26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 008c4bd6ee83… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 008c4bd6ee83…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d"],"about":{"@type":"SoftwareApplication","name":"1000.exe","applicationCategory":["peexe","executable"],"identifier":"008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51a,"\Sessions\1\BaseNamedObjects\Local\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}" "\Sessions\1\BaseNamedObjects\Local\{B92517C0-C493-538C-96FD-38372A81EC5B}" "\Sessions\1\BaseNamedObjects\Local\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "{63A6D59C-66D8-8D94-8847-FA113C6BCED5}" "Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}" "Local\WininetProxyRegistryMutex" "Local\WininetStartupMutex" "Local\WininetConnectionMutex" "Local\_!MSFTHISTORY!_" "Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!" "Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!" "Local\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}"28:T499,"" touched file "C:\Windows\System32\C_1252.NLS" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\ntdll.dll" "explorer.exe" touched file "C:\Windows\System32\C_1252.NLS" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "explorer.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "explorer.exe" touched file "C:\Windows\System32\msxml3r.dll" "explorer.exe" touched file "C:\Windows\System32\msxml6r.dll" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "explorer.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791566145038,"unified_at":"2026-10-09T17:15:45.038Z","metadata":{"hashes":{"sha256":"008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d","sha1":"16d5ded68677f4a870423d3fd30da8377a5b2408","md5":"e6d118192fc848797e15dc0600834783","sha512":"872b50145bd84646a402558e65894c499a7340248e94e672a10009d2c55d03a0fab93a2dcca3b88163293adc9dffde5bfbec1fb0b33e78a6daed968b0d2fa88c","ssdeep":"6144:wha4jvM2RgxFPZToQ8rdCDbiAflI3EFJvSchM1md8PIZZUvtKanGhW5F8:MD05gBCDbw3EFAEQNIZW15nGs","ssdeep_chunks":["6144:wha4jvM","6144:ha4jvM2","6144:a4jvM2R","6144:4jvM2Rg","6144:jvM2Rgx","6144:vM2RgxF","6144:M2RgxFP","6144:2RgxFPZ","6144:RgxFPZT","6144:gxFPZTo","6144:xFPZToQ","6144:FPZToQ8","6144:PZToQ8r","6144:ZToQ8rd","6144:ToQ8rdC","6144:oQ8rdCD","6144:Q8rdCDb","6144:8rdCDbi","6144:rdCDbiA","6144:dCDbiAf","6144:CDbiAfl","6144:DbiAflI","6144:biAflI3","6144:iAflI3E","6144:AflI3EF","6144:flI3EFJ","6144:lI3EFJv","6144:I3EFJvS","6144:3EFJvSc","6144:EFJvSch","6144:FJvSchM","6144:JvSchM1","6144:vSchM1m","6144:SchM1md","6144:chM1md8","6144:hM1md8P","6144:M1md8PI","6144:1md8PIZ","6144:md8PIZZ","6144:d8PIZZU","6144:8PIZZUv","6144:PIZZUvt","6144:IZZUvtK","6144:ZZUvtKa","6144:ZUvtKan","6144:UvtKanG","6144:vtKanGh","6144:tKanGhW","6144:KanGhW5","6144:anGhW5F","6144:nGhW5F8","12288:wha4jvM","12288:ha4jvM2","12288:a4jvM2R","12288:4jvM2Rg","12288:jvM2Rgx","12288:vM2RgxF","12288:M2RgxFP","12288:2RgxFPZ","12288:RgxFPZT","12288:gxFPZTo","12288:xFPZToQ","12288:FPZToQ8","12288:PZToQ8r","12288:ZToQ8rd","12288:ToQ8rdC","12288:oQ8rdCD","12288:Q8rdCDb","12288:8rdCDbi","12288:rdCDbiA","12288:dCDbiAf","12288:CDbiAfl","12288:DbiAflI","12288:biAflI3","12288:iAflI3E","12288:AflI3EF","12288:flI3EFJ","12288:lI3EFJv","12288:I3EFJvS","12288:3EFJvSc","12288:EFJvSch","12288:FJvSchM","12288:JvSchM1","12288:vSchM1m","12288:SchM1md","12288:chM1md8","12288:hM1md8P","12288:M1md8PI","12288:1md8PIZ","12288:md8PIZZ","12288:d8PIZZU","12288:8PIZZUv","12288:PIZZUvt","12288:IZZUvtK","12288:ZZUvtKa","12288:ZUvtKan","12288:UvtKanG","12288:vtKanGh","12288:tKanGhW","12288:KanGhW5","12288:anGhW5F","12288:nGhW5F8","6144:MD05gBC","6144:D05gBCD","6144:05gBCDb","6144:5gBCDbw","6144:gBCDbw3","6144:BCDbw3E","6144:CDbw3EF","6144:Dbw3EFA","6144:bw3EFAE","6144:w3EFAEQ","6144:3EFAEQN","6144:EFAEQNI","6144:FAEQNIZ","6144:AEQNIZW","6144:EQNIZW1","6144:QNIZW15","6144:NIZW15n","6144:IZW15nG","6144:ZW15nGs"],"imphash":"31750d6a4f61c8768e8da5d3051e9d90"},"file_info":{"file_name":"1000.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":452608,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521477244000,"last_seen":1750987370000,"last_multi_scan":1750987370000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ursnif","banker","panda","zbot"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":16,"malicious_count":4,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.tyfxd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30434043","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30434043 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Ursnif.BO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Injector.cc!s2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 0052501a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Foreign.tqOu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.ayj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Banker1.ezabmk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Lethic-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Foreign.SLVA-8321","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ursnif.BKB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Foreign","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_45.