23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Titirez.Generic Sample 00192f879f31… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 00192f879f31…. Malware family: Mint.Titirez.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","keywords":["Malicious","Mint.Titirez.Generic","malware analysis","sandbox report","threat intelligence","00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be"],"about":{"@type":"SoftwareApplication","name":"2017-10-30_05-40-00.exe","applicationCategory":["peexe","executable"],"identifier":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Titirez.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Tc1a,"" wrote bytes "4d" to virtual address "0x00415B1C" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "d9" to virtual address "0x00428000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "eb" to virtual address "0x00426000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "8a" to virtual address "0x00427000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "bb" to virtual address "0x00424000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "77" to virtual address "0x00425000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "f3" to virtual address "0x00422000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "99" to virtual address "0x00423000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "8f" to virtual address "0x00420000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "a1" to virtual address "0x00421000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "7e" to virtual address "0x0041D000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "9c" to virtual address "0x0041C000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "b1" to virtual address "0x0041F000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "d8" to virtual address "0x0041E000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "1f" to virtual address "0x00419000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "75" to virtual address "0x00418000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "82" to virtual address "0x0041B000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "50" to virtual address "0x0041A000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "76" to virtual address "0x00417000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE") "" wrote bytes "e2" to virtual address "0x00416000" (part of module "00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D1478276A69BE.EXE")25:T551,"" wrote 32 bytes to a remote process "C:\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe" (Handle: 52) "" wrote 52 bytes to a remote process "C:\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe" (Handle: 52) "" wrote 4 bytes to a remote process "C:\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe" (Handle: 52) "" wrote 1024 bytes to a remote process "C:\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe" (Handle: 52) "" wrote 9728 bytes to a remote process "C:\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe" (Handle: 52) "" wrote 51200 bytes to a remote process "C:\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe" (Handle: 52) "" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 290 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496)26:T1e28,Found malicious artifacts related to "62.113.203.99" (ASN: , Owner: ): ... File SHA256: 742333aebc251113367a5044802a4b85e0e94efa231eb5b2fce4ec0a247bc3a9 (Scanned on 10/21/2017 16:48:28) File SHA256: 5fb51e463be08f61a90a4a5d7be3dc922277319332ee79423750993101f0f370 (Scanned on 10/15/2017 01:36:34) File SHA256: f7cfdf1999fb94dcc0648638fa3d26f0d877eb393050eef81172aa081c28cdbc (Scanned on 07/23/2017 19:30:29) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "93.170.96.235" (ASN: , Owner: ): ... File SHA256: 11a162caa419ef4f83ee5c613d1a96907d4df3d52c455c81b50e030e31822678 (Scanned on 10/25/2017 01:18:47) File SHA256: 742333aebc251113367a5044802a4b85e0e94efa231eb5b2fce4ec0a247bc3a9 (Scanned on 10/21/2017 16:48:28) File SHA256: 07b38f5f1471bfc6d2122eddacc8d91a7ecfb9dccea53d59a6a33547d4d146ca (AV positives: 12/63 scanned on 10/03/2017 13:12:57) File SHA256: f7cfdf1999fb94dcc0648638fa3d26f0d877eb393050eef81172aa081c28cdbc (Scanned on 07/23/2017 19:30:29) Found malicious artifacts related to "31.3.135.232" (ASN: , Owner: ): ... URL: http://31.3.135.232/ (AV positives: 3/65 scanned on 08/28/2017 10:02:15) URL: http://31.3.135.232:53/ (AV positives: 2/64 scanned on 03/23/2017 17:22:11) File SHA256: 78070b9a01616fbb7fe78922dadd6b49d40ed2a0d7835c2b7c0e84724bb1cf8c (Scanned on 10/22/2017 21:21:57) File SHA256: 742333aebc251113367a5044802a4b85e0e94efa231eb5b2fce4ec0a247bc3a9 (Scanned on 10/21/2017 16:48:28) File SHA256: 146ca3b5d1be28ee3a5b299c21eb6e7c093cef4262c48a23ec2782cbf8c59509 (Scanned on 10/20/2017 05:11:17) File SHA256: b77d736c66a02de55595b93b10e7e48173eb0637dae816cfcf9a43eadc058c38 (Scanned on 08/31/2017 16:47:59) File SHA256: ed89a3148131d0efb99ed791d48cfb9ee9f032ec72656d26384a5c45f8bdff77 (Scanned on 08/31/2017 16:47:44) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:58) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "108.61.164.218" (ASN: , Owner: ): ... File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "23.94.5.133" (ASN: , Owner: ): ... URL: http://23.94.5.133/ (AV positives: 2/64 scanned on 10/26/2017 21:13:21) File SHA256: 467898cfbe1259dbfe1d56080b7869b368d2ddfc6d4aeb9f786be1d60f2dd0ea (Scanned on 10/26/2017 12:00:35) File SHA256: 16c956462a70aa65e195de51c616c7ecc1e4940664789b9107ba093b99faef58 (Scanned on 10/25/2017 05:38:41) File SHA256: cd1a22a290d7643db062680f0f9687df8ed49ab2ebb6b7549ab828ab8d999100 (Scanned on 10/23/2017 08:31:44) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:23) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:41) Found malicious artifacts related to "51.255.48.78" (ASN: , Owner: ): ... URL: http://51.255.48.78/ (AV positives: 1/65 scanned on 07/19/2017 03:52:53) File SHA256: 0eef57d352a42628adddd664e7d35285026ee4d0755fdb23f3e9a087a4205148 (AV positives: 39/68 scanned on 10/30/2017 05:43:42) File SHA256: a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e (Scanned on 08/31/2017 17:12:09) File SHA256: 953fec239651bd73633f558954592768cab43cafe07e9caa240097dac0286ccd (Scanned on 08/31/2017 17:10:31) File SHA256: f3f648ed4f1188685f7afda176d16913b77d5722f21647820d275b47d72a9acf (AV positives: 14/65 scanned on 08/29/2017 14:48:34) File SHA256: 078dfb58efa8d69d6f87698ac41bdaac623c3b7b0dbe1307fdc9fec98d8beb8f (AV positives: 22/65 scanned on 08/12/2017 04:28:41) File SHA256: 4aa4dc793b90a9e4c7b4c5ab5e60af2ad7e8f5ba828bbcf61e90b71021a81ec7 (Scanned on 07/21/2017 17:37:33) File SHA256: cc6bf0264e91ba99f332e0b6ff32e24cd3c728d0d55eeba428542a8e65c97a79 (Scanned on 07/21/2017 17:36:12) File SHA256: 53e1b3afc79a33822471bf3f06a4e22379b99c1a8e4b04798b1c78daaea78799 (Scanned on 07/21/2017 17:32:51) File SHA256: cb2a2457523be36d6e2ecd9069e0ab19b8392766d113fcffd15f7c6dde9a7b1c (AV positives: 38/63 scanned on 07/16/2017 15:42:13) File SHA256: 071868a430256589aa51c7263bf593300dbb7531876a4f17705960ade9223404 (AV positives: 11/60 scanned on 06/28/2017 10:28:47) Found malicious artifacts related to "130.255.73.90" (ASN: , Owner: ): ... URL: http://130.255.73.90/ (AV positives: 1/64 scanned on 10/20/2017 19:31:23) File SHA256: 467898cfbe1259dbfe1d56080b7869b368d2ddfc6d4aeb9f786be1d60f2dd0ea (Scanned on 10/26/2017 12:00:35) File SHA256: 8b8d5b527c430888483c6e2909b995bcfb64478a715d740780e45a284434c032 (Scanned on 10/25/2017 19:57:01) File SHA256: d23369d9f435779c204c1c76dde4f7b2e2be7432076239d6e386028c52f0ab4e (Scanned on 10/25/2017 17:20:39) File SHA256: 16c956462a70aa65e195de51c616c7ecc1e4940664789b9107ba093b99faef58 (Scanned on 10/25/2017 05:38:41) File SHA256: cd1a22a290d7643db062680f0f9687df8ed49ab2ebb6b7549ab828ab8d999100 (Scanned on 10/23/2017 08:31:44) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:22) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:40) Found malicious artifacts related to "96.90.175.167" (ASN: , Owner: ): ... URL: http://96.90.175.167/ (AV positives: 1/64 scanned on 10/17/2017 21:15:47) File SHA256: 467898cfbe1259dbfe1d56080b7869b368d2ddfc6d4aeb9f786be1d60f2dd0ea (Scanned on 10/26/2017 12:00:35) File SHA256: 16c956462a70aa65e195de51c616c7ecc1e4940664789b9107ba093b99faef58 (Scanned on 10/25/2017 05:38:41) File SHA256: cd1a22a290d7643db062680f0f9687df8ed49ab2ebb6b7549ab828ab8d999100 (Scanned on 10/23/2017 08:31:44) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:23) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:41)27:T1e28,Found malicious artifacts related to "62.113.203.99" (ASN: , Owner: ): ... File SHA256: 742333aebc251113367a5044802a4b85e0e94efa231eb5b2fce4ec0a247bc3a9 (Scanned on 10/21/2017 16:48:28) File SHA256: 5fb51e463be08f61a90a4a5d7be3dc922277319332ee79423750993101f0f370 (Scanned on 10/15/2017 01:36:34) File SHA256: f7cfdf1999fb94dcc0648638fa3d26f0d877eb393050eef81172aa081c28cdbc (Scanned on 07/23/2017 19:30:29) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "93.170.96.235" (ASN: , Owner: ): ... File SHA256: 11a162caa419ef4f83ee5c613d1a96907d4df3d52c455c81b50e030e31822678 (Scanned on 10/25/2017 01:18:47) File SHA256: 742333aebc251113367a5044802a4b85e0e94efa231eb5b2fce4ec0a247bc3a9 (Scanned on 10/21/2017 16:48:28) File SHA256: 07b38f5f1471bfc6d2122eddacc8d91a7ecfb9dccea53d59a6a33547d4d146ca (AV positives: 12/63 scanned on 10/03/2017 13:12:57) File SHA256: f7cfdf1999fb94dcc0648638fa3d26f0d877eb393050eef81172aa081c28cdbc (Scanned on 07/23/2017 19:30:29) Found malicious artifacts related to "31.3.135.232" (ASN: , Owner: ): ... URL: http://31.3.135.232/ (AV positives: 3/65 scanned on 08/28/2017 10:02:15) URL: http://31.3.135.232:53/ (AV positives: 2/64 scanned on 03/23/2017 17:22:11) File SHA256: 78070b9a01616fbb7fe78922dadd6b49d40ed2a0d7835c2b7c0e84724bb1cf8c (Scanned on 10/22/2017 21:21:57) File SHA256: 742333aebc251113367a5044802a4b85e0e94efa231eb5b2fce4ec0a247bc3a9 (Scanned on 10/21/2017 16:48:28) File SHA256: 146ca3b5d1be28ee3a5b299c21eb6e7c093cef4262c48a23ec2782cbf8c59509 (Scanned on 10/20/2017 05:11:17) File SHA256: b77d736c66a02de55595b93b10e7e48173eb0637dae816cfcf9a43eadc058c38 (Scanned on 08/31/2017 16:47:59) File SHA256: ed89a3148131d0efb99ed791d48cfb9ee9f032ec72656d26384a5c45f8bdff77 (Scanned on 08/31/2017 16:47:44) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:58) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "108.61.164.218" (ASN: , Owner: ): ... File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "23.94.5.133" (ASN: , Owner: ): ... URL: http://23.94.5.133/ (AV positives: 2/64 scanned on 10/26/2017 21:13:21) File SHA256: 467898cfbe1259dbfe1d56080b7869b368d2ddfc6d4aeb9f786be1d60f2dd0ea (Scanned on 10/26/2017 12:00:35) File SHA256: 16c956462a70aa65e195de51c616c7ecc1e4940664789b9107ba093b99faef58 (Scanned on 10/25/2017 05:38:41) File SHA256: cd1a22a290d7643db062680f0f9687df8ed49ab2ebb6b7549ab828ab8d999100 (Scanned on 10/23/2017 08:31:44) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:23) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:41) Found malicious artifacts related to "51.255.48.78" (ASN: , Owner: ): ... URL: http://51.255.48.78/ (AV positives: 1/65 scanned on 