24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0161db0f1201… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0161db0f1201…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623"],"about":{"@type":"SoftwareApplication","name":"DHL_AWB invoice.scr","applicationCategory":["peexe","executable"],"identifier":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6a4,"" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "UNINSTALLSTRING"; Value: "0000000001000000AC00000043003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C004D006100630072006F006D00650064005C0046006C006100730068005C0046006C006100730068005500740069006C00330032005F00320034005F0030005F0030005F003200320031005F0050006C007500670069006E002E0065007800650020002D006D00610069006E007400610069006E00200070006C007500670069006E000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME"; Value: "000000000100000038000000410064006F0062006500200046006C00610073006800200050006C00610079006500720020003200340020004E0050004100500049000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "UNINSTALLSTRING"; Value: "00000000010000004E00000043003A005C00500072006F006700720061006D002000460069006C00650073005C004100750074006F004900740033005C0055006E0069006E007300740061006C006C002E006500780065000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME"; Value: "0000000001000000220000004100750074006F00490074002000760033002E0033002E00310032002E0030000000")26:T521,"" opened file "C:\Program Files\Common Files\Ipswitch\WS_FTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Roaming\SmartFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\ProgramData\SmartFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Local\SmartFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Roaming\TurboFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\ProgramData\TurboFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Local\TurboFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Roaming\VanDyke\Config\Sessions\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\ProgramData\VanDyke\Config\Sessions\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Local\VanDyke\Config\Sessions\" (DesiredAccess: 1048577, OpenOptions: 16417) "" opened file "C:\Users\%OSUSER%\AppData\Roaming\FTPRush\" (DesiredAccess: 1048577, OpenOptions: 16417)27:T71b,Found malicious artifacts related to "67.227.226.240": ... URL: http://www.immei.info/files/imeimobi.zip (AV positives: 7/67 scanned on 04/20/2018 14:03:10) URL: http://darkerwik.zzl.org/index.php (AV positives: 1/67 scanned on 04/20/2018 13:58:28) URL: http://d2.vipcn.org/v1/ldjdtq.rar (AV positives: 4/67 scanned on 04/20/2018 13:47:16) URL: http://animalesyplantas.com/libreria/show_area.php?area=19&subcat=290&cat=50$id_categoria (AV positives: 2/67 scanned on 04/20/2018 13:46:35) URL: http://animalesyplantas.com/libreria/show_area.php?area=1185&subcat=62&cat=16 (AV positives: 1/67 scanned on 04/20/2018 13:46:35) File SHA256: 5ab44f257a83c18ca426028e0bf03b9bf2c194c0138c5c704f018cec98bd7650 (AV positives: 1/57 scanned on 04/20/2018 03:22:45) File SHA256: e866dc55fc5e7d90432f79cd6d38c3e5f13e870c61cdefd342ca345fda6470fc (AV positives: 53/67 scanned on 04/20/2018 12:55:01) File SHA256: 2ae2c8864941a4c522974555a7f55097e795d00d5babdd5ceb3a7f8a8509c32b (AV positives: 54/68 scanned on 04/20/2018 09:10:47) File SHA256: 53474115a99b19509736bb474754a7fd0b0496c73e80deaf36c8611072047200 (AV positives: 1/67 scanned on 04/20/2018 08:44:53) File SHA256: 1054222e0bc7f3b564cd15de798a87c949f821cf10a0d79f3621618e507011a0 (AV positives: 55/68 scanned on 04/20/2018 08:43:16) File SHA256: 2cb78209832e4cdda784aebc4a41e2011bd4e52e39f63f62638c5362d3649ce8 (Date: 04/14/2018 16:27:44) File SHA256: 56e7c599cbc3d72449d3ceb5c3805f0b86bfbeee4c829ebb8872a9fec65dd4dd (Date: 04/13/2018 02:14:09) File SHA256: 