24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 2223a93521b2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2223a93521b2…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b"],"about":{"@type":"SoftwareApplication","name":"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir","applicationCategory":["peexe","executable"],"identifier":"2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T477,Found API call GetVersion@KERNEL32.dll directly followed by "cmp eax, 04h" and "jne 0042C6FDh" at 48839-4366-0042C6D4 Found API call GetVersionExW@KERNEL32.dll directly followed by "cmp dword ptr [ebp-00000114h], 05h" and "jc 0042AD5Fh" at 48839-4315-0042AD0A Found API call GetVersionExA@KERNEL32.dll directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp" at 48839-4136-0043E381 Found API call GetVersionExW@KERNEL32.dll directly followed by "cmp dword ptr [ebp-00000120h], 06h" and "jc 0044B75Dh" at 48839-9207-0044B6CB Found API call GetVersionExW@KERNEL32.dll directly followed by "cmp dword ptr [ebp-70h], 02h" and "jne 0042C052h" at 48839-8464-0042BFA8 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000114h], 05h" and "jc 0042AD5Fh" at 00010610-00001396-61704-1329-0042AD0A Found API call GetVersion@KERNEL32.DLL directly followed by "cmp eax, 04h" and "jne 0042C6FDh" at 00010610-00001396-61704-1380-0042C6D4 Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp" at 00010610-00001396-61704-1150-0043E38126:T451,"" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db" "" touched file "C:\Windows\SysWOW64\cmd.exe" "" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\SysWOW64" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\SysWOW64\rsaenh.dll" "" touched file "C:\Windows\SysWOW64\stdole2.tlb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db"27:Tc81,Found string "freeaddrinfo" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: WS2_32.DLL) Found string "getaddrinfo" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: WS2_32.DLL) Found string "GetLayout" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: GDI32.DLL) Found string "SetLayout" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: GDI32.DLL) Found string "GetMonitorInfoA" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "GetMonitorInfoW" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "EnumDisplayDevicesW" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "EnumDisplayMonitors" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "MonitorFromPoint" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "MonitorFromRect" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "MonitorFromWindow" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: USER32.DLL) Found string "InitCommonControls" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: COMCTL32.DLL) Found string "InitCommonControlsEx" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: COMCTL32.DLL) Found string "InitNetworkAddressControl" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: SHELL32.DLL) Found string "DeactivateActCtx" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: KERNEL32.DLL) Found string "ActivateActCtx" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: KERNEL32.DLL) Found string "ReleaseActCtx" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: KERNEL32.DLL) Found string "CreateActCtxW" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: KERNEL32.DLL) Found string "FindActCtxSectionStringW" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: KERNEL32.DLL) Found string "GetSystemDefaultUILanguage" (Source: VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin, API is part of module: KERNELBASE.DLL)28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAABEREREREREQAAAAAAAAAAAREREREREREAAAAAAAAAAAERERERERERAAAAAAAAAAABEREREREREQAAAJmQAAmZmZm7u7uxEREAAACZkAAJmZmbu7u7sRERAAAAmZAACZmZu7u7u7EREQAAAJmQAAmZkREREREVFRVEQACZkAAAmbsRERFRVVVVREREmZAAAAu7sVVVVVVVVURERJmUREREu7tVVVVVVVVERESZlEREREu7tVVVVVVVREREmZRERERFu7tVVVVVVURERJmURERERVu7tVVVVVVERESZlEREREVVu7tVVVVVREREmZRERERFVVu7tVVVVURERJm0RERERFVVu7tVVVVERESbtEREREVVVVu7tVVVREREu7u7u7u7u7u7u7VVVURERLu7u7u7u7u7u7u1VVVERES7u7u7u7u7u7u7tVVVREREu7RERERFVVVVVVVVVURERLu0RERERVVVVVVVVVVERES7tEREREVVVVVVVVVVxEREu7RERERFVVVVVVVVVcxERLu7u7u7u7u7u7u1VVXMxES7u7u7u7u7u7u7tVVVzMxEu7u7u7u7u7u7u7VVVczMxERERERERVVVVVVVVVXMzMxEREREREVVVVVVVVVVzMzMRERERERFVVVVVVVVVczMzMRERERERVVVVVVVVVUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790300045377,"unified_at":"2026-09-25T01:34:05.377Z","metadata":{"hashes":{"sha256":"2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b","sha1":"cf5a74c268661501156663f74cd5e20603b0f261","md5":"03694e2fa1744fb856e652667d4801fb","sha512":"4b864b53178080d702945ba6b20f771f406b509824da4adf98cfb54fd5a09f03e012a37f6ead9f89210905c15eb63cbdccf8cba9e51f043b4d11147ae38219c2","ssdeep":"24576:dtTCMA6kxsKEeULRyQ+2CrhSHZnd0iDHsD:nuzxULRr+2EhSD0iDMD","ssdeep_chunks":["24576:dtTCMA6","24576:tTCMA6k","24576:TCMA6kx","24576:CMA6kxs","24576:MA6kxsK","24576:A6kxsKE","24576:6kxsKEe","24576:kxsKEeU","24576:xsKEeUL","24576:sKEeULR","24576:KEeULRy","24576:EeULRyQ","24576:eULRyQ+","24576:ULRyQ+2","24576:LRyQ+2C","24576:RyQ+2Cr","24576:yQ+2Crh","24576:Q+2CrhS","24576:+2CrhSH","24576:2CrhSHZ","24576:CrhSHZn","24576:rhSHZnd","24576:hSHZnd0","24576:SHZnd0i","24576:HZnd0iD","24576:Znd0iDH","24576:nd0iDHs","24576:d0iDHsD","49152:dtTCMA6","49152:tTCMA6k","49152:TCMA6kx","49152:CMA6kxs","49152:MA6kxsK","49152:A6kxsKE","49152:6kxsKEe","49152:kxsKEeU","49152:xsKEeUL","49152:sKEeULR","49152:KEeULRy","49152:EeULRyQ","49152:eULRyQ+","49152:ULRyQ+2","49152:LRyQ+2C","49152:RyQ+2Cr","49152:yQ+2Crh","49152:Q+2CrhS","49152:+2CrhSH","49152:2CrhSHZ","49152:CrhSHZn","49152:rhSHZnd","49152:hSHZnd0","49152:SHZnd0i","49152:HZnd0iD","49152:Znd0iDH","49152:nd0iDHs","49152:d0iDHsD","24576:nuzxULR","24576:uzxULRr","24576:zxULRr+","24576:xULRr+2","24576:ULRr+2E","24576:LRr+2Eh","24576:Rr+2EhS","24576:r+2EhSD","24576:+2EhSD0","24576:2EhSD0i","24576:EhSD0iD","24576:hSD0iDM","24576:SD0iDMD"],"imphash":"dadc55c224c0f1fb176273026bc28c36"},"file_info":{"file_name":"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1053696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1527676379000,"last_seen":1660982979000,"last_multi_scan":1660982979000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backswap","banker","bluteal","botnet","chir","clipbanker","neshta","parite","ramnit","sality","tinba","tinbanker","tinybanker","virut"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":24,"suspicious_count":19,"malicious_count":4,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BackSwap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.ClipBanker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Swrort.edpwe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30883061","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30883061 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/BackSwap.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Backswap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00531b451 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Win32.ClipBanker.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-BackSwap.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.ClipBanker.fdukgp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Swrort-AY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Banker/W32.ClipBanker.1053696","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.9C08A054","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.9C08A054","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanBanker.ClipBanker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Dynamic Data Exchange","attack_id":"T1173","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1173","identifiers":[{"type":"suspicious","value":"The input sample contains an embedded RTF document"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Has the capability to lower Firefox security settings"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48839-4081-004AAD4C\n SetUnhandledExceptionFilter@KERNEL32.dll at 48839-12061-00481131\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010610-00001396-61704-16-00477B46\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010610-00001396-61704-17-0047816D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010610-00001396-61704-1095-004AAD4C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NotifyWinEvent@USER32.DLL