07/19/2017 03:52:53) File SHA256: 0eef57d352a42628adddd664e7d35285026ee4d0755fdb23f3e9a087a4205148 (AV positives: 39/68 scanned on 10/30/2017 05:43:42) File SHA256: a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e (Scanned on 08/31/2017 17:12:09) File SHA256: 953fec239651bd73633f558954592768cab43cafe07e9caa240097dac0286ccd (Scanned on 08/31/2017 17:10:31) File SHA256: f3f648ed4f1188685f7afda176d16913b77d5722f21647820d275b47d72a9acf (AV positives: 14/65 scanned on 08/29/2017 14:48:34) File SHA256: 078dfb58efa8d69d6f87698ac41bdaac623c3b7b0dbe1307fdc9fec98d8beb8f (AV positives: 22/65 scanned on 08/12/2017 04:28:41) File SHA256: 4aa4dc793b90a9e4c7b4c5ab5e60af2ad7e8f5ba828bbcf61e90b71021a81ec7 (Scanned on 07/21/2017 17:37:33) File SHA256: cc6bf0264e91ba99f332e0b6ff32e24cd3c728d0d55eeba428542a8e65c97a79 (Scanned on 07/21/2017 17:36:12) File SHA256: 53e1b3afc79a33822471bf3f06a4e22379b99c1a8e4b04798b1c78daaea78799 (Scanned on 07/21/2017 17:32:51) File SHA256: cb2a2457523be36d6e2ecd9069e0ab19b8392766d113fcffd15f7c6dde9a7b1c (AV positives: 38/63 scanned on 07/16/2017 15:42:13) File SHA256: 071868a430256589aa51c7263bf593300dbb7531876a4f17705960ade9223404 (AV positives: 11/60 scanned on 06/28/2017 10:28:47) Found malicious artifacts related to "130.255.73.90" (ASN: , Owner: ): ... URL: http://130.255.73.90/ (AV positives: 1/64 scanned on 10/20/2017 19:31:23) File SHA256: 467898cfbe1259dbfe1d56080b7869b368d2ddfc6d4aeb9f786be1d60f2dd0ea (Scanned on 10/26/2017 12:00:35) File SHA256: 8b8d5b527c430888483c6e2909b995bcfb64478a715d740780e45a284434c032 (Scanned on 10/25/2017 19:57:01) File SHA256: d23369d9f435779c204c1c76dde4f7b2e2be7432076239d6e386028c52f0ab4e (Scanned on 10/25/2017 17:20:39) File SHA256: 16c956462a70aa65e195de51c616c7ecc1e4940664789b9107ba093b99faef58 (Scanned on 10/25/2017 05:38:41) File SHA256: cd1a22a290d7643db062680f0f9687df8ed49ab2ebb6b7549ab828ab8d999100 (Scanned on 10/23/2017 08:31:44) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:22) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:40) Found malicious artifacts related to "96.90.175.167" (ASN: , Owner: ): ... URL: http://96.90.175.167/ (AV positives: 1/64 scanned on 10/17/2017 21:15:47) File SHA256: 467898cfbe1259dbfe1d56080b7869b368d2ddfc6d4aeb9f786be1d60f2dd0ea (Scanned on 10/26/2017 12:00:35) File SHA256: 16c956462a70aa65e195de51c616c7ecc1e4940664789b9107ba093b99faef58 (Scanned on 10/25/2017 05:38:41) File SHA256: cd1a22a290d7643db062680f0f9687df8ed49ab2ebb6b7549ab828ab8d999100 (Scanned on 10/23/2017 08:31:44) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:23) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:41)28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAHQAAABHAAAAAAAAAAAAAHAABmZgAAcAAAAAAAAAAHAEd3d3d3dABwAAAAAAAAcAd4dmZmZ4dwBwAAAAAABwd4ZmZmZmZmh3BwAAAAAHB3dmZmZmZmZmd3BwAAAAcHhmZmZmbGZmZmaHBwAABwd2ZmbMZ4iGZmZmZ3BwAAAHdmZ4j///jGZmxmdwAABAeGaP//////iIiIdmhwQABnZsj//////4iIiIxmdgBAeGbI//////+IiIiMZocEQHdmyP/////4iIiIjGZ3BAB2Zsj/iPj//4iIiIxmZwAHdmbI/3j8j/+IiIiMZmdwB3ZmyP+IiI//iIiIjGZncAd2Zsj/iIiP/4iIiIxmZ3AHdmbI+I/Pj/iIiIiMZmdwAHZmyPj/j4j/iIiIjGZnAEB3Zsj/////+HiIeIxmdwRAeGbI//////+IiIiMZocEAHdmyP//////iIiIjGZ3AAQHhmj//////4iIiHZocEAAAHdmaIj///jGzMxmdwAAAHB3ZmbMxniIZmZmZncHAAAGB4ZmZmZmxmZmZmhwYAAAAEB3dmZmZmZmZmd3BAAAAAAEB3hmZmZmZmaHcEAAAAAAAGAHeHZmZmeHcAYAAAAAAAAHAHd3d3d3dwBwAAAAAAAAAAQAAHd3AABAAAAAAAAAAAAABEAAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790279857566,"unified_at":"2026-09-24T19:57:37.566Z","metadata":{"hashes":{"sha256":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","sha1":"6fcd770ce40cc91cf9fef9f774d9a746b64085dc","md5":"4886b97fc58c418768f6b4f90765ca56","sha512":"50643cd71b57ab1302b7a9cbc5ef87e3cddede4f536166837622264357771768022968e141b4beb5e448a57375d9d4329ed460023e0c97920234c75b75377a6a","ssdeep":"3072:3Gv4Gv4Gv4Gv4Gv4Gv4Gv4GvAnACIL96mnwUks5qrp1OfXPC210qJ:3GwGwGwGwGwGwGwG4nbO98UkkqrpkXC0","ssdeep_chunks":["3072:3Gv4Gv4","3072:Gv4Gv4G","3072:v4Gv4Gv","3072:4Gv4Gv4","3072:4Gv4GvA","3072:Gv4GvAn","3072:v4GvAnA","3072:4GvAnAC","3072:GvAnACI","3072:vAnACIL","3072:AnACIL9","3072:nACIL96","3072:ACIL96m","3072:CIL96mn","3072:IL96mnw","3072:L96mnwU","3072:96mnwUk","3072:6mnwUks","3072:mnwUks5","3072:nwUks5q","3072:wUks5qr","3072:Uks5qrp","3072:ks5qrp1","3072:s5qrp1O","3072:5qrp1Of","3072:qrp1OfX","3072:rp1OfXP","3072:p1OfXPC","3072:1OfXPC2","3072:OfXPC21","3072:fXPC210","3072:XPC210q","3072:PC210qJ","6144:3Gv4Gv4","6144:Gv4Gv4G","6144:v4Gv4Gv","6144:4Gv4Gv4","6144:4Gv4GvA","6144:Gv4GvAn","6144:v4GvAnA","6144:4GvAnAC","6144:GvAnACI","6144:vAnACIL","6144:AnACIL9","6144:nACIL96","6144:ACIL96m","6144:CIL96mn","6144:IL96mnw","6144:L96mnwU","6144:96mnwUk","6144:6mnwUks","6144:mnwUks5","6144:nwUks5q","6144:wUks5qr","6144:Uks5qrp","6144:ks5qrp1","6144:s5qrp1O","6144:5qrp1Of","6144:qrp1OfX","6144:rp1OfXP","6144:p1OfXPC","6144:1OfXPC2","6144:OfXPC21","6144:fXPC210","6144:XPC210q","6144:PC210qJ","3072:3GwGwGw","3072:GwGwGwG","3072:wGwGwGw","3072:wGwGwG4","3072:GwGwG4n","3072:wGwG4nb","3072:GwG4nbO","3072:wG4nbO9","3072:G4nbO98","3072:4nbO98U","3072:nbO98Uk","3072:bO98Ukk","3072:O98Ukkq","3072:98Ukkqr","3072:8Ukkqrp","3072:Ukkqrpk","3072:kkqrpkX","3072:kqrpkXC","3072:qrpkXC0"],"imphash":"55f9908b9a090832c4ae8aebeef154c9"},"file_info":{"file_name":"2017-10-30_05-40-00.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":156672,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509342603000,"last_seen":1677357539000,"last_multi_scan":1677357539000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","chthonic","zeus"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":11,"malicious_count":13,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1246194","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Titirez.jqW@KO8@@Wpi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Titirez.jqW@KO8@@Wpi (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FYGF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051a7e81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.jaal","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.cok","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.euurxa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Inject-CEE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.BX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1287859","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.Titirez.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"letit2.bit\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"62.113.203.99:53\"\n \"93.170.96.235:53\"\n \"85.159.213.210:53\"\n \"37.187.16.17:53\"\n \"31.3.135.232:53\"\n \"52.90.6.184:80\"\n \"45.63.99.180:53\"\n \"45.32.28.232:53\"\n \"108.61.164.218:53\"\n \"45.56.117.118:53\"\n \"23.94.5.133:53\"\n \"51.255.48.78:53\"\n \"130.255.78.223:53\"\n \"130.255.73.90:53\"\n \"185.133.72.100:53\"\n \"96.90.175.167:53\"\n \"104.238.186.189:53\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\{0AC140EE-3B60-0EA6-0A57-CCDBE577D2BD}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015693-00003072)\n Spawned process \"msiexec.exe\" (UID: 00015841-00003552)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Oraclet.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\msiexec.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Encoding: identity\nUser-Agent: Microsoft BITS/7.5\nX-Old-UID: cnt=0\nX-Last-HR: 0x80042194\nX-Last-HTTP-Status-Code: 404\n\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"Oraclet.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"msiexec.