13099f-e9fe-4a85-af25-c6dd54f75cfd.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
3296 | starrrrr0000.exe | C:\Users\admin\AppData\Local\Temp\~DF2FD1C6CDE6351429.TMP | binary | |
MD5:BF364D303F5C4B3BDFD334CA0A1BA16F | SHA256:9E9C98986F7F4FCCAA0E30A31393BF26D9E717C64208A4B86BC06F9E232C48AD | |||
3448 | starrrrr0000.exe | C:\Users\admin\subfolder\filename.vbs | text | |
MD5:28CCC5014300EF75E2038CDBDCB1F0C8 | SHA256:5C43264EAE271C2309DD1399B2AD54239C86305C92AA1A7C6610E46648A11EC7 | |||
2264 | starrrrr0000.exe | C:\Users\admin\subfolder\filename.vbs | text | |
MD5:28CCC5014300EF75E2038CDBDCB1F0C8 | SHA256:5C43264EAE271C2309DD1399B2AD54239C86305C92AA1A7C6610E46648A11EC7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3304 | filename.exe | GET | 200 | 52.6.79.229:80 | http://checkip.amazonaws.com/ | US | text | 14 b | shared |
476 | filename.exe | GET | 200 | 52.6.79.229:80 | http://checkip.amazonaws.com/ | US | text | 14 b | shared |
476 | filename.exe | GET | 200 | 52.6.79.229:80 | http://checkip.amazonaws.com/ | US | text | 14 b | shared |
476 | filename.exe | GET | 200 | 52.6.79.229:80 | http://checkip.amazonaws.com/ | US | text | 14 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
476 | filename.exe | 202.146.241.47:587 | mail.hervitama.co.id | PT Centrin Utama | ID | malicious |
3304 | filename.exe | 202.146.241.47:587 | mail.hervitama.co.id | PT Centrin Utama | ID | malicious |
3304 | filename.exe | 52.6.79.229:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
476 | filename.exe | 52.6.79.229:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
Domain | IP | Reputation |
---|---|---|
checkip.amazonaws.com |
| shared |
mail.hervitama.co.id |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3304 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
3304 | filename.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
3304 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Keylogger.AgentTesla Exfiltration by SMTP |
476 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
476 | filename.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
476 | filename.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |