24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 059aab1a6ac0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 059aab1a6ac0…. Malware family: Trojan.Generic. Threat score 100/100. 24/27 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0"],"about":{"@type":"SoftwareApplication","name":"bounty-2915147612499131","applicationCategory":["peexe","executable"],"identifier":"059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8ef,"color="EE0000" size ="6">

All your important files are encrypted

Your files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.

There is only one way to get your files back: contact with us, pay, and get decryptor software.

You have "UNIQUE_ID_DO_NOT_REMOVE" file on your desktop also it duplicated in some folders,

its your unique idkey, attach it to letter when contact with us. Also you can decrypt 3 files for test.

We accept Bitcoin, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others.

Contact information:

primary email:

All your important files are encrypted

Your files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.

There is only one way to get your files back: contact with us pay and get decryptor software.

You have "UNIQUE_ID_DO_NOT_REMOVE" file on your desktop also it duplicated in some folders

its your unique idkey attach it to letter when contact with us. Also you can decrypt 3 files for test.

We accept Bitcoin you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others.

Contact information:

primary email: \" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.bitcoin.com/buy-bitcoin\"\n Heuristic match: \".mobi\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\cmd.exe\", Handle: 192)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 2286080)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions: .tif\n .php\n .1cd\n .accdb\n .dbf\n .arw\n .txt\n .doc\n .docm\n .docx\n .zip\n .rar\n .xlsx\n .xls\n .xlsb\n .xlsm\n .jpg\n .jpe\n .jpeg\n .bmp\n .sql\n .adp\n .mdf\n .frm\n .mdb\n .odb\n .odm\n .odp\n .ods\n .pdf\n .kdbx\n .erf\n .3dm\n .3ds\n .max\n .obj\n .dwg\n .bdb\n .bak\n .db3\n .dbx\n .edb\n .gdb\n .itdb\n .kdb\n .myd\n .ndf\n .ns2\n .ns3\n .ns4\n .nsf\n .nyf\n .pdb\n .rdb\n .sdf\n .cdr\n .cdr3\n .ppt\n .pptx\n .act\n .asc\n .dot\n .dotm\n .dotx\n .hbk","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$25","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetModuleFileNameW\n IsDebuggerPresent\n GetFileAttributesW\n GetModuleFileNameA\n WinExec\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"cmd.exe\" wrote bytes \"711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201\" to virtual address \"0x75D007E4\" (part of module \"USER32.DLL\")\n \"taskkill.exe\" wrote bytes \"c0df10771cf90f77ccf80f770d64117700000000c011fb7500000000fc3efb7500000000e013fb75000000009457ee7525e01077c6e0107700000000bc6aed7500000000cf31fb75000000009319ee75000000002c32fb7500000000\" to virtual address \"0x770B1000\" (part of module \"NSI.DLL\")\n \"taskkill.exe\" wrote bytes \"711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201\" to virtual address \"0x75D007E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"53/68 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"53/68 Antivirus vendors marked sample as malicious (77% detection rate)\n 6/11 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Hermes","Ransomware","ransomware"],"sample_flags":["Sample not shared","User Comment"],"sandbox_reports":[{"id":"5a4219a27ca3e15678497f74","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.Hermes","submit_name":"OTX_059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0","analysis_start_time":"2017-12-26T10:48:28+00:00","indicators_count":{"informative":7,"suspicious":9,"malicious":3},"tags":["Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"58a5b553aac2ed706a57f7da","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur.RP","contacted_countries":["USA"],"submit_name":"059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0","analysis_start_time":"2017-02-16T15:21:30+00:00","indicators_count":{"informative":18,"suspicious":18,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}],"processes":[{"pid":800,"ppid":0,"name":"059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0.exe","command_line":"","sha256":"059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0","normalized_path":"C:\\059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0.exe","uid":"00010135-00000800","icon":"$26"},{"pid":3032,"ppid":800,"name":"cmd.exe","command_line":"/c taskkill /IM 059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0.exe /F & del C:\\059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0.exe /F","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00010135-00000800","uid":"00010248-00003032"},{"pid":2112,"ppid":3032,"name":"taskkill.exe","command_line":"taskkill /IM 059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0.exe /F","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00010248-00003032","uid":"00010252-00002112"}],"all_imported_dlls":["cryptbase.dll","usp10.dll","imm32.dll","clbcatq.dll","advapi32.dll","framedynos.dll","fastprox.dll","kernel32.dll","shlwapi.dll","ws2_32.dll","cryptsp.dll","user32.dll","mpr.dll","netutils.dll","ole32.dll","msctf.dll","version.dll","wtsapi32.dll","ntdsapi.dll","KernelBase.dll","srvcli.dll","shell32.dll","wbemprox.dll","wmiutils.dll","ntdll.dll","wow64win.dll","rpcrt4.dll","netapi32.dll","gdi32.dll","winbrand.dll","oleaut32.dll","dbghelp.dll","wow64.dll","wow64cpu.dll","sechost.dll","wkscli.dll","apphelp.dll","secur32.dll","wbemcomn.dll","wbemsvc.dll","msvcrt.dll","samcli.dll","lpk.dll","nsi.dll","winsta.dll","rsaenh.dll","RpcRtRemote.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\SysWOW64\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a4219a27ca3e15678497f74"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a4219a27ca3e15678497f74","58a5b553aac2ed706a57f7da"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 059aab1a6ac0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 059aab1a6ac0…. Malware family: Trojan.Generic. Threat score 100/100. 24/27 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 059aab1a6ac0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 059aab1a6ac0…. Malware family: Trojan.Generic. Threat score 100/100. 24/27 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/059aab1a6ac0764ff8024c8be37981d0506337909664c7b3862fc056d8c405b0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 059aab1a6ac0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 059aab1a6ac0…. Malware family: Trojan.Generic. Threat score 100/100. 24/27 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]