at 00010610-00001396-61704-134-0046D935\n Found reference to API FindActCtxSectionStringW@KERNEL32.DLL at 00010610-00001396-61704-2404-00448A96","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 48839-3250-00402619\n GetSystemTimeAsFileTime@KERNEL32.dll at 48839-4425-0047DFEB\n GetLocalTime@KERNEL32.DLL at 00010610-00001396-61704-265-00402619\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010610-00001396-61704-189-00482298\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010610-00001396-61704-1439-0047DFEB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 48839-3807-0048C011\n GetTimeZoneInformation@KERNEL32.DLL at 00010610-00001396-61704-821-0048C011","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 48839-4366-0042C6D4\n GetVersionExW@KERNEL32.dll at 48839-4315-0042AD0A\n GetVersionExA@KERNEL32.dll at 48839-4136-0043E381\n GetVersionExW@KERNEL32.dll at 48839-5049-00441D64\n GetVersionExW@KERNEL32.dll at 48839-9207-0044B6CB\n GetVersionExW@KERNEL32.dll at 48839-8464-0042BFA8\n GetVersionExW@KERNEL32.DLL at 00010610-00001396-61704-1329-0042AD0A\n GetVersion@KERNEL32.DLL at 00010610-00001396-61704-1380-0042C6D4\n GetVersionExA@KERNEL32.DLL at 00010610-00001396-61704-1150-0043E381\n GetVersionExW@KERNEL32.DLL at 00010610-00001396-61704-2063-00441D64","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 48839-4103-004A2A3E\n EnumSystemLocalesA@KERNEL32.dll at 48839-4101-004A2AA5\n GetUserDefaultLCID@KERNEL32.dll at 48839-4100-004A2AE1\n GetUserDefaultLCID@KERNEL32.dll at 48839-10652-004A2548\n EnumSystemLocalesA@KERNEL32.dll at 48839-12137-004A2A12\n EnumSystemLocalesA@KERNEL32.DLL at 00010610-00001396-61704-1117-004A2A3E\n GetUserDefaultLCID@KERNEL32.DLL at 00010610-00001396-61704-1114-004A2AE1\n EnumSystemLocalesA@KERNEL32.DLL at 00010610-00001396-61704-1115-004A2AA5","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.dll at 48839-12346-0046F96E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 48839-3725-004A86DA\n GetProcessHeap@KERNEL32.DLL at 00010610-00001396-61704-739-004A86DA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"d:\\devel\\svn\\FZS\\trunk\\FileZilla Server\\source\\Interface\\Release\\FileZilla Server Interface.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"cmd.exe\" created file \"%TEMP%\\fegrt\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/V:ON /C dir /S/B/A-D \"%APPDATA%\\Mozilla\\prefs.js\" > \"%TEMP%\\fegrt\" && SETLOCAL EnableDelayedExpansion && set /p v=<\"%TEMP%\\fegrt\" && echo ^user_pref(\"devtools.selfxss.count\", 100); >> \"!v!\"\" on 2018-7-10.13:53:12.155","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/V:ON /C dir /S/B/A-D \"%APPDATA%\\Mozilla\\prefs.js\" > \"%TEMP%\\feg ...\" (UID: 00012415-00004004)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/V:ON /C dir /S/B/A-D \"%APPDATA%\\Mozilla\\prefs.js\" > \"%TEMP%\\feg ...\" (UID: 00012415-00004004)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"prefs.js\" has type \"ASCII text with very long lines with CRLF line terminators\"\n \"fegrt\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://counter.yadro.ru/hit?rhttp://sexy.com/;uhttp://sexy.com/;h\"\n Pattern match: \"https://*ipko.pl*transactions/transfers*\"\n Pattern match: \"https://*mbank.pl*transfer*\"\n Pattern match: \"https://*ingbank.pl*mojeing*transactions\"\n Heuristic match: \"mailto:Tim.Kosse@gmx.de\"\n Pattern match: \"https://www.paypal.com/xclick/business=Tim.Kosse%40gmx.de&item_name=FileZilla&cn=Enter+your+comments+here&tax=0¤cy_code=USD\"\n Pattern match: \"http://filezilla-project.org/\"\n Pattern match: \"http://filezilla-project.org/specs/draft-preston-ftpext-deflate-03.txt\"\n Pattern match: \"http://en.wikipedia.org/wiki/CIDR_notation\"\n Pattern match: \"http://192.168.56.151:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56\"\n Pattern match: \"http://[fe80::8d8d:12f:f3a3:d4a9]:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"https://www.paypal.com/xclick/business=Tim.Kosse%40gmx.de&item_name=FileZilla&cn=Enter+your+comments+here&tax=0¤cy_code=USD\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"cmd.exe\" wrote