24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 2eb447785e5b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2eb447785e5b…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e"],"about":{"@type":"SoftwareApplication","name":"Sample_5c993a236f4db735eaf545cf.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":29},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d4,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" ".exe" touched file "C:\Users\GqdlXWm\AppData\Local\Microsoft\Windows\Temporary Internet Files" ".exe" touched file "C:\Users\GqdlXWm\AppData\Roaming\Microsoft\Windows\Cookies" ".exe" touched file "C:\Users\GqdlXWm\AppData\Local\Microsoft\Windows\History" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\System32\en-US\wshtcpip.dll.mui" ".exe" touched file "C:\Windows\System32\en-US\wship6.dll.mui" ".exe" touched file "C:\Windows\System32\wshqos.dll" ".exe" touched file "C:\Windows\System32\en-US\wshqos.dll.mui" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" ".exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"26:T733,"POST /verify.php HTTP/1.1 Accept: text/html Accept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2 Content-Type: application/x-www-form-urlencoded Content-Length: 1695 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 47.91.56.21 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /bakala/verify.php HTTP/1.1 Accept: text/html Accept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2 Content-Type: application/x-www-form-urlencoded Content-Length: 1739 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.alahbabgroup.com Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /admin/verify.php HTTP/1.1 Accept: text/html Accept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2 Content-Type: application/x-www-form-urlencoded Content-Length: 1695 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 103.225.168.159 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /odin_backup/public/loggoff.php HTTP/1.1 Accept: text/html Accept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2 Content-Type: application/x-www-form-urlencoded Content-Length: 1643 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.khuyay.org Connection: Keep-Alive Cache-Control: no-cache" with no payload27:T58d,Found malicious artifacts related to "198.96.95.58": ... URL: http://hermaintravels.com/fakk/fax/index2.php (AV positives: 6/66 scanned on 03/31/2019 10:10:28) URL: http://hayatestate.com.pk/js/nn/signin.php?country=-&lang=en (AV positives: 4/66 scanned on 03/30/2019 02:12:36) URL: http://hayatestate.com.pk/js/nn/signin.php (AV positives: 4/66 scanned on 03/29/2019 17:22:19) URL: http://alahbabgroup.com/bakala/verify.php (AV positives: 5/67 scanned on 03/29/2019 03:20:19) URL: http://hermaintravels.com/fakk/fax (AV positives: 2/66 scanned on 03/29/2019 02:26:02) File SHA256: dcce88d23f6f05e549c41bccdc8060b3f009fc38a28ea45bc4d1810b31ab431d (Date: 03/27/2019 11:18:12) File SHA256: 2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e (Date: 03/27/2019 11:14:46) File SHA256: 96286ef10f2bf20a54722e8983b1db630a9a17c878378e00dd3a6bb91c8c842f (Date: 03/27/2019 11:06:16) File SHA256: 484f78eb4a3bb69d62491fdb84f2c81b7ae131ec8452a04d6018a634e961cd6a (AV positives: 23/67 scanned on 03/25/2019 20:17:05) File SHA256: aa52ffd587fd0991998faf8c25ed85d140a2e644b40a409f71ed8bd5faa7c909 (AV positives: 10/70 scanned on 02/20/2019 00:44:45) File SHA256: eba30eb5300bbe45e46e7d6d142502af7e5df92b428d12730dbc34f7fdd87f47 (AV positives: 4/59 scanned on 01/30/2019 15:13:55) File SHA256: ac6e9d4ef9e849a00bf99d29ebf9f0a901f17ec5fe421f9a0dec7107d76231d0 (AV positives: 3/70 scanned on 01/11/2019 15:34:18)28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790904008502,"unified_at":"2026-10-02T01:20:08.502Z","metadata":{"hashes":{"sha256":"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e","sha1":"431c792fcc8ba9b58f0ffde5c8fe6fd93066ec45","md5":"96986b18a8470f4020ea78df0b3db7d4","sha512":"1fda04c7d313830b0b3d663479d1e575541b1fb181a125ad59aadf4508946ed0382e970729cbf920e9f1fb3d3426dce12dda1d2706802e8eaf2716fd16926b4a","ssdeep":"3072:Liy4g4zS6Vv/jrKY7pewQpKsQUSfe5bf+Y:Liw4XVv7eYFew5sKy7+Y","ssdeep_chunks":["3072:Liy4g4z","3072:iy4g4zS","3072:y4g4zS6","3072:4g4zS6V","3072:g4zS6Vv","3072:4zS6Vv/","3072:zS6Vv/j","3072:S6Vv/jr","3072:6Vv/jrK","3072:Vv/jrKY","3072:v/jrKY7","3072:/jrKY7p","3072:jrKY7pe","3072:rKY7pew","3072:KY7pewQ","3072:Y7pewQp","3072:7pewQpK","3072:pewQpKs","3072:ewQpKsQ","3072:wQpKsQU","3072:QpKsQUS","3072:pKsQUSf","3072:KsQUSfe","3072:sQUSfe5","3072:QUSfe5b","3072:USfe5bf","3072:Sfe5bf+","3072:fe5bf+Y","6144:Liy4g4z","6144:iy4g4zS","6144:y4g4zS6","6144:4g4zS6V","6144:g4zS6Vv","6144:4zS6Vv/","6144:zS6Vv/j","6144:S6Vv/jr","6144:6Vv/jrK","6144:Vv/jrKY","6144:v/jrKY7","6144:/jrKY7p","6144:jrKY7pe","6144:rKY7pew","6144:KY7pewQ","6144:Y7pewQp","6144:7pewQpK","6144:pewQpKs","6144:ewQpKsQ","6144:wQpKsQU","6144:QpKsQUS","6144:pKsQUSf","6144:KsQUSfe","6144:sQUSfe5","6144:QUSfe5b","6144:USfe5bf","6144:Sfe5bf+","6144:fe5bf+Y","3072:Liw4XVv","3072:iw4XVv7","3072:w4XVv7e","3072:4XVv7eY","3072:XVv7eYF","3072:Vv7eYFe","3072:v7eYFew","3072:7eYFew5","3072:eYFew5s","3072:YFew5sK","3072:Few5sKy","3072:ew5sKy7","3072:w5sKy7+","3072:5sKy7+Y"],"imphash":"50a5f2a0ef77106f38a2b4a79271216f"},"file_info":{"file_name":"Sample_5c993a236f4db735eaf545cf.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":98816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1553595257000,"last_seen":1663576407000,"last_multi_scan":1663576407000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bootkit_troy","coinminer","miner","suspicious","targeted"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":10,"suspicious_count":16,"malicious_count":5,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win64.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.sbfbl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.31783690","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.31783690 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/TrojanDownloader.Agent.DJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 00549bb31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.qwiqys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Download.foacsd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.MBT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W64.Agent.98816","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.807C2437","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.807C2437","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.BJN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.1080787","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 654-171-0000000140002E94\n SetUnhandledExceptionFilter@KERNEL32.dll at 654-199-0000000140006580\n SetUnhandledExceptionFilter@KERNEL32.dll at 654-281-0000000140003698\n SetUnhandledExceptionFilter@KERNEL32.dll at 654-712-0000000140003870\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023155-00002896-7121-46-3FE92E94\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023155-00002896-7121-69-3FE96580\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023155-00002896-7121-109-3FE93698\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023155-00002896-7121-409-3FE93870","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 654-710-0000000140003574\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00023155-00002896-7121-122-3FE93574","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 654-176-0000000140001660\n GetProcessHeap@KERNEL32.dll at 654-186-0000000140001B30\n GetProcessHeap@KERNEL32.DLL at 00023155-00002896-7121-50-3FE91660\n GetProcessHeap@KERNEL32.DLL at 00023155-00002896-7121-61-3FE91B30","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.alahbabgroup.com\"\n \"www.khuyay.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"47.91.56.21:80\"\n \"198.96.95.58:80\"\n \"103.225.168.159:80\"\n \"170.239.84.243:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\")\n \".exe\" touched \"NetworkListManager\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \".exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.alahbabgroup.com/bakala/verify.php\"\n Pattern match: \"http://103.225.168.159/admin/verify.php\"\n Pattern match: \"http://www.khuyay.org/odin_backup/public/loggoff.php\"\n Pattern match: \"http://47.91.56.21/verify.php\"\n Pattern match: \"www.alahbabgroup.com\"\n Pattern match: \"www.khuyay.org\"\n Pattern match: \"www.alahbabgroup.com/bakala/verify.