26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 225e6f5d1dad… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 225e6f5d1dad…. Malware family: Trojan.Agent. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760"],"about":{"@type":"SoftwareApplication","name":"payload-Fotki DSC000455 DSC000456.scr.dat","applicationCategory":["peexe","executable"],"identifier":"225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAbwSURBVFhH7VdZU1RXED6TEiqJAkIhBiZJJXnIY15TlR/ho495T6WyGJe4RY0RkLAJKLsii4gIsrghyCargIRlGJhhR8CRTUAFAfHL1+cyghomxPIxt6rrnu2e/k73d7r7KvX/s2oBqOJGqMpWqMZOqL/sUO09UNZeqM5+qK4V6eyD6uBYazdUsw2qrsP45lYDVF4lVFYJ1PnrUIn5UNHZUGEZUH+kQB1IgGn3aZi+CwNVirzxcKM2Q3lbNz6uqoKy9eGL8mJ8XlGCbZWlUP3DUL1D+LCiFDtqqKyOgFsIpInfOEFcqYDKvAV17ipU3BWoiItQwWlQR5Oh9sbC9FOUBiDP6wgM5XJqWz8sk+N8dxsLe3niqtvomHDAOvEQX1UWQXUP4MXyMi3Bb8Qa8q2AuF4PlVsGlX4TKqkAKuYyVOiFFSvEw/RLjAsAPLkol1O2UpEa6MeLxef4sqEcoZYmRNjbsMy+cnCuqRaqXqxEwOIisUS1Ber2PajCO1AXi2mFa4YVwmmFoFSo3xJh2nvGBQBu5N7WDpPdiuaxB1DD/Vicf0aFA1DjNP+jh1h6xv4UAXR34OvSq3i/lsp6Bg1eNHUZVrixxgrChShyISSdbjgLtS/WBQCaVdlsePZ0DvNPn1LRGBbk/XgMalaEiodsWJqbx8OpSb7nyAuevu++YTlxhVihpMkg5AW6KrnQcIOQ8fg5qP3xLgDQ9GpkFGqMiiYp0+SBVsyx2ZEVkTbnZjg+wfYDtoc5J1YQ/ggXylugrtI94oazJOOZXALIhAo8r2/D+iSUk4w6aG4Hwm1dmoDv4vkgOGkVwEFXAAbo5wcEwJPJs0yWvwuxyqGEiIEk4qFEFxZYC+D5MhYXl5BEQprvVVLKKRUr7Wq+62FuqIO5vhbm6hqYy7imiGsKimHOvg5zai6Wl5b0HpZhEnpDALQLuJgueL6wgHlhfC9ZPUtuvCI8kfBDeDLGtvCmlxyoqOc1XcTOm4wD12uR02bVe7QPkSNODrh0wRoSLvAmPHnCG9BrfY2EBCgknKYICSUmrJDw0exj/c0cv1VXq3G5xaL7rQM82IZIaOc1HCRahwNPZ2cxPTNDdhOAMF6Uavbz5KJcTk9LKTGvWE5yxV0Lpqen4XmBEZDX8FJzm96jtZ8W3NA1lIgmphwZwczUFCYmJ3m/ea8l8DAIaRHFkxKkBvW8XtPFICSByBmOVwJRVmOLnm/u5b4nNxKIJBTLSeiKibExOB5SmYXZTvw8bnBDSYSk2a3Dw3pe5FC9JCVmTx2Km6EKjFCcebdZzzfZGR82FIp1MjJAOEZHMUxLqFZmyBEqlas0SFML4Tg+QpF5kUkB2mjFBF2nv0ll9GMyyqht1P2GTqZtScmMgu8fcHUNnbUAQ+rw0H0MDNJ3DUwu9PF9Z18iHkXm1soIiejsjz8gYKbj9Oq7eqyhgwCOJMH98Fn4nGBIXjcdOwuSBisGGON7+lh8VLLQKK/VbZEdpXdgKq152XeOv/6WLJh6p06vq2u3wv1YCnyCM2GOYFheF4D4rogKK1rQ092DLjvdUVSNyLoG3RaxdXejv6//Zd85/vr7s9BkpJTVwMZvyhkPvEOy4B+Vj0+jeEPWBSDllFQ012ph67Kho5PpNfsmrHa7bv8XKWlqQXppFZq77Mhvt8E/ugCfxBTCHMn0vC6AFBYQGUyh2bdh7bCijTfgbaWl3YJ6SyeKOntw3tKDgNOF+DG/Gj8EnnRREybkGfmbRaXN2okWFidvK+MTExjkVW22WJBbVISguDgcjIlb9/RSH0KdugR1OgfKCURKKqlw01jfOeX8DagUjkmel5ovnqDlm8gsRjvWfkFpcAvKYBxxvFQeSOVhGcyGK6b/p4LUACBlk8TsSAKRKkY2lpouniKgRKQfSybHcE7Kbsly4VQsle+JFLidSIVnyCWSz4YcnjwwNhYJeavEW0+5AeAYazapWmSzUN5X2VgAiRI5oZTYWiHH5LQCWCIcFUvZ7car5hGcBd9TBbhVVqrNHpezeu1cKTcA/EofSbo8whr+d9ZvsrEAEiVrRcYksh3jGgYYKbPcGGQ8AzPhG5GPjyILEZaYgJPJPNC/mH3tvwFMP0frvxf5gdBgpH47RDnM8MmSWou0BaQUl/vidJntvj8Rnscz4PtnLrZHFGBbaB6OxnCfDSp3Xgt47knEe99H6r8X064Y/kTwV2rPGa3EJH81ItLfTZG5XdFw3xMHryNp8A2h8vBC+AXl4pud38LLywtmsxn+/v7w9fXVbXmv/Ja9chteGdy0aRM2b96MLVu26LeHh4fezNvbG1u3boWPj48W6YtIW8ZFnOv8/Py0woCAAGzfvl0rlrasfQPAu6h633YP8f/fljMktrjhjEMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790437551054,"unified_at":"2026-09-26T15:45:51.054Z","metadata":{"hashes":{"sha256":"225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760","sha1":"33d82f661ffabb04698c432040313d7832bae231","md5":"f0f3aece02235374576db7fbaad4da68","sha512":"a60051b814a4db233d8e68f05d1150c2000062a0e6e4b4d6229c352f8e07b6da9ad888f144f11631a4c9d414c5f0c4bdb2cb1b08d80bf5f3af7a2197ed5daa92","ssdeep":"49152:/UTsamCDYhtUjZQPSwNLEH9OiGTSFqPk:/alDYhqjoTNcjGT4Sk","ssdeep_chunks":["49152:/UTsamC","49152:UTsamCD","49152:TsamCDY","49152:samCDYh","49152:amCDYht","49152:mCDYhtU","49152:CDYhtUj","49152:DYhtUjZ","49152:YhtUjZQ","49152:htUjZQP","49152:tUjZQPS","49152:UjZQPSw","49152:jZQPSwN","49152:ZQPSwNL","49152:QPSwNLE","49152:PSwNLEH","49152:SwNLEH9","49152:wNLEH9O","49152:NLEH9Oi","49152:LEH9OiG","49152:EH9OiGT","49152:H9OiGTS","49152:9OiGTSF","49152:OiGTSFq","49152:iGTSFqP","49152:GTSFqPk","98304:/UTsamC","98304:UTsamCD","98304:TsamCDY","98304:samCDYh","98304:amCDYht","98304:mCDYhtU","98304:CDYhtUj","98304:DYhtUjZ","98304:YhtUjZQ","98304:htUjZQP","98304:tUjZQPS","98304:UjZQPSw","98304:jZQPSwN","98304:ZQPSwNL","98304:QPSwNLE","98304:PSwNLEH","98304:SwNLEH9","98304:wNLEH9O","98304:NLEH9Oi","98304:LEH9OiG","98304:EH9OiGT","98304:H9OiGTS","98304:9OiGTSF","98304:OiGTSFq","98304:iGTSFqP","98304:GTSFqPk","49152:/alDYhq","49152:alDYhqj","49152:lDYhqjo","49152:DYhqjoT","49152:YhqjoTN","49152:hqjoTNc","49152:qjoTNcj","49152:joTNcjG","49152:oTNcjGT","49152:TNcjGT4","49152:NcjGT4S","49152:cjGT4Sk"],"imphash":"586fa6e6c43f51c796989dc6ddb6dd3e"},"file_info":{"file_name":"payload-Fotki