228dbbb56d7187b6d2d3a8333a7a5c9e382b3ad7f49f90eef69c82dd745ff46b (Date: 04/13/2018 02:13:48) File SHA256: f3e151ac3dc5de001e183a31df39c015d79ecad0ccb1a379547af691035d9b66 (Date: 04/07/2018 02:32:49) File SHA256: 289e1d04d4411896f661b9b392c8dafea31b2dc041771687d8a11284d223ce73 (Date: 03/22/2018 02:08:43)28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAyIgAAAAAAAAAAAAAAAIAAMiIAAAAAAAAAAAAAAAAAByqiAAAAAAAAAAAAAAAAB3IiIAiAAAAAAAAAAAAAACIqIiAIgAAAAAAAAAAAAAAiKiIgCIAAAAAAAAAAAAAHKqIgAAAAAAAAAAAAAAAHcqMzIAAAAAAAAAAAAAAAB3dzOiAGAAAAAAAAAAAAAAd3czogBgAAAAAAAAAAAAACJ3d6IAeAAAAAAAAAAAAAAid3d3AIgAAAAAAAAAAAAAInd3dwCIAAAAAAAAAAAAACJ3d3cAiAAAAAAAAAAAAAAid3d3AAAAAAAAAAAAAAAAInd3dwAAAPAAAAAAAAAAAiJ3d3eIc/8AAAAAAAAAAAIid3d3iHP/AAAAAAAAAAAAInd3cnd3dwAAAAAAAAAAACKnd3czegAAAAAAAAAAAAIio3d3iHIAAAAAAAAAAAACIqN3d4hyAAAAAAAAAAAiKqqqM3eIdwAAAAAAAAACIiIiqjM3dyAAAAAAAAAAAAAiIiqqqncAAAAAAAAAAAAAIiIqqqp3AAAAAAAAAAAAAAIiIqqqIgAAAAAAAAAAAAAAACIioiIAAAAAAAAAAAAAAAACIiIiAAAAAAAAAAAAAAAAAiIiIgAAAAAAAAAAAAAAAAAAIAAAAAAAD///////9w////cP///+D///+Bn///AZ///wGf//4H///4B///+Ab///gG///4Bn//+AZ///gGf//4Bn//+Af///gH7//wAB//8AAf//gAH//4AB//gAB//4AAf/8AAH//AAD//+AA///gAP//8AD///4B////Af///wH////n/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790565751311,"unified_at":"2026-09-28T03:22:31.311Z","metadata":{"hashes":{"sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","sha1":"753f7de34eeb4f506eca4ed8e0bc5c5c207dc7a9","md5":"2df397766a1d4c2cfc0878d0f06e017c","sha512":"d8b229fd20b509d4cf7eb251a02f846e13a7c1378dbc4cd3826961a0257e447d789982f0a8d8b5beeaca78ea6fa1d5b1bd8cd751d7a4872be92c117f9e160515","ssdeep":"12288:9jKkXsJ8E0LF2rJatBV+2nJOWRSD40/xX0pwoNGb++Gr2LULSWx1n9a282Z0awAm:9+cN2rQwgO7Dr/dowoNGb++GDlghIpLm","ssdeep_chunks":["12288:9jKkXsJ","12288:jKkXsJ8","12288:KkXsJ8E","12288:kXsJ8E0","12288:XsJ8E0L","12288:sJ8E0LF","12288:J8E0LF2","12288:8E0LF2r","12288:E0LF2rJ","12288:0LF2rJa","12288:LF2rJat","12288:F2rJatB","12288:2rJatBV","12288:rJatBV+","12288:JatBV+2","12288:atBV+2n","12288:tBV+2nJ","12288:BV+2nJO","12288:V+2nJOW","12288:+2nJOWR","12288:2nJOWRS","12288:nJOWRSD","12288:JOWRSD4","12288:OWRSD40","12288:WRSD40/","12288:RSD40/x","12288:SD40/xX","12288:D40/xX0","12288:40/xX0p","12288:0/xX0pw","12288:/xX0pwo","12288:xX0pwoN","12288:X0pwoNG","12288:0pwoNGb","12288:pwoNGb+","12288:woNGb++","12288:oNGb++G","12288:NGb++Gr","12288:Gb++Gr2","12288:b++Gr2L","12288:++Gr2LU","12288:+Gr2LUL","12288:Gr2LULS","12288:r2LULSW","12288:2LULSWx","12288:LULSWx1","12288:ULSWx1n","12288:LSWx1n9","12288:SWx1n9a","12288:Wx1n9a2","12288:x1n9a28","12288:1n9a282","12288:n9a282Z","12288:9a282Z0","12288:a282Z0a","12288:282Z0aw","12288:82Z0awA","12288:2Z0awAm","24576:9jKkXsJ","24576:jKkXsJ8","24576:KkXsJ8E","24576:kXsJ8E0","24576:XsJ8E0L","24576:sJ8E0LF","24576:J8E0LF2","24576:8E0LF2r","24576:E0LF2rJ","24576:0LF2rJa","24576:LF2rJat","24576:F2rJatB","24576:2rJatBV","24576:rJatBV+","24576:JatBV+2","24576:atBV+2n","24576:tBV+2nJ","24576:BV+2nJO","24576:V+2nJOW","24576:+2nJOWR","24576:2nJOWRS","24576:nJOWRSD","24576:JOWRSD4","24576:OWRSD40","24576:WRSD40/","24576:RSD40/x","24576:SD40/xX","24576:D40/xX0","24576:40/xX0p","24576:0/xX0pw","24576:/xX0pwo","24576:xX0pwoN","24576:X0pwoNG","24576:0pwoNGb","24576:pwoNGb+","24576:woNGb++","24576:oNGb++G","24576:NGb++Gr","24576:Gb++Gr2","24576:b++Gr2L","24576:++Gr2LU","24576:+Gr2LUL","24576:Gr2LULS","24576:r2LULSW","24576:2LULSWx","24576:LULSWx1","24576:ULSWx1n","24576:LSWx1n9","24576:SWx1n9a","24576:Wx1n9a2","24576:x1n9a28","24576:1n9a282","24576:n9a282Z","24576:9a282Z0","24576:a282Z0a","24576:282Z0aw","24576:82Z0awA","24576:2Z0awAm","12288:9+cN2rQ","12288:+cN2rQw","12288:cN2rQwg","12288:N2rQwgO","12288:2rQwgO7","12288:rQwgO7D","12288:QwgO7Dr","12288:wgO7Dr/","12288:gO7Dr/d","12288:O7Dr/do","12288:7Dr/dow","12288:Dr/dowo","12288:r/dowoN","12288:/dowoNG","12288:dowoNGb","12288:owoNGb+","12288:NGb++GD","12288:Gb++GDl","12288:b++GDlg","12288:++GDlgh","12288:+GDlghI","12288:GDlghIp","12288:DlghIpL","12288:lghIpLm"],"imphash":"7b27f3b27c36836c610c5b7ae4b6b27f"},"file_info":{"file_name":"DHL_AWB invoice.