24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 2b6288bbd81b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2b6288bbd81b…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6fc,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")26:T4f9,".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB")27:T465,".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")28:T7ea,".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")29:T45f,".exe" wrote bytes "7111e9017a3be801ab8b02007f950200fc8c0200729602006cc805001ecde5017d26e501" to virtual address "0x75C407E4" (part of module "USER32.DLL") ".exe" wrote bytes "0efcaa7781eda977ae86a877c6e0a777effdaa772d16a977c0fca677da8fb1776014ab77478da877a8e2a7776089a87700000000ad3761778b2d6177b641617700000000" to virtual address "0x74001000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "c0dfa7771cf9a677ccf8a6770d64a87700000000c011db7500000000fc3edb7500000000e013db750000000094579b7525e0a777c6e0a77700000000bc6a9a7500000000cf31db750000000093199b75000000002c32db7500000000" to virtual address "0x75991000" (part of module "NSI.DLL") ".exe" wrote bytes "6013c873" to virtual address "0x7568E324" (part of module "WININET.DLL") ".exe" wrote bytes "6013c873" to virtual address "0x73A54028" (part of module "WEBIO.DLL") ".exe" wrote bytes "7d07ab7781eda977ae86a877c6e0a777effdaa772d16a9776014ab77478da877a8e2a7776089a87700000000ad3761778b2d6177b641617700000000" to virtual address "0x73FF1000" (part of module "WSHTCPIP.DLL")2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790696009413,"unified_at":"2026-09-29T15:33:29.413Z","metadata":{"hashes":{"sha256":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","sha1":"2102cc78f95f014cdee33a63a5f7b1d282ca397f","md5":"216088053dac46fcd95938568c469fa6","sha512":"997bbe0880c2b71cbf73d6f787ae3aed6f54cbe5fd99a1bfbaa9a7671ec3d81518a6234cd9d319c3c65928682f72e81d4b482b61a036904c255456f25aaee860","ssdeep":"192:uXhInmeASISw1cX34Q7q7qvbA+NA1wUoynbmttwS6:hVzjX34cb/NA1lVmttw","ssdeep_chunks":["192:uXhInme","192:XhInmeA","192:hInmeAS","192:InmeASI","192:nmeASIS","192:meASISw","192:eASISw1","192:ASISw1c","192:SISw1cX","192:ISw1cX3","192:Sw1cX34","192:w1cX34Q","192:1cX34Q7","192:cX34Q7q","192:X34Q7q7","192:34Q7q7q","192:4Q7q7qv","192:Q7q7qvb","192:7q7qvbA","192:q7qvbA+","192:7qvbA+N","192:qvbA+NA","192:vbA+NA1","192:bA+NA1w","192:A+NA1wU","192:+NA1wUo","192:NA1wUoy","192:A1wUoyn","192:1wUoynb","192:wUoynbm","192:Uoynbmt","192:oynbmtt","192:ynbmttw","192:nbmttwS","192:bmttwS6","384:uXhInme","384:XhInmeA","384:hInmeAS","384:InmeASI","384:nmeASIS","384:meASISw","384:eASISw1","384:ASISw1c","384:SISw1cX","384:ISw1cX3","384:Sw1cX34","384:w1cX34Q","384:1cX34Q7","384:cX34Q7q","384:X34Q7q7","384:34Q7q7q","384:4Q7q7qv","384:Q7q7qvb","384:7q7qvbA","384:q7qvbA+","384:7qvbA+N","384:qvbA+NA","384:vbA+NA1","384:bA+NA1w","384:A+NA1wU","384:+NA1wUo","384:NA1wUoy","384:A1wUoyn","384:1wUoynb","384:wUoynbm","384:Uoynbmt","384:oynbmtt","384:ynbmttw","384:nbmttwS","384:bmttwS6","192:hVzjX34","192:VzjX34c","192:zjX34cb","192:jX34cb/","192:X34cb/N","192:34cb/NA","192:4cb/NA1","192:cb/NA1l","192:b/NA1lV","192:/NA1lVm","192:NA1lVmt","192:A1lVmtt","192:1lVmttw"],"imphash":"8265ad1d095b593af18af85c74f9725e"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":16384,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1611403081000,"last_seen":1646426872000,"last_multi_scan":1646426872000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":18,"suspicious_count":16,"malicious_count":8,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1223801","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.11329","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Part.g","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.11329 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Agent.QUX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!2848D4A791191229","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 0055e3da1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FFIF!216088053DAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.hxrnq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"TrojanAPT.Garveep.DL4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Small.16384.XE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_MOTMOT.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_MOTMOT.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dhupad.CLH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sourcecodecenter.org\"\n \"ocsp.godaddy.com\"\n \"mechanicalcomfort.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"72.167.191.69:80\"\n \"72.167.191.69:443\"\n \"192.124.249.41:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\20110406\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"20110406\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /u3/update/chkupdate.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: sourcecodecenter.org\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com\"\n \"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDnXTo8R91tMg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"WinInetBroker Class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\LOCALSERVER32\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\\PROGID\")\n \".exe\" touched \"NetworkListManager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\\TREATAS\")\n \".exe\" touched \"Network List Manager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00000000-00001856) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", PROMPT=\"$P$G\"\"\n Process \".exe\" (UID: 00000000-00001856) was launched with modified environment variables: \"CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00000000-00001856)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00000000-00001856)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4817 bytes 1 file\"\n \"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771\" has type \"data\"\n \"0550E1EDDDAA6684B0BEBD84D334DFF5_79DF86536A5944B746CA6D8B7421094B\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"sourcecodecenter.org\"\n Heuristic match: \"ocsp.godaddy.com\"\n Heuristic match: \"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com\"\n Heuristic match: \"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDnXTo8R91tMg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com\"\n Heuristic match: \"mechanicalcomfort.