23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4e3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Generic.MSIL.Bladabindi Sample 2f8e39f8e0b3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2f8e39f8e0b3…. Malware family: Dropper.Generic.MSIL.Bladabindi. Threat score 100/100. 9/26 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1","keywords":["Malicious","Dropper.Generic.MSIL.Bladabindi","malware analysis","sandbox report","threat intelligence","2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1"],"about":{"@type":"SoftwareApplication","name":"0ec2a5409fbce8ca1010d9555dedc65e.zip","applicationCategory":["peexe","executable"],"identifier":"2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Generic.MSIL.Bladabindi","antivirusDetections":{"malicious":9,"total":26},"behavioralIndicators":{"malicious":10,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Taba,"Server.exe" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00018901-00002764-0000010C-45089053 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00018901-00002764-0000010C-45089219 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00018901-00002764-0000010C-45312481 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00018901-00002764-0000010C-45312711 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00018901-00002764-0000010C-45393977 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00018901-00002764-0000010C-45394197 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00018901-00002764-0000010C-45467726 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00018901-00002764-0000010C-45468009 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00018901-00002764-0000010C-47479763 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00018901-00002764-0000010C-47479887 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00018901-00002764-0000010C-47588605 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00018901-00002764-0000010C-47588810 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll" at 00018901-00002764-0000010C-47635042 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll" at 00018901-00002764-0000010C-47635411 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll" at 00018901-00002764-0000010C-47716838 "Server.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll" at 00018901-00002764-0000010C-4771717925:T6b8,"Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-64299387 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-64299671 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-64302095 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-71542693 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-71542908 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-71543266 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-76550073 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-76550305 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-76550662 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-78795715 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-78795955 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-78796328 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-88563710 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-88563909 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-88564256 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-92561485 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-92561714 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-92562063 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-101245691 "Server.exe" queried SystemProcessInformation at 00018901-00002764-00000105-10124589726:T5c5,"Server.exe" wrote bytes "77395f7779a86377be726377d62d63771de25e7705a26377c868627757d16977bee35e77616f6377684161770050617700000000ad37d3758b2dd375b641d37500000000" to virtual address "0x75181000" (part of module "WSHIP6.DLL") "Server.exe" wrote bytes "0857427604784b760000000051c1a9759498a975ee9ca97575dcab75273eab75efb2af750000000046ce1076013d117638ed1176cfcd107631231076de2f1176c4ca107680bb1076aa6e11769fbb107692bb107646ba10760abf107600000000" to