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Foreign.Win32.57718","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 19795-3134-0040B4A1\n SetUnhandledExceptionFilter@KERNEL32.dll at 19795-1366-0040E653\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00033001-00001192-33651-16-00409E8C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00033001-00001192-33651-17-0040898A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00033001-00001192-33651-217-0040E653\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00033001-00001192-33651-368-0040B4A1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00033001-00001192-33651-199-0040BD79","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bitsupport.top\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.63.158.236:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00051028-00001384) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00051028-00001384) was launched with modified environment variables: \"Path\"\n Process \"explorer.exe\" (UID: 00051028-00001384) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\21E8.bi1\"\" on 2018-3-19.09:27:57.196\n \"cmd /C \"echo -------- >> %TEMP%\\21E8.bi1\"\" on 2018-3-19.09:27:57.306","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\21E8.bi1\"\" (UID: 00057082-00003580)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"echo -------- >> %TEMP%\\21E8.bi1\"\" (UID: 00057094-00003672)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"explorer.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 504)\n \"explorer.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 784)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"21E8.bi1\" has type \"ASCII text with CRLF line terminators\"\n \"prefs.js\" has type \"ASCII text with very long lines with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Drops executable files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"API-GSVC\"; Value: \"%APPDATA%\\Microsoft\\Cmdisvc6\\adprtext.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"bitsupport.top\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1000.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"adprtext.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00033001-00001192-00000105-105273007","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Scanning for process managers","description":"\"\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-15","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00033001-00001192-33651-226-0040DCDD\n cpuid at 50134-1375-0040DCDD","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DNS Query to a *.top domain - Likely Hostile\" (SID: 2023883, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://bitsupport.top\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/65 Antivirus vendors marked dropped file \"adprtext.exe\" as malicious (classified as \"DangerousObject.Multi\" with 21% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00051028-00001384)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2018-3-19.09:26:56.699 (UID: 00051028-00001384)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\1000.exe\" marked \"C:\\1000.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\1000.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"System Security","name":"Disables SPDY-connections","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"ENABLESPDY3_0\"; Value: \"00000000\")","origin":"Registry Access","relevance":5,"id":"registry-41","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"System Security","name":"Has the capability to lower Firefox security settings","description":"\"user_pref(\"network.http.spdy.enabled\", false);\" (Indicator: \"user_pref(\"network.http.spdy.enabled\",false);\"; File: \"prefs.js\")","origin":"File/Memory","relevance":10,"id":"string-60","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount\n VirtualAlloc\n SetWindowsHookExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FlsSetValue\" (Source: 1000.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"FlsGetValue\" (Source: 1000.