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00023155-00002896-7121-121-3FE93AFC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"5/66 reputation engines marked \"http://www.alahbabgroup.com/bakala/verify.php\" as malicious (7% detection rate)\n 4/66 reputation engines marked \"http://www.khuyay.org/odin_backup/public/loggoff.php\" as malicious (6% detection rate)\n 1/66 reputation engines marked \"http://47.91.56.21\" as malicious (1% detection rate)\n 6/67 reputation engines marked \"http://103.225.168.159/admin/verify.php\" as malicious (8% detection rate)\n 5/66 reputation engines marked \"http://47.91.56.21/verify.php\" as malicious (7% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 654-214-0000000140002A60\n LoadResource@KERNEL32.DLL at 00023155-00002896-7121-97-3FE92A60","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 654-260-00000001400025EB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 3179520)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4268242432)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"http://103.225.168.159/admin/verify.php\"\n Heuristic match: \"http://47.91.56.21/verify.php\"\n \"47.91.56.21\"\n \"103.225.168.159\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 47.91.56.21 on port 80 is sent without HTTP header\n TCP traffic to 198.96.95.58 on port 80 is sent without HTTP header\n TCP traffic to 103.225.168.159 on port 80 is sent without HTTP header\n TCP traffic to 170.239.84.243 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"Module32FirstW@KERNEL32.dll at 654-247-0000000140001F4C\n CreateToolhelp32Snapshot@KERNEL32.dll at 654-262-0000000140001F00\n Module32FirstW@KERNEL32.DLL at 00023155-00002896-7121-72-3FE91F00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyA\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n GetProcAddress\n WriteFile\n FindNextFileW\n GetComputerNameA\n FindFirstFileExW\n CreateFileW\n Process32NextW\n LockResource\n GetCommandLineW\n GetCommandLineA\n Process32FirstW\n GetModuleHandleW\n FindResourceW\n Sleep\n VirtualAlloc\n InternetConnectW\n InternetCrackUrlW\n InternetCloseHandle\n HttpSendRequestW\n InternetReadFile\n InternetOpenW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FlsGetValue\" (Source: 2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin, API is part of module: KERNELBASE.DLL)\n Found string \"FlsSetValue\" (Source: 2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin, API is part of module: KERNELBASE.DLL)\n Found string \"InitializeCriticalSectionEx\" (Source: 2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: 2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: 2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.bin\" (Offset: 12081)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"5/66 reputation engines marked \"http://www.alahbabgroup.com/bakala/verify.php\" as malicious (7% detection rate)\n 4/66 reputation engines marked \"http://www.khuyay.org/odin_backup/public/loggoff.php\" as malicious (6% detection rate)\n 6/67 reputation engines marked \"http://103.225.168.159/admin/verify.php\" as malicious (8% detection rate)\n 5/66 reputation engines marked \"http://47.91.56.21/verify.php\" as malicious (7% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/71 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/71 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["bootkit_troy","coinminer","miner","suspicious","targeted"],"sample_flags":["Network Traffic","TOR analysis"],"sandbox_reports":[{"id":"5ca0d5cc028838112ab815d6","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHL","THA","USA"],"submit_name":"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.exe","analysis_start_time":"2019-03-31T14:50:08+00:00","indicators_count":{"informative":10,"suspicious":21,"malicious":6},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true},{"id":"5c99fb770288383f421ac18f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"Sample_5c993a236f4db735eaf545cf.bin","analysis_start_time":"2019-04-09T18:37:17+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"47.91.56.21","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"address":"198.96.95.58","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"address":"103.225.168.159","port":80,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"address":"170.239.84.243","port":80,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}],"dns_resolutions":[{"domain":"www.alahbabgroup.com","address":"198.96.95.58","ttl":14399,"country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_name_servers":"NS401.HOSTERPK.COM","registrar_creation_date":"2014-12-15T09:39:12+00:00","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"domain":"www.khuyay.org","address":"170.239.84.243","ttl":14399,"country":"Chile","registrar_name":"GoDaddy.com, LLC","registrar_organization":"ASESORIAS