21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 07e789f4f2f3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 07e789f4f2f3…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f"],"about":{"@type":"SoftwareApplication","name":"taskmgr.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":26,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T528,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23b.dat"23:T476,YARA signature "njrat1" classified file "07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f.exe.bin" as "rat,njrat" based on indicators: "6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5300450045005f004d00410053004b005f004e004f005a004f004e00450043004800450043004b005300,5b005400410050005d00,63006d0064002e0065007800650020002f0063002000700069006e006700" (Author: Brian Wallace @botnet_hunter) YARA signature "njrat1" classified file "taskmgr.exe" as "rat,njrat" based on indicators: "6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5300450045005f004d00410053004b005f004e004f005a004f004e00450043004800450043004b005300,5b005400410050005d00,63006d0064002e0065007800650020002f0063002000700069006e006700" (Author: Brian Wallace @botnet_hunter) YARA signature "njrat1" classified file "all.bstring" as "rat,njrat" based on indicators: "netsh firewall add allowedprogram ,SEE_MASK_NOZONECHECKS,[TAP],cmd.exe /c ping" (Author: Brian Wallace @botnet_hunter)24:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790268738771,"unified_at":"2026-09-24T16:52:18.771Z","metadata":{"hashes":{"sha256":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","sha1":"a0231d04ae17e9a400b32e2b06353e654df3418c","md5":"1513b3984eeafa346728799966dd4728","sha512":"1648489304160cdc841bbdfc4c05848112feb66ccb428cce22e35492e51250fcb7e9d3d5135103875b9ddb1f87c6efe1bef0610da360d3feff789bc3f5dcf4fe","ssdeep":"384:mnc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZSC:mle9EJLN/yRpcnua","ssdeep_chunks":["384:mnc6ze6","384:nc6ze6e","384:c6ze6e1","384:6ze6e1P","384:ze6e1PA","384:e6e1PAh","384:6e1PAhJ","384:e1PAhJV","384:1PAhJVz","384:PAhJVzC","384:AhJVzC3","384:hJVzC3t","384:JVzC3tC","384:VzC3tC1","384:zC3tC1i","384:C3tC1im","384:3tC1im/","384:tC1im/B","384:C1im/Bs","384:1im/BsT","384:im/BsTx","384:m/BsTx4","384:/BsTx46","384:BsTx46P","384:sTx46Pg","384:Tx46PgZ","384:x46PgZ0","384:46PgZ0r","384:6PgZ0ra","384:PgZ0rap","384:gZ0rap9","384:Z0rap9H","384:0rap9HB","384:rap9HBm","384:ap9HBmR","384:p9HBmRv","384:9HBmRvR","384:HBmRvR6","384:BmRvR6J","384:mRvR6JZ","384:RvR6JZl","384:vR6JZlb","384:R6JZlbw","384:6JZlbw8","384:JZlbw8h","384:Zlbw8hq","384:lbw8hqI","384:bw8hqIu","384:w8hqIus","384:8hqIusZ","384:hqIusZz","384:qIusZzZ","384:IusZzZS","384:usZzZSC","768:mnc6ze6","768:nc6ze6e","768:c6ze6e1","768:6ze6e1P","768:ze6e1PA","768:e6e1PAh","768:6e1PAhJ","768:e1PAhJV","768:1PAhJVz","768:PAhJVzC","768:AhJVzC3","768:hJVzC3t","768:JVzC3tC","768:VzC3tC1","768:zC3tC1i","768:C3tC1im","768:3tC1im/","768:tC1im/B","768:C1im/Bs","768:1im/BsT","768:im/BsTx","768:m/BsTx4","768:/BsTx46","768:BsTx46P","768:sTx46Pg","768:Tx46PgZ","768:x46PgZ0","768:46PgZ0r","768:6PgZ0ra","768:PgZ0rap","768:gZ0rap9","768:Z0rap9H","768:0rap9HB","768:rap9HBm","768:ap9HBmR","768:p9HBmRv","768:9HBmRvR","768:HBmRvR6","768:BmRvR6J","768:mRvR6JZ","768:RvR6JZl","768:vR6JZlb","768:R6JZlbw","768:6JZlbw8","768:JZlbw8h","768:Zlbw8hq","768:lbw8hqI","768:bw8hqIu","768:w8hqIus","768:8hqIusZ","768:hqIusZz","768:qIusZzZ","768:IusZzZS","768:usZzZSC","384:mle9EJL","384:le9EJLN","384:e9EJLN/","384:9EJLN/y","384:EJLN/yR","384:JLN/yRp","384:LN/yRpc","384:N/yRpcn","384:/yRpcnu","384:yRpcnua"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"taskmgr.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":24064,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1507576641000,"last_seen":1632096236000,"last_multi_scan":1632096236000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["njrat","rat"]},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":13,"malicious_count":9,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.mAmC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.Bladabindi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.Bladabindi.as","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.Bladabindi.45B82211","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Backdoor.MSIL.Bladabindi.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Bladabindi.AU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Bladabindi (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Bladabindi.BC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Bladabindi.n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Bladabindi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Disfa.bop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FIGN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Disfa.dtznyx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Backdoor.Bladabindi.AL3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DotNet-P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Backdoor.Ratenjay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"BKDR_BLADABI.SMC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"BKDR_BLADABI.SMC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Generic.AWM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Disfa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"malicious","threat_name":"Backdoor.njRAT.63","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent.Win32.55242","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TASKMGR.