virtual address "0x6F6B1000" (part of module "SHFOLDER.DLL") "Server.exe" wrote bytes "92e65e7779a86377be726377d62d63771de25e7705a26377bee35e77616f6377684161770050617700000000ad37d3758b2dd375b641d37500000000" to virtual address "0x74C91000" (part of module "WSHTCPIP.DLL") "Server.exe" wrote bytes "db4d9e6e00000000" to virtual address "0x01082000" (part of module "SERVER.EXE") "Server.exe" wrote bytes "4053617758586277186a6277653c63770000000000bf10760000000056cc1076000000007cca10760000000037687b756a2c6377d62d63770000000020697b750000000029a6107600000000a48d7b7500000000f70e107600000000" to virtual address "0x76061000" (part of module "NSI.DLL") "Server.exe" wrote bytes "623db437" to virtual address "0x68231FDC" (part of module "MSCORWKS.DLL") "netsh.exe" wrote bytes "a3541076013d117638ed1176cfcd107631231076de2f1176c4ca107680bb1076aa6e11769fbb107692bb107646ce107600bf10760abf107646ba107600000000273eab75efb2af7551c1a9759498a975ee9ca97575dcab7500000000" to virtual address "0x6A4B1000" (part of module "MPRMSG.DLL")27:T459,"" wrote 1500 bytes to a remote process "%TEMP%\Server.exe" (Handle: 564) "" wrote 4 bytes to a remote process "%TEMP%\Server.exe" (Handle: 564) "" wrote 32 bytes to a remote process "%TEMP%\Server.exe" (Handle: 564) "" wrote 52 bytes to a remote process "%TEMP%\Server.exe" (Handle: 564) "" wrote 1500 bytes to a remote process "%TEMP%\Mes_Drivers_3.0.4.exe" (Handle: 456) "" wrote 4 bytes to a remote process "%TEMP%\Mes_Drivers_3.0.4.exe" (Handle: 456) "" wrote 32 bytes to a remote process "%TEMP%\Mes_Drivers_3.0.4.exe" (Handle: 456) "" wrote 52 bytes to a remote process "%TEMP%\Mes_Drivers_3.0.4.exe" (Handle: 456) "Server.exe" wrote 1500 bytes to a remote process "%WINDIR%\System32\netsh.exe" (Handle: 504) "Server.exe" wrote 4 bytes to a remote process "%WINDIR%\System32\netsh.exe" (Handle: 504) "Server.exe" wrote 32 bytes to a remote process "%WINDIR%\System32\netsh.exe" (Handle: 504) "Server.exe" wrote 52 bytes to a remote process "%WINDIR%\System32\netsh.exe" (Handle: 504)28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Aj////////////4mZmZmZmZeP///////////3mZmZmZmZmY///////////5mZmZmZmZmZj//////////5mZmZmZmZmZj/////////+JmZmZmZmZmZj/////////+JmZmZmZmZmZj/////////+ZmZmZmZmZmZj/////////+ZmZmZmZmZmZj/////////iZmZmZmZmZmZj/////////mZmZmZmZmZmX//////////mZmZmRAZmZkQAAAAj/AAAAAZmZkQGZmZEHd3d4/wB3dwAJmZEBmZmRB/////8H//+BCXeRAZmZkQGP////B///8Qd3dQF3mZEBf////wf///cHd3cBd3eRAZj///8H///wBxAAAAAHcQGY////AHd3AHcQAAAAB3EFmY///3d3d3j3d3d3d3d3d3mP////////93d4iHd3d3d5f/////////d3d4/4iHd3d5j////////4iIh4///4h3eY////////+IiIiP////+Id/////////iIiIiP//////j////////4iIiIiP//////////////+IiIiIiP//////////////iIiIiIiP/////////////4iIiIiIiP////////////+IiIiIiIiP////////////iIiIiIiIj////////////4iIiIiIiIj///////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Aj////////////4mZmZmZmZeP///////////3mZmZmZmZmY///////////5mZmZmZmZmZj//////////5mZmZmZmZmZj/////////+JmZmZmZmZmZj/////////+JmZmZmZmZmZj/////////+ZmZmZmZmZmZj/////////+ZmZmZmZmZmZj/////////iZmZmZmZmZmZj/////////mZmZmZmZmZmX//////////mZmZmRAZmZkQAAAAj/AAAAAZmZkQGZmZEHd3d4/wB3dwAJmZEBmZmRB/////8H//+BCXeRAZmZkQGP////B///8Qd3dQF3mZEBf////wf///cHd3cBd3eRAZj///8H///wBxAAAAAHcQGY////AHd3AHcQAAAAB3EHmY///3d3d3j3d3d3d3d3d3mP////////93d4iHd3d3d5f/////////d3d4/4iHd3d5j////////4iIh4///4h3eY////////+IiIiP////+Id/////////iIiIiP//////j////////4iIiIiP//////////////+IiIiIiP//////////////iIiIiIiP/////////////4iIiIiIiP////////////+IiIiIiIiP////////////iIiIiIiIj////////////4iIiIiIiIj///////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790338618609,"unified_at":"2026-09-25T12:16:58.609Z","metadata":{"hashes":{"sha256":"2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1","sha1":"2035fe2a622020f16f245fc02654016252595464","md5":"0ec2a5409fbce8ca1010d9555dedc65e","sha512":"56a4623f15fd2958e81b121ba91bc4cd398d3fcea79016533eeda67d6a077511d1b1cc02b3f440a73092c66a245785f313834f539366f5df7c94302cd8bb0465","ssdeep":"24576:9T+rpScs1FArnI61Ex/kNmpREaNkDYKkbIkzo1BIKNZi+EiTETt3Pe:9TWpScs1qrnI61ezoayYKazgI0k+EAcG","ssdeep_chunks":["24576:9T+rpSc","24576:T+rpScs","24576:+rpScs1","24576:rpScs1F","24576:pScs1FA","24576:Scs1FAr","24576:cs1FArn","24576:s1FArnI","24576:1FArnI6","24576:FArnI61","24576:ArnI61E","24576:rnI61Ex","24576:nI61Ex/","24576:I61Ex/k","24576:61Ex/kN","24576:1Ex/kNm","24576:Ex/kNmp","24576:x/kNmpR","24576:/kNmpRE","24576:kNmpREa","24576:NmpREaN","24576:mpREaNk","24576:pREaNkD","24576:REaNkDY","24576:EaNkDYK","24576:aNkDYKk","24576:NkDYKkb","24576:kDYKkbI","24576:DYKkbIk","24576:YKkbIkz","24576:KkbIkzo","24576:kbIkzo1","24576:bIkzo1B","24576:Ikzo1BI","24576:kzo1BIK","24576:zo1BIKN","24576:o1BIKNZ","24576:1BIKNZi","24576:BIKNZi+","24576:IKNZi+E","24576:KNZi+Ei","24576:NZi+EiT","24576:Zi+EiTE","24576:i+EiTET","24576:+EiTETt","24576:EiTETt3","24576:iTETt3P","24576:TETt3Pe","49152:9T+rpSc","49152:T+rpScs","49152:+rpScs1","49152:rpScs1F","49152:pScs1FA","49152:Scs1FAr","49152:cs1FArn","49152:s1FArnI","49152:1FArnI6","49152:FArnI61","49152:ArnI61E","49152:rnI61Ex","49152:nI61Ex/","49152:I61Ex/k","49152:61Ex/kN","49152:1Ex/kNm","49152:Ex/kNmp","49152:x/kNmpR","49152:/kNmpRE","49152:kNmpREa","49152:NmpREaN","49152:mpREaNk","49152:pREaNkD","49152:REaNkDY","49152:EaNkDYK","49152:aNkDYKk","49152:NkDYKkb","49152:kDYKkbI","49152:DYKkbIk","49152:YKkbIkz","49152:KkbIkzo","49152:kbIkzo1","49152:bIkzo1B","49152:Ikzo1BI","49152:kzo1BIK","49152:zo1BIKN","49152:o1BIKNZ","49152:1BIKNZi","49152:BIKNZi+","49152:IKNZi+E","49152:KNZi+Ei","49152:NZi+EiT","49152:Zi+EiTE","49152:i+EiTET","49152:+EiTETt","49152:EiTETt3","49152:iTETt3P","49152:TETt3Pe","24576:9TWpScs","24576:TWpScs1","24576:WpScs1q","24576:pScs1qr","24576:Scs1qrn","24576:cs1qrnI","24576:s1qrnI6","24576:1qrnI61","24576:qrnI61e","24576:rnI61ez","24576:nI61ezo","24576:I61ezoa","24576:61ezoay","24576:1ezoayY","24576:ezoayYK","24576:zoayYKa","24576:oayYKaz","24576:ayYKazg","24576:yYKazgI","24576:YKazgI0","24576:KazgI0k","24576:azgI0k+","24576:zgI0k+E","24576:gI0k+EA","24576:I0k+EAc","24576:0k+EAcG"],"imphash":"4d17be67c8d0394c5c1b8e725359ed89"},"file_info":{"file_name":"0ec2a5409fbce8ca1010d9555dedc65e.zip","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1472471,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1503922431000,"last_seen":1664799808000,"last_multi_scan":1664799808000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["njrat","rat"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":21,"malicious_count":10,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.m119","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1233713","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dropped:Generic.MSIL.Bladabindi.5C64E69A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Generic.MSIL.Bladabindi.5C64E69A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Disfa.dtznyx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dropper.Generic.MSIL.Bladabindi","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 60098-150-0100240C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00018924-00000188-50554-517-00451994","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@kernel32.dll at 62712-644-00402884","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00018221-00002676-29618-66-004041ED","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$24","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SERVER.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SERVER.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MES_DRIVERS_3.0.4.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MES_DRIVERS_3.0.4.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bimbo09.ddns.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"141.255.159.18:1177\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Server.exe\"\n \"\" created file \"%TEMP%\\Mes_Drivers_3.0.4.exe\"\n \"Mes_Drivers_3.0.4.exe\" created file \"%TEMP%\\detection.exe\"\n \"Mes_Drivers_3.0.4.exe\" created file \"%TEMP%\\interface.cmd\"\n \"Mes_Drivers_3.0.4.exe\" created file \"%TEMP%\\waitfor_x86.