EN TECNOLOGIA DE LA INFORMACION WEBSUP LIMITADA","registrar_name_servers":"NS1.WEBSUP.CL","registrar_creation_date":"2018-01-02T13:26:11+00:00","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}],"http_requests":[{"host":"47.91.56.21","host_ip":"47.91.56.21:80","url":"/verify.php","method":"POST","header":"POST /verify.php HTTP/1.1\nAccept: text/html\nAccept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 1695\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 47.91.56.21\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"host":"www.alahbabgroup.com","host_ip":"198.96.95.58:80","url":"/bakala/verify.php","method":"POST","header":"POST /bakala/verify.php HTTP/1.1\nAccept: text/html\nAccept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 1739\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.alahbabgroup.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"host":"103.225.168.159","host_ip":"103.225.168.159:80","url":"/admin/verify.php","method":"POST","header":"POST /admin/verify.php HTTP/1.1\nAccept: text/html\nAccept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 1695\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 103.225.168.159\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"host":"www.khuyay.org","host_ip":"170.239.84.243:80","url":"/odin_backup/public/loggoff.php","method":"POST","header":"POST /odin_backup/public/loggoff.php HTTP/1.1\nAccept: text/html\nAccept-Language: en-us;q=0.8;q=0.6,en-us;q=0.4,en;q=0.2\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 1643\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.khuyay.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}],"processes":[{"pid":2896,"ppid":0,"name":"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.exe","command_line":"","sha256":"2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e","normalized_path":"C:\\2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e.exe","uid":"00023155-00002896","icon":"$28"}],"all_imported_dlls":["WSHTCPIP.DLL","dhcpcsvc.dll","comctl32.dll","rasadhlp.dll","gdi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","user32.dll","msctf.dll","npmproxy.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","VxSSL64.dll","sspicli.dll","mswsock.dll","clbcatq.dll","usp10.dll","advapi32.dll","normaliz.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","userenv.dll","winhttp.dll","KernelBase.dll","imm32.dll","api-ms-win-core-synch-l1-2-0.dll","netprofm.dll","rpcrt4.dll","shlwapi.dll","ole32.dll","nsi.dll","FWPUCLNT.DLL","ntdll.dll","shell32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rsaenh.dll","sechost.dll","wship6.dll","dhcpcsvc6.dll","cryptsp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","IPHLPAPI.DLL","cryptbase.dll","wshqos.dll","kernel32.dll","lpk.dll","msvcr100.dll","msvcrt.dll","version.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","profapi.dll","winnsi.dll","wininet.dll","nlaapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","oleaut32.dll","secur32.dll","webio.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","urlmon.dll","ws2_32.dll","dnsapi.dll","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\GuiCache.db","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\00-00-5E-00-01-01\\","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ca0d5cc028838112ab815d6"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5ca0d5cc028838112ab815d6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 2eb447785e5b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2eb447785e5b…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 2eb447785e5b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2eb447785e5b…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2eb447785e5b35c42d842706d593a907d0bdbc50ad9d0327c3591ac4ef17ce6e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 2eb447785e5b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2eb447785e5b…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]