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TASKMGR.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"dw20.exe\" was created by \"taskmgr.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"youssefelmi.ddns.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"197.0.152.18:1177\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\taskmgr.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\c378187652f5f5af8afcf28d6782ff50\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"c378187652f5f5af8afcf28d6782ff50\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6ADE0000\n \"taskmgr.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 68680000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"taskmgr.exe\" (UID: 00015363-00003880)\n Spawned process \"netsh.exe\" with commandline \"\"netsh firewall add allowedprogram \"%TEMP%\\taskmgr.exe\" \"taskmgr.exe\" ENABLE\" (UID: 00016111-00002924), Spawned process \"dw20.exe\" with commandline \"-x -s 768\" (UID: 00016375-00002996)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"taskmgr.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$22","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"youssefelmi.ddns.net\"\n Pattern match: \"http://go.microsoft.com/fwlink/?linkid=121488\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"taskmgr.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskmgr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"dw20.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskmgr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/65 reputation engines marked \"http://youssefelmi.ddns.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"netsh.exe\" called \"OpenService\" to access the \"policyagent\" service\n \"netsh.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"netsh.exe\" called \"OpenService\" to access the \"NapAgent\" service\n \"netsh.exe\" called \"OpenService\" to access the \"NapAgent\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"netsh.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"NapAgent\"\n \"netsh.exe\" called \"ControlService\" and sent control code \"0X120\" to the service \"NapAgent\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"taskmgr.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"taskmgr.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"C378187652F5F5AF8AFCF28D6782FF50\"; Value: \"\"%TEMP%\\taskmgr.exe\" ..\")\n \"taskmgr.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"C378187652F5F5AF8AFCF28D6782FF50\"; Value: \"\"%TEMP%\\taskmgr.exe\" ..\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"j.kl::GetKeyboardState at 1513b3984eeafa346728799966dd4728-600002b-kl_VKCodeToUnicode\n j.kl::GetAsyncKeyState at 1513b3984eeafa346728799966dd4728-600002d-kl_WRK","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"0f02b78f\" to virtual address \"0x69181FDC\" (part of module \"MSCORWKS.DLL\")\n \"\" wrote bytes \"db4d0d7100000000\" to virtual address \"0x01112000\" (part of module \"07E789F4F2F3259E7559FDCCB36E96814C2DBFF872A21E1FA03DE9EE377D581F.EXE\")\n \"netsh.exe\" wrote bytes \"a3545e76013d5f7638ed5f76cfcd5e7631235e76de2f5f76c4ca5e7680bb5e76aa6e5f769fbb5e7692bb5e7646ce5e7600bf5e760abf5e7646ba5e7600000000273e7976efb27d7651c1777694987776ee9c777675dc797600000000\" to virtual address \"0x6A851000\" (part of module \"MPRMSG.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"taskmgr.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"taskmgr.exe\" at non-system pathway \"%TEMP%\\taskmgr.exe\" (UID: 00015363-00003880)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/66 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/66 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"58/66 Antivirus vendors marked dropped file \"taskmgr.exe\" as malicious (classified as \"Generic.MSIL.Bladabindi\" with 87% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"58/66 Antivirus vendors marked spawned process \"taskmgr.exe\" (PID: 3880) as malicious (classified as \"Generic.MSIL.Bladabindi\" with 87% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%TEMP%\\taskmgr.exe\" (Handle: 568)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\taskmgr.exe\" (Handle: 568)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\taskmgr.exe\" (Handle: 568)\n \"taskmgr.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 408)\n \"taskmgr.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 408)\n \"taskmgr.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 408)\n \"taskmgr.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 788)\n \"taskmgr.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 788)\n \"taskmgr.