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":829952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1524233759000,"last_seen":1651375326000,"last_multi_scan":1651375326000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["pony","banker","downloader","fareit","trojan"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":18,"malicious_count":8,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Delphi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/PSW.Fareit.gck","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30633599","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.EAPU-9322","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30633599 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/PSW.Fareit.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/DelfInjector.gen!D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052e9f31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.Win32.Fareit.dyny","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.ayu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealer.fdyckg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Fareit-Q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_FA.0CB72C32","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_FA.0CB72C32","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.AUU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00026342-00002092-21147-682-0040A188\n GetLocalTime@KERNEL32.DLL at 00026342-00002092-21147-2285-0040A1B4\n GetLocalTime@KERNEL32.DLL at 00031671-00003196-44852-682-0040A188","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00026342-00002092-21147-2311-0040C664\n GetVersionExA@KERNEL32.DLL at 00031647-00004056-36142-220-004045FD\n GetVersionExA@kernel32.dll at 00039330-00002916-57504-262-0041074C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00026342-00002092-21147-2274-00408AF8","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pornhouse.mobi\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.227.226.240:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /main.php?dir=//Virgin%20Babes%20First%20Sex&start=1&sort=1 HTTP/1.0Host: pornhouse.mobiAccept: */*Accept-Encoding: identity, *;q=0Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c \"\"%TEMP%\\4125256.bat\" \"C:\\DHL_AWB invoice.scr.exe\" \"\" on 2018-4-20.08:54:00.690","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00031647-00004056)\n Spawned process \"\" with commandline \"2 4056 4097005\" (UID: 00031671-00003196)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\4125256.bat\" \"C:\\DHL_AWB invoice.scr.exe\" \"\" (UID: 00034503-00002728)\n Spawned process \"\" (UID: 00036044-00003104)\n Spawned process \"\" (UID: 00039330-00002916)\n Spawned process \"\" with commandline \"2 2916 4173986\" (UID: 00039366-00004008)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@advapi32.dll at 00039330-00002916-57504-518-00410812","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"4125256.bat\" has type \"ASCII text with CRLF CR line terminators\"\n \"4195267.bat\" has type \"ASCII text with CRLF CR line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\wcx_ftp.ini\"\n \"\" touched file \"%WINDIR%\\32BitFtp.ini\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Font.Name\"\n Heuristic match: \"pornhouse.mobi\"\n Pattern match: \"http://myrfrers.com/bros/speedy/gate.php\"\n Pattern match: \"http://www.facebook.com/\"\n Heuristic match: \"\\RhinoSoft.com\"\n Pattern match: \"http://www.ibsensoftware.com/\"\n Pattern match: \"http://pornhouse.mobi/main.php?dir=//Virgin%20Babes%20First%20Sex&start=1&sort=1\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"http://www.facebook.com/\" (Indicator: \"facebook.com\")\n \"myspace1\" (Indicator: \"myspace\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DHL_AWB invoice.scr.exe.bin\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 47 calls to GetProcAddress@KERNEL32.DLL at 00026342-00002092-21147-2856-0042B834","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"4/67 reputation engines marked \"http://pornhouse.mobi/main.php\" as malicious (5% detection rate)\n 2/67 reputation engines marked \"http://pornhouse.mobi\" as malicious (2% detection rate)\n 4/67 reputation engines marked \"http://myrfrers.com/bros/speedy/gate.php\" as malicious (5% detection rate)\n 4/67 reputation engines marked \"http://myrfrers.com\" as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00026342-00002092-21147-944-00473A64\n FindResourceA@KERNEL32.DLL at 00026342-00002092-21147-964-0041A8B0\n FindResourceA@KERNEL32.DLL at 00026342-00002092-21147-2518-00417C44\n FindResourceA@KERNEL32.DLL at 00031671-00003196-44852-964-0041A8B0\n FindResourceA@KERNEL32.DLL at 00031671-00003196-44852-944-00473A64","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%WINDIR%\\win.ini\"\n \"\" read file \"%APPDATA%\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"27/69 Antivirus vendors marked dropped file \"4125256.bat\" as malicious (classified as \"Trojan.BAT\" with 39% detection rate)\n 27/69 Antivirus vendors marked dropped file \"4195267.bat\" as malicious (classified as \"Trojan.BAT\" with 39% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\DHL_AWB invoice.scr.exe\", Handle: 220)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\apphelp.dll\", Handle: 248)\n \"\" is creating a new process (Name: \"C:\\DHL_AWB invoice.scr.exe\", Handle: 224)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 2147483648)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 2147483648)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"$26","origin":"API Call","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00031647-00004056-36142-200-00402CE7\n CreateToolhelp32Snapshot@kernel32.dll at 00039330-00002916-57504-236-00410716","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00026342-00002092-21147-445-00487690\n GetKeyboardState@USER32.DLL at 00031671-00003196-44852-445-00487690","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetFileAttributesA\n WriteFile\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n GetModuleHandleA\n CreateThread\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetProcAddress\n FindFirstFileA\n CreateFileA\n LockResource\n GetCommandLineA\n Sleep\n FindResourceA\n VirtualAlloc\n SetKeyboardState\n GetLastActivePopup\n SetWindowsHookExA\n FindWindowA\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"92e6567779a85b77be725b77d62d5b771de2567705a25b77bee35677616f5b77684159770050597700000000ad37a6758b2da675b641a67500000000\" to virtual address \"0x74BB1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"DHL_AWB invoice.scr.exe.bin\" claims program is from Mon Dec 30 01:43:12 1991","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET TROJAN Fareit/Pony Downloader Checkin 3\" (SID: 2014234, Rev: 10, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System\" (SID: 2007695, Rev: 21, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98\" (SID: 2014562, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.