DSC000455 DSC000456.scr.dat","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1958400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297418000,"last_seen":1678316658000,"last_multi_scan":1678316658000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":10,"malicious_count":5,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1201153","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BNBU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BNBU (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.Autoit.BWC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.DarkKomet.gcip","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DarkKomet.dxleot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Autoit_c.CKPK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.Win32.323170","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/56 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"kris-krill.ddns.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"173.0.10.26:6850\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut88D0.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut894E.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut8AC6.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut8BD1.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c C:\\ProgramData\\TReA2L.exe C:\\ProgramData\\TReA2L.au3\" on 2015-9-30.02:39:05.003","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c C:\\ProgramData\\TReA2L.exe C:\\ProgramData\\TReA2L.au3\" (UID: 00035860-00003936)\n Spawned process \"TReA2L.exe\" with commandline \"C:\\ProgramData\\TReA2L.au3\" (UID: 00036067-00003468)\n Spawned process \"ipconfig.exe\" with commandline \"/release *\" (UID: 00038568-00002832)\n Spawned process \"vbc.exe\" (UID: 00038587-00002976)\n Spawned process \"ipconfig.exe\" with commandline \"/renew *\" (UID: 00038902-00002348)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"TReA2L.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"TReA2L.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n .rsrc with unusual entropies 7.93660367338\n 7.97059376777","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"Section name UPX0\n Section name UPX1","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"TReA2L.exe\" (Thread ID: 1928) slept \"210\" times (threshold: 200)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"TReA2L.exe\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"TReA2L.exe\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"TReA2L.exe\" created file \"C:\\Windows\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"TReA2L.exe\" created file \"C:\\Windows\\System32\\msxml3r.dll\"\n \"TReA2L.exe\" created file \"C:\\Windows\\System32\\msxml3.dll\\1\"\n \"TReA2L.exe\" created file \"C:\\Windows\\System32\\msxml3.dll\"\n \"TReA2L.exe\" created file \"C:\\Windows\\system32\\stdole2.tlb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut88D0.tmp\" for deletion\n \"C:\\225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut894E.tmp\" for deletion\n \"C:\\225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut8AC6.tmp\" for deletion\n \"C:\\225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut8BD1.tmp\" for deletion\n \"C:\\ProgramData\\TReA2L.exe\" marked \"\\Device\\HarddiskVolume2\\225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut88D0.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut894E.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut8AC6.