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcessWindowStation\" (Source: 1000.exe.bin, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: 1000.exe.bin, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: 1000.exe.bin, API is part of module: USER32.DLL)\n Found string \"MessageBoxA\" (Source: 1000.exe.bin, API is part of module: USER32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/65 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/65 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 212)\n \"\" wrote 792 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 212)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\21E8.bi1\"\" (Indicator: \"myip.opendns.com\"; File: \"cmd.exe\")","origin":"File/Memory","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":44,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ursnif","banker","panda","zbot"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"5aafe25d7ca3e1307a6944e9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["RUS"],"submit_name":"1000.exe","analysis_start_time":"2018-03-19T17:19:07+00:00","indicators_count":{"informative":17,"suspicious":16,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.63.158.236","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}],"dns_resolutions":[{"domain":"bitsupport.top","address":"5.63.158.236","ttl":3033,"country":"Russian Federation","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"private person","registrar_name_servers":"ns2.hostline.ru","registrar_creation_date":"2018-02-28T18:12:28+00:00","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}],"processes":[{"pid":1192,"ppid":0,"name":"1000.exe","command_line":"","sha256":"008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d","normalized_path":"C:\\1000.exe","uid":"00033001-00001192","icon":"$29"},{"pid":1384,"ppid":1192,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00033001-00001192","uid":"00051028-00001384"}],"all_imported_dlls":["usp10.dll","shell32.dll","rasadhlp.dll","FWPUCLNT.DLL","user32.dll","imm32.dll","ACCTRES.dll","rtutils.dll","msxml3.dll","winrnr.dll","ntdll.dll","sechost.dll","dnsapi.dll","wab32.dll","msimg32.dll","wship6.dll","KernelBase.dll","msvcrt.dll","msctf.dll","rasapi32.dll","rasman.dll","msoert2.dll","kernel32.dll","lpk.dll","shlwapi.dll","advapi32.dll","schannel.dll","inetcomm.dll","msxml3r.dll","pnrpnsp.dll","gdi32.dll","ole32.dll","msoeacct.dll","SensApi.dll","imagehlp.dll","NapiNSP.dll","msxml6r.dll","version.dll","mswsock.dll","WSHTCPIP.DLL","INETRES.dll","cryptdlg.dll","rpcrt4.dll","msxml6.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"adprtext.exe","sha256":"008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"21E8.bi1","sha256":"0b5c0f6ffac14107357e2c1bfe0dea06932fd2aa5c8bd598a73f25655f0abfd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"prefs.js","sha256":"878aa99e2cf190d0c4f35d72398e26d4214e15b13d058412837fe36e67a983d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%WINDIR%\\System32\\C_1252.NLS","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%APPDATA%\\Microsoft\\Cmdisvc6","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%APPDATA%\\Microsoft\\Cmdisvc6\\adprtext.exe","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%TEMP%\\21E8.bi1","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{A770D234-3A38-4244-88F4-7A867FDC9959}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{B4FCE48D-2097-4415-9537-7933E765DE73}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{D71DE24B-BE28-45C4-B4BE-E99C363FDE00}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%USERPROFILE%\\Contacts","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\1BF08513-BEE6-055F-A07F-D209D423264D\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{B92517C0-C493-538C-96FD-38372A81EC5B}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"{63A6D59C-66D8-8D94-8847-FA113C6BCED5}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"Local\\{B92517C0-C493-538C-96FD-38372A81EC5B}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{63A6D59C-66D8-8D94-8847-FA113C6BCED5}","sources":[{"report_type":"sandbox","report_id":"5aafe25d7ca3e1307a6944e9"}]}]}},"report_ids":{"sandbox_job_ids":["5aafe25d7ca3e1307a6944e9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 008c4bd6ee83… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 008c4bd6ee83…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 008c4bd6ee83… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 008c4bd6ee83…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/008c4bd6ee834d113cfc693af0ea90396eaa47e860bcdd567ffd964b57434e1d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 008c4bd6ee83… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 008c4bd6ee83…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]