\" (SID: 2016870, Rev: 12, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"CrowdStrike Pony Request\" (SID: 181708101, Rev: 20170522, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"4/67 reputation engines marked \"http://pornhouse.mobi/main.php\" as malicious (5% detection rate)\n 4/67 reputation engines marked \"http://myrfrers.com/bros/speedy/gate.php\" as malicious (5% detection rate)\n 4/67 reputation engines marked \"http://myrfrers.com\" as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"\" set thread context in remote process \"C:\\DHL_AWB invoice.scr.exe\" (PID 00000fd8)\n \"\" set thread context in remote process \"C:\\DHL_AWB invoice.scr.exe\" (PID 00000b64)","origin":"API Call","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 220)\n \"\" wrote 52 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 220)\n \"\" wrote 4 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 220)\n \"\" wrote 32 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 248)\n \"\" wrote 52 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 248)\n \"\" wrote 4 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 248)\n \"\" wrote 32 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 224)\n \"\" wrote 52 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 224)\n \"\" wrote 4 bytes to a remote process \"C:\\DHL_AWB invoice.scr.exe\" (Handle: 224)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"pony\" classified process \"DHL_AWB invoice.scr.exe\" as \"trojan,pony\" based on indicators: \"{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X},YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0,POST %s HTTP/1.0,Accept-Encoding: identity, *;q=0\" (Author: Brian Wallace @botnet_hunter)\n Internal YARA signature matched on process \"DHL_AWB invoice.scr.exe\"\n YARA signature \"pony\" classified file \"all.bstring\" as \"trojan,pony\" based on indicators: \"{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X},YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0,POST %s HTTP/1.0,Accept-Encoding: identity, *;q=0\" (Author: Brian Wallace @botnet_hunter)\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials","description":"\"RushSite.xml\" (Indicator: \"rushsite.xml\")\n \"Software\\FlashPeak\\BlazeFtp\\Settings\" (Indicator: \"\\blazeftp\\\")","origin":"File/Memory","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00026342-00002092)\n Spawned process \"\" (UID: 00031647-00004056)\n Spawned process \"\" with commandline \"2 4056 4097005\" (UID: 00031671-00003196)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\4125256.bat\" \"C:\\DHL_AWB invoice.scr.exe\" \"\" (UID: 00034503-00002728)\n Spawned process \"\" (UID: 00036044-00003104)\n Spawned process \"\" (UID: 00039330-00002916)\n Spawned process \"\" with commandline \"2 2916 4173986\" (UID: 00039366-00004008)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal FTP credentials"}],"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":72,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":89,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["pony","banker","downloader","fareit","trojan"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5ad9f17c7ca3e14e6a0eb429","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"DHL_AWB invoice.scr","analysis_start_time":"2018-04-20T16:00:20+00:00","indicators_count":{"informative":19,"suspicious":23,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.227.226.240","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}],"dns_resolutions":[{"domain":"pornhouse.mobi","address":"67.227.226.240","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}],"http_requests":[{"host":"pornhouse.mobi","host_ip":"67.227.226.240:80","url":"/main.php?dir=//Virgin%20Babes%20First%20Sex&start=1&sort=1","method":"GET","header":"GET /main.php?dir=//Virgin%20Babes%20First%20Sex&start=1&sort=1 HTTP/1.0\nHost: pornhouse.mobi\nAccept: */*\nAccept-Encoding: identity, *;q=0\nConnection: close\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}],"processes":[{"pid":2092,"ppid":0,"name":"DHL_AWB invoice.scr.exe","command_line":"","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","normalized_path":"C:\\DHL_AWB