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\aut8BD1.tmp\" with delete access\n \"TReA2L.exe\" opened \"C:\\225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"TReA2L.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetProcAddress\n VirtualProtect\n VirtualAlloc\n IcmpSendEcho\n FtpOpenFileW\n socket (Ordinal #23)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\Windows\\System32\\cmd.exe\"\n \"TReA2L.exe\" allocated memory in \"C:\\Windows\\System32\\ipconfig.exe\"\n \"TReA2L.exe\" allocated memory in \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"C:\\ProgramData\\TReA2L.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"TReA2L.exe\" wrote 65536 bytes starting with PE header signature to file \"\\Device\\HarddiskVolume2\\PROGRA~2\\TReA2L.backup\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 173.0.10.26 on port 6850","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":"UPX1","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00035385-00004020)\n Spawned process \"cmd.exe\" with commandline \"/c C:\\ProgramData\\TReA2L.exe C:\\ProgramData\\TReA2L.au3\" (UID: 00035860-00003936)\n Spawned process \"TReA2L.exe\" with commandline \"C:\\ProgramData\\TReA2L.au3\" (UID: 00036067-00003468)\n Spawned process \"ipconfig.exe\" with commandline \"/release *\" (UID: 00038568-00002832)\n Spawned process \"vbc.exe\" (UID: 00038587-00002976)\n Spawned process \"ipconfig.exe\" with commandline \"/renew *\" (UID: 00038902-00002348)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"560baa290e316d2f3b2e96ae","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"suspicious","threat_score":73,"contacted_countries":["USA"],"submit_name":"payload-Fotki DSC000455 DSC000456.scr.dat","analysis_start_time":"2015-09-30T04:37:08+00:00","indicators_count":{"informative":7,"suspicious":14,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"560baa290e316d2f3b2e96ac","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760","analysis_start_time":"2015-09-30T04:25:14+00:00","indicators_count":{"informative":15,"suspicious":37,"malicious":16},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"173.0.10.26","port":6850,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]}],"dns_resolutions":[{"domain":"kris-krill.ddns.net","address":"173.0.10.26","country":"United States","sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"560baa290e316d2f3b2e96ae"}],"processes":[{"pid":4020,"ppid":0,"name":"225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760","command_line":"","normalized_path":"","uid":"00035385-00004020","icon":"$27"},{"pid":3936,"ppid":0,"name":"cmd.exe","command_line":"/c C:\\ProgramData\\TReA2L.exe C:\\ProgramData\\TReA2L.au3","normalized_path":"","uid":"00035860-00003936"},{"pid":3468,"ppid":0,"name":"TReA2L.exe","command_line":"C:\\ProgramData\\TReA2L.au3","normalized_path":"","uid":"00036067-00003468"},{"pid":2832,"ppid":0,"name":"ipconfig.exe","command_line":"/release *","normalized_path":"","uid":"00038568-00002832"},{"pid":2976,"ppid":0,"name":"vbc.exe","command_line":"","normalized_path":"","uid":"00038587-00002976"},{"pid":2348,"ppid":0,"name":"ipconfig.exe","command_line":"/renew *","normalized_path":"","uid":"00038902-00002348"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["560baa290e316d2f3b2e96ac","560baa290e316d2f3b2e96ae"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 225e6f5d1dad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 225e6f5d1dad…. Malware family: Trojan.Agent. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 225e6f5d1dad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 225e6f5d1dad…. Malware family: Trojan.Agent. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/225e6f5d1dade51f8236765cfc4de2ffbf1806e2dc960ef2cc35de35db2a7760"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 225e6f5d1dad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 225e6f5d1dad…. Malware family: Trojan.Agent. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]