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"msiexec.exe\" called \"OpenService\" to access the \"wuauserv\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"WdNisSvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"wscsvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"SharedAccess\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"MpsSvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"WinDefend\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"SharedAccess\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"MpsSvc\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Oraclet.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ORACLET\"; Value: \"%APPDATA%\\Oraclet\\Oraclet.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoA\n GetModuleHandleA\n LockResource\n GetProcAddress\n FindResourceA\n GetModuleFileNameA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$24","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN TCP DNS Query Domain .bit\" (SID: 2826593, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/66 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/66 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"35/66 Antivirus vendors marked dropped file \"Oraclet.exe\" as malicious (classified as \"Trojan.Generic\" with 53% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"35/66 Antivirus vendors marked spawned process \"\" (PID: 3072) as malicious (classified as \"Trojan.Generic\" with 53% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 17 (or more) hosts in at least 7 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wuauserv\" (Indicator: \"wuauserv\")\n \"wscsvc\" (Indicator: \"wscsvc\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"msiexec.exe\" called \"OpenService\" to access the \"wuauserv\" service (\"Windows Update\")\n \"msiexec.exe\" called \"OpenService\" to access the \"wscsvc\" service (\"Windows Security Center\")\n \"msiexec.exe\" called \"OpenService\" to access the \"MpsSvc\" service (\"Windows Firewall\")\n \"msiexec.exe\" called \"OpenService\" to access the \"WinDefend\" service (\"Windows Defender\")","origin":"API Call","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"level":"malicious","category":"System Security","name":"Sent a control code to a critical system service","description":"\"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\" (\"Windows Update\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\" (\"Windows Security Center\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"MpsSvc\" (\"Windows Firewall\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\" (\"Windows Defender\")","origin":"API Call","relevance":10,"id":"api-78","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the windows product ID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":17,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banker","chthonic","zeus"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59f6bb7a7ca3e1442129d5e3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHE","CZE","DEU","FRA","GBR","NLD","USA"],"submit_name":"2017-10-30_05-40-00.exe","analysis_start_time":"2017-10-30T06:39:16+00:00","indicators_count":{"informative":8,"suspicious":12,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"62.113.203.99","port":53,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"93.170.96.235","port":53,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"85.159.213.210","port":53,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"37.187.16.17","port":53,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"31.3.135.232","port":53,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"52.90.6.184","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