invoice.scr.exe","uid":"00026342-00002092","icon":"$28"},{"pid":4056,"ppid":2092,"name":"DHL_AWB invoice.scr.exe","command_line":"","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","normalized_path":"C:\\DHL_AWB invoice.scr.exe","parent_uid":"00026342-00002092","uid":"00031647-00004056"},{"pid":2728,"ppid":4056,"name":"cmd.exe","command_line":"cmd /c \"\"%TEMP%\\4125256.bat\" \"C:\\DHL_AWB invoice.scr.exe\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00031647-00004056","uid":"00034503-00002728"},{"pid":3196,"ppid":2092,"name":"DHL_AWB invoice.scr.exe","command_line":"2 4056 4097005","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","normalized_path":"C:\\DHL_AWB invoice.scr.exe","parent_uid":"00026342-00002092","uid":"00031671-00003196"},{"pid":3104,"ppid":3196,"name":"DHL_AWB invoice.scr.exe","command_line":"","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","normalized_path":"C:\\DHL_AWB invoice.scr.exe","parent_uid":"00031671-00003196","uid":"00036044-00003104"},{"pid":2916,"ppid":3104,"name":"DHL_AWB invoice.scr.exe","command_line":"","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","normalized_path":"C:\\DHL_AWB invoice.scr.exe","parent_uid":"00036044-00003104","uid":"00039330-00002916"},{"pid":4008,"ppid":3104,"name":"DHL_AWB invoice.scr.exe","command_line":"2 2916 4173986","sha256":"0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623","normalized_path":"C:\\DHL_AWB invoice.scr.exe","parent_uid":"00036044-00003104","uid":"00039366-00004008"}],"all_imported_dlls":["kernel32.dll","lpk.dll","ole32.dll","version.dll","KernelBase.dll","Wldap32.dll","NapiNSP.dll","winrnr.dll","ntdll.dll","user32.dll","oleaut32.dll","shlwapi.dll","shell32.dll","cfgmgr32.dll","usp10.dll","IPHLPAPI.DLL","propsys.dll","setupapi.dll","dwmapi.dll","urlmon.dll","netapi32.dll","msi.dll","psapi.dll","dnsapi.dll","shdocvw.dll","comctl32.dll","iertutil.dll","cryptbase.dll","msxml3.dll","mswsock.dll","imm32.dll","rpcss.dll","sspicli.dll","clbcatq.dll","oleacc.dll","sechost.dll","msctf.dll","srvcli.dll","devobj.dll","nsi.dll","oleaccrc.dll","ntmarta.dll","nlaapi.dll","winbrand.dll","gdi32.dll","ws2_32.dll","profapi.dll","WSHTCPIP.DLL","pnrpnsp.dll","FWPUCLNT.DLL","comdlg32.dll","wininet.dll","wkscli.dll","pstorec.dll","winnsi.dll","uxtheme.dll","msxml3r.dll","msvcrt.dll","userenv.dll","mlang.dll","samlib.dll","crypt32.dll","msasn1.dll","rasadhlp.dll","rpcrt4.dll","wsock32.dll","netutils.dll","atl.dll","advapi32.dll","apphelp.dll","samcli.dll","ieframe.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"4125256.bat","sha256":"936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"4195267.bat","sha256":"936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}],"files_written":[{"path":"%TEMP%\\HWID","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%TEMP%\\4125256.bat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"C:\\DHL_AWB invoice.scr.exe","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%USERPROFILE%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%PROGRAMFILES%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"path":"%WINDIR%\\32BitFtp.ini","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad9f17c7ca3e14e6a0eb429"}]}]}},"report_ids":{"sandbox_job_ids":["5ad9f17c7ca3e14e6a0eb429"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0161db0f1201… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0161db0f1201…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0161db0f1201… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0161db0f1201…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0161db0f1201509c9a5ab91ce20974f4d239a3d55915fd81e39177835f2af623"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0161db0f1201… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0161db0f1201…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]