bytes \"7111c0007a3bbf00ab8b02007f950200fc8c0200729602006cc805001ecdbc007d26bc00\" to virtual address \"0x76F607E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00010610-00001396-00000033-76822498416","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"\" (Thread ID: 572) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/68 reputation engines marked \"https://www.paypal.com\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://counter.yadro.ru\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://mbank.pl\" as malicious (1% detection rate)\n 2/67 reputation engines marked \"http://counter.yadro.ru/hit\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 48839-4128-00444D2A\n FindResourceW@KERNEL32.dll at 48839-6709-004667D5\n FindResourceW@KERNEL32.dll at 48839-5178-00445324\n FindResourceW@KERNEL32.dll at 48839-5198-0044585B\n LockResource@KERNEL32.dll at 48839-6166-0045825D\n FindResourceW@KERNEL32.dll at 48839-5194-004457C4\n LockResource@KERNEL32.dll at 48839-5195-0044581C\n FindResourceW@KERNEL32.dll at 48839-6217-00459245\n FindResourceW@KERNEL32.dll at 48839-6176-00458665\n FindResourceW@KERNEL32.dll at 48839-8394-004455C9\n FindResourceW@KERNEL32.DLL at 00010610-00001396-61704-120-00405233\n LockResource@KERNEL32.DLL at 00010610-00001396-61704-121-004051D8\n FindResourceW@KERNEL32.DLL at 00010610-00001396-61704-1142-00444D2A\n FindResourceW@KERNEL32.DLL at 00010610-00001396-61704-2188-00445324\n FindResourceW@KERNEL32.DLL at 00010610-00001396-61704-2204-004457C4\n FindResourceW@KERNEL32.DLL at 00010610-00001396-61704-2208-0044585B\n LockResource@KERNEL32.DLL at 00010610-00001396-61704-2205-0044581C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00010610-00001396-61704-578-00409BB5\n recv@WS2_32.DLL at 00010610-00001396-61704-502-0040671F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\cmd.exe\", Handle: 604)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n Heuristic match: \"Due to security considerations, the admin interface settings can only be changed from local connections. If you aren't connected locally (using 127.0.0.1 as server IP), all changes on this page will be ignored by the server.\"\n Heuristic match: \"Use * to bind to all addresses.127.0.0.1 is the default binding, it always exists and cannot be removed.\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"System Security","name":"Has the capability to lower Firefox security settings","description":"\"user_pref(\"app.update.auto\", false);\" (Indicator: \"user_pref(\"app.update.auto\",false);\"; File: \"prefs.js\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":10,"id":"string-60","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyW\n RegCreateKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n RegOpenKeyW\n GetFileAttributesW\n UnhandledExceptionFilter\n LoadLibraryExW\n WriteFile\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n CreateThread\n ExitThread\n TerminateProcess\n LoadLibraryW\n GetVersionExW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n GetStartupInfoW\n DeleteFileW\n GetTempFileNameW\n GetFileSizeEx\n FindFirstFileW\n GetProcAddress\n CreateFileW\n CreateFileA\n WinExec\n LockResource\n GetCommandLineW\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n FindResourceW\n CreateProcessW\n Sleep\n VirtualAlloc\n ShellExecuteW\n GetLastActivePopup\n SetWindowsHookExW\n FindWindowW\n GetWindowThreadProcessId\n accept\n WSAStartup\n connect\n recv\n send\n listen\n closesocket\n socket\n bind","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$27","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"The input sample contains an embedded RTF document","description":"\"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe.bin\" has an embedded RTF document (Line: 1365; Offset: 755)","origin":"Binary File","mitre_attack_id":"T1173","relevance":10,"id":"binary-3","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/63 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/63 