"45.63.99.180","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"45.32.28.232","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"108.61.164.218","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"45.56.117.118","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"23.94.5.133","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"51.255.48.78","port":53,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"130.255.78.223","port":53,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"130.255.73.90","port":53,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"185.133.72.100","port":53,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"96.90.175.167","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"address":"104.238.186.189","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}],"dns_resolutions":[{"domain":"letit2.bit","country":"-","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}],"processes":[{"pid":3012,"ppid":0,"name":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe","command_line":"","sha256":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","normalized_path":"C:\\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe","uid":"00015020-00003012","icon":"$28"},{"pid":3072,"ppid":3012,"name":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe","command_line":"","sha256":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","normalized_path":"C:\\00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be.exe","parent_uid":"00015020-00003012","uid":"00015693-00003072","icon":"$29"},{"pid":3552,"ppid":3072,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00015693-00003072","uid":"00015841-00003552","icon":"$2a"}],"all_imported_dlls":["ntdll.dll","gdi32.dll","usp10.dll","version.dll","winnsi.dll","mswsock.dll","profapi.dll","setupapi.dll","WSHTCPIP.DLL","KernelBase.dll","apphelp.dll","uxtheme.dll","cfgmgr32.dll","iertutil.dll","ws2_32.dll","rpcss.dll","Wldap32.dll","msctf.dll","sspicli.dll","ole32.dll","shell32.dll","msacm32.dll","wininet.dll","nsi.dll","secur32.dll","AcGenral.dll","kernel32.dll","shlwapi.dll","mpr.dll","dwmapi.dll","crypt32.dll","lpk.dll","msvcrt.dll","sfc.dll","sfc_os.dll","devobj.dll","msasn1.dll","cryptbase.dll","ntmarta.dll","sechost.dll","rpcrt4.dll","AcLayers.dll","samcli.dll","urlmon.dll","IPHLPAPI.DLL","winmm.dll","user32.dll","imm32.dll","advapi32.dll","msi.dll","oleaut32.dll","userenv.dll","dnsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Oraclet.exe","sha256":"00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%APPDATA%\\Oraclet","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%APPDATA%\\Oraclet\\Oraclet.exe","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D14\\00192F879F31C7425524DC4A1DEE88A94D4DD24694A332873E3D14","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{0AC140EE-3B60-0EA6-0A57-CCDBE577D2BD}","sources":[{"report_type":"sandbox","report_id":"59f6bb7a7ca3e1442129d5e3"}]}]}},"report_ids":{"sandbox_job_ids":["59f6bb7a7ca3e1442129d5e3"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Mint.Titirez.Generic Sample 00192f879f31… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 00192f879f31…. Malware family: Mint.Titirez.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.Titirez.Generic Sample 00192f879f31… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 00192f879f31…. Malware family: Mint.Titirez.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/00192f879f31c7425524dc4a1dee88a94d4dd24694a332873e3d1478276a69be"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.Titirez.Generic Sample 00192f879f31… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 00192f879f31…. Malware family: Mint.Titirez.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]