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00002376-00000033-4881283\n \".exe\" at 00000000-00001856-00000033-6081746","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"2B6288BBD81BB9D666C3A0372F26EDE47C8C9FF11C604307982D51654FB9E850.EXE\"; Value: \"C:\\2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e\")\n \".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 72.167.191.69 on port 80 is sent without HTTP header\n TCP traffic to 72.167.191.69 on port 443 is sent without HTTP header\n TCP traffic to 192.124.249.41 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n RegOpenKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n GetStartupInfoA\n GetModuleHandleA\n FindFirstFileA\n DeleteFileA\n Sleep\n GetVersionExA\n GetProcAddress\n GetModuleFileNameA\n HttpSendRequestA\n InternetReadFile\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n HttpQueryInfoA\n WSAStartup","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Suspicious Purported MSIE 7 with terse HTTP Headers GET to PHP\" (SID: 2012384, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ETPRO MALWARE Garveep CnC Beacon Fake Headers\" (SID: 2812432, Rev: 3, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"26/37 Antivirus vendors marked sample as malicious (70% detection rate)\n 59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"26/37 Antivirus vendors marked sample as malicious (70% detection rate)\n 59/69 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"72/91 Antivirus vendors marked dropped file \"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe.bin\" as malicious (classified as \"TrojanAPT.Garveep\" with 79% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"72/91 Antivirus vendors marked spawned process \".exe\" (PID: 1856) as malicious (classified as \"TrojanAPT.Garveep\" with 79% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\n Microsoft-CryptoAPI/6.1","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"61f98303b7cfbc7022153765","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Doina","contacted_countries":["USA"],"submit_name":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","analysis_start_time":"2022-02-01T18:59:24+00:00","indicators_count":{"informative":18,"suspicious":20,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"72.167.191.69","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"address":"72.167.191.69","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"address":"192.124.249.41","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"dns_resolutions":[{"domain":"mechanicalcomfort.net","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"domain":"ocsp.godaddy.com","address":"192.124.249.41","ttl":3138,"country":"United States","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"domain":"sourcecodecenter.org","address":"72.167.191.69","ttl":600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"http_requests":[{"host":"sourcecodecenter.org","host_ip":"72.167.191.69:80","url":"/u3/update/chkupdate.php","method":"GET","header":"GET /u3/update/chkupdate.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: sourcecodecenter.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.41:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.41:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDnXTo8R91tMg%3D%3D","method":"GET","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDnXTo8R91tMg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}],"processes":[{"pid":2376,"ppid":0,"name":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe","command_line":"","sha256":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","normalized_path":"C:\\2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe","uid":"00000000-00002376","icon":"$2a"},{"pid":1856,"ppid":0,"name":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe","command_line":"","sha256":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","normalized_path":"C:\\2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe","uid":"00000000-00001856","icon":"$2b"}],"all_imported_dlls":["api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","bcryptprimitives.dll","wintrust.dll","ntdll.dll","kernel32.dll","KernelBase.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","WSHTCPIP.DLL","sspicli.dll","cryptbase.dll","urlmon.dll","RpcRtRemote.dll","schannel.dll","SensApi.dll","webio.dll","cfgmgr32.dll","advapi32.dll","normaliz.dll","iertutil.dll","dnsapi.dll","nlaapi.dll","cryptsp.dll","imm32.dll","rasadhlp.dll","crypt32.dll","msasn1.dll","rsaenh.dll","comctl32.dll","gpapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","secur32.dll","IPHLPAPI.DLL","bcrypt.dll","wow64cpu.dll","gdi32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wshqos.dll","ncrypt.dll","msvcrt.dll","msctf.dll","rpcrt4.dll","oleaut32.dll","FWPUCLNT.DLL","usp10.dll","wow64win.dll","version.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","Wldap32.dll","npmproxy.dll","shlwapi.dll","shell32.dll","lpk.dll","profapi.dll","dhcpcsvc6.dll","credssp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ws2_32.dll","sechost.dll","nsi.dll","mswsock.dll","wship6.dll","dhcpcsvc.dll","wininet.dll","wow64.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winhttp.dll","winnsi.dll","cryptnet.dll","netprofm.dll","user32.dll","ole32.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850.exe.bin","sha256":"2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"1b4a3f2cc3c09e0717f25b0d950f5d176586fbf116d2a7af8deedc84304dbc07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"7a52a5f6b92df2afabe3c41c8cce3ac513220700c4e364760ce8622218f6217c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"0550E1EDDDAA6684B0BEBD84D334DFF5_79DF86536A5944B746CA6D8B7421094B","sha256":"ae9cbd4f332e1b96ffba37941094a1db94f2e5619faabf0312beb99242339253","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\20110406","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"20110406","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f98303b7cfbc7022153765"}]}]}},"report_ids":{"sandbox_job_ids":["61f98303b7cfbc7022153765"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 2b6288bbd81b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2b6288bbd81b…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 2b6288bbd81b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2b6288bbd81b…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2b6288bbd81bb9d666c3a0372f26ede47c8c9ff11c604307982d51654fb9e850"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 2b6288bbd81b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2b6288bbd81b…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]