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 788)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 197.0.152.18 on port 1177","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$23","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"\"netsh firewall add allowedprogram \"%TEMP%\\taskmgr.exe\" \"taskmgr.exe\" ENABLE\" (UID: 00016111-00002924)","origin":"Monitored Target","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies firewall settings"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":143,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["njrat","rat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"59dbca287ca3e1191d410ac3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.Bladabindi","contacted_countries":["TUN"],"submit_name":"taskmgr.exe","analysis_start_time":"2017-10-09T20:10:46+00:00","indicators_count":{"informative":12,"suspicious":14,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"197.0.152.18","port":1177,"protocol":"TCP","country":"Tunisia","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}],"dns_resolutions":[{"domain":"youssefelmi.ddns.net","address":"197.0.152.18","country":"Tunisia","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-06-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}],"processes":[{"pid":3380,"ppid":0,"name":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f.exe","command_line":"","sha256":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","normalized_path":"C:\\07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f.exe","uid":"00014402-00003380","icon":"$24"},{"pid":3880,"ppid":3380,"name":"taskmgr.exe","command_line":"","sha256":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","normalized_path":"%TEMP%\\taskmgr.exe","parent_uid":"00014402-00003380","uid":"00015363-00003880","icon":"$25"},{"pid":2924,"ppid":3880,"name":"netsh.exe","command_line":"\"netsh firewall add allowedprogram \"%TEMP%\\taskmgr.exe\" \"taskmgr.exe\" ENABLE","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00015363-00003880","uid":"00016111-00002924","icon":"$26"},{"pid":2996,"ppid":3880,"name":"dw20.exe","command_line":"-x -s 768","sha256":"728f9cfd55a2d64816805bce935e28034755374e0163a3415f33ad807fbc91cc","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe","parent_uid":"00015363-00003880","uid":"00016375-00002996","icon":"$27"}],"all_imported_dlls":["QUTIL.DLL","polstore.dll","ndfapi.dll","odbcint.dll","dhcpcsvc.dll","netiohlp.dll","dot3api.dll","nshipsec.dll","netapi32.dll","logoncli.dll","nettrace.dll","kernel32.dll","uxtheme.dll","winnsi.dll","odbc32.dll","dot3cfg.dll","secur32.dll","WcnNetsh.dll","mscoreei.dll","msctf.dll","wlanhlp.dll","wininet.dll","System.Drawing.ni.dll","dhcpcmonitor.dll","adsldpc.dll","wwancfg.dll","lpk.dll","cryptbase.dll","clbcatq.dll","rsaenh.dll","FirewallAPI.dll","webio.dll","comctl32.dll","Wldap32.dll","tzres.dll","P2P.dll","WSHTCPIP.DLL","slc.dll","devrtl.dll","winhttp.dll","version.dll","NAPMONTR.DLL","psapi.dll","rpcrt4.dll","rasadhlp.dll","httpapi.dll","p2pcollab.dll","ole32.dll","System.Windows.Forms.ni.dll","rasapi32.dll","atl.dll","wlanapi.dll","wlanutil.dll","advapi32.dll","mscorwks.dll","mscorjit.dll","propsys.dll","ntmarta.dll","System.Management.dll","WMINet_Utils.dll","bcrypt.dll","setupapi.dll","rasman.dll","mfc42u.dll","eappcfg.dll","QAGENT.DLL","imm32.dll","cryptsp.dll","nsi.dll","nshwfp.dll","nlaapi.dll","msvcrt.dll","usp10.dll","iertutil.dll","SensApi.dll","sechost.dll","Microsoft.VisualBasic.dll","System.dll","oleaut32.dll","msasn1.dll","ws2help.dll","rpcnsh.dll","urlmon.dll","System.Configuration.ni.dll","mprmsg.dll","crypt32.dll","cfgmgr32.dll","IPHLPAPI.DLL","DHCPQEC.DLL","nshhttp.dll","fwcfg.dll","user32.dll","shell32.dll","System.Windows.Forms.dll","mprapi.dll","wevtapi.dll","nci.dll","wwapi.dll","rpcss.dll","rasmontr.dll","mscorlib.dll","userenv.dll","p2pnetsh.dll","gdi32.dll","dhcpcsvc6.dll","wshelper.dll","ifmon.dll","netshell.dll","netutils.dll","profapi.dll","System.ni.dll","System.Xml.ni.dll","ws2_32.dll","dnsapi.dll","FWPUCLNT.DLL","mpr.dll","whhelper.dll","KernelBase.dll","RpcRtRemote.dll","wship6.dll","hnetmon.dll","activeds.dll","ntdll.dll","mscoree.dll","mswsock.dll","winipsec.dll","tdh.dll","devobj.dll","wkscli.dll","wlancfg.dll","sspicli.dll","apphelp.dll","authfwcfg.dll","certcli.dll","wer.dll","credui.dll","eappprxy.dll","wdi.dll","msvcr80.dll","mscorlib.ni.dll","onex.dll","srvcli.dll","shlwapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"taskmgr.exe","sha256":"07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}],"files_written":[{"path":"C:\\07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f.exe.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"C:\\07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f.exe","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%TEMP%\\taskmgr.exe.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\FWCFG.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\P2PNETSH.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%TEMP%\\taskmgr.exe","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"path":"%WINDIR%\\system32\\en-US\\wer.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\c378187652f5f5af8afcf28d6782ff50","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"c378187652f5f5af8afcf28d6782ff50","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\09689e10-ad69-11e7-9c42-0a002745db77","sources":[{"report_type":"sandbox","report_id":"59dbca287ca3e1191d410ac3"}]}]}},"report_ids":{"sandbox_job_ids":["59dbca287ca3e1191d410ac3"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 07e789f4f2f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 07e789f4f2f3…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 07e789f4f2f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 07e789f4f2f3…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 07e789f4f2f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 07e789f4f2f3…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]