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\DisabledSessions\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00010610-00001396-61704-2095-004425D6\n NtdllDefWindowProc_W@NTDLL.DLL at 00010610-00001396-61704-1912-0043EFEA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backswap","banker","bluteal","botnet","chir","clipbanker","neshta","parite","ramnit","sality","tinba","tinbanker","tinybanker","virut"],"sample_flags":["Extracted Files","TOR analysis","Sample not shared"],"sandbox_reports":[{"id":"5b44aca87ca3e14d785d97d3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir","analysis_start_time":"2018-07-10T13:52:00+00:00","indicators_count":{"informative":24,"suspicious":20,"malicious":5},"tags":["Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"5b0e7dd77ca3e142b26c274e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b.exe","analysis_start_time":"2018-05-30T11:30:59+00:00","indicators_count":{"informative":21,"suspicious":20,"malicious":4},"tags":["Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}],"processes":[{"pid":1396,"ppid":0,"name":"VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe","command_line":"","sha256":"2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b","normalized_path":"C:\\VTDL2223A93521B261715767F00F0D1AE4E692BD593202BE40F3508CB4FD5E21712B.vir.exe","uid":"00010610-00001396","icon":"$28"},{"pid":4004,"ppid":1396,"name":"cmd.exe","command_line":"/V:ON /C dir /S/B/A-D \"%APPDATA%\\Mozilla\\prefs.js\" > \"%TEMP%\\fegrt\" && SETLOCAL EnableDelayedExpansion && set /p v=<\"%TEMP%\\fegrt\" && echo ^user_pref(\"devtools.selfxss.count\", 100); >> \"!v!\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00010610-00001396","uid":"00012415-00004004"}],"all_imported_dlls":["rpcrt4.dll","rsaenh.dll","sxs.dll","msctf.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cryptsp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","winbrand.dll","cryptbase.dll","urlmon.dll","Wldap32.dll","wininet.dll","ntdll.dll","version.dll","uxtheme.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","clbcatq.dll","ieframe.dll","wow64.dll","user32.dll","KernelBase.dll","sspicli.dll","comctl32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nsi.dll","ole32.dll","oleaut32.dll","oleacc.dll","RpcRtRemote.dll","ieproxy.dll","ws2_32.dll","comdlg32.dll","imm32.dll","lpk.dll","advapi32.dll","shlwapi.dll","cfgmgr32.dll","sechost.dll","usp10.dll","profapi.dll","devobj.dll","userenv.dll","wow64cpu.dll","kernel32.dll","shell32.dll","secur32.dll","oleaccrc.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","msvcrt.dll","setupapi.dll","normaliz.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","MSO.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wow64win.dll","propsys.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","ntmarta.dll","apphelp.dll","gdi32.dll","crypt32.dll","psapi.dll","msasn1.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"prefs.js","sha256":"798e685c5b2deddda90ce3ed2f06b173c8a7bf29899a0770cba8b4473aa4cdd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"fegrt","sha256":"65cdb86a1faa2499aa8c4764e12e140f2d6415659b33bcb07a26173c68896e9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]}],"files_written":[{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%TEMP%\\fegrt","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\prefs.js","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b44aca87ca3e14d785d97d3"},{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b0e7dd77ca3e142b26c274e"}]}]}},"report_ids":{"sandbox_job_ids":["5b44aca87ca3e14d785d97d3","5b0e7dd77ca3e142b26c274e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 2223a93521b2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2223a93521b2…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 2223a93521b2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2223a93521b2…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2223a93521b261715767f00f0d1ae4e692bd593202be40f3508cb4fd5e21712b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 2223a93521b2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2223a93521b2…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]