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"8fdc4d6260ac2344c39855dbe0eb38de\"\n \"\\Sessions\\1\\BaseNamedObjects\\8fdc4d6260ac2344c39855dbe0eb38de\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"waitfor_x86.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"interface.cmd\" as clean (type is \"DOS batch file Non-ISO extended-ASCII text with CRLF NEL line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Server.exe\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 663A0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Server.exe\" (UID: 00018901-00002764) was launched with new environment variables: \"__COMPAT_LAYER=\"VistaSetup\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Server.exe\" (UID: 00018901-00002764)\n Spawned process \"Mes_Drivers_3.0.4.exe\" (UID: 00018924-00000188)\n Spawned process \"netsh.exe\" with commandline \"\"netsh firewall add allowedprogram \"%TEMP%\\Server.exe\" \"Server.exe\" ENABLE\"\" (UID: 00021075-00003352)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"Server.exe\" connecting to \"\\ThemeApiPort\"\n \"Mes_Drivers_3.0.4.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"detection.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"Mes_Drivers_3.0.4.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"waitfor_x86.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"\n \"interface.cmd\" has type \"DOS batch file Non-ISO extended-ASCII text with CRLF NEL line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\propsys.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"Server.exe\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"Server.exe\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ea0|U.Do\"\n Heuristic match: \"bimbo09.ddns.net\"\n Pattern match: \"www.TousLesDrivers.com\"\n Pattern match: \"http://go.microsoft.com/fwlink/?linkid=121488\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Server.exe\" opened \"\\Device\\KsecDD\"\n \"Mes_Drivers_3.0.4.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Server.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"detection.exe\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"\n \"waitfor_x86.exe\" was detected as \"Microsoft visual C++ v7.1 EXE\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$25","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Server.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .MPRESS1\n .rsrc with unusual entropies 7.55765965337\n 7.99982920331\n 7.98099551661","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Server.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://bimbo09.ddns.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FreeResource@kernel32.dll at 62712-998-0040A83C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"detection.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"Mes_Drivers_3.0.4.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"waitfor_x86.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Server.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"8FDC4D6260AC2344C39855DBE0EB38DE\"; Value: \"\"%TEMP%\\Server.exe\" ..\")\n \"Server.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"8FDC4D6260AC2344C39855DBE0EB38DE\"; Value: \"\"%TEMP%\\Server.exe\" ..\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"Mes_Drivers_3.0.4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00018221-00002676-29618-74-00404EA7","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\0ec2a5409fbce8ca1010d9555dedc65e.exe\" marked \"%TEMP%\\nsdE181.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsdE181.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"detection.exe\" claimed CRC 1200057 while the actual is CRC 60197\n \"Mes_Drivers_3.0.4.exe\" claimed CRC 1628320 while the actual is CRC 1200057\n \"waitfor_x86.exe\" claimed CRC 89126 while the actual is CRC 1628320","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"detection.exe\" has an entrypoint in section \".MPRESS2\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n RegCreateKeyExW\n RegOpenKeyExW\n RegDeleteKeyW\n GetStartupInfoW\n GetModuleFileNameW\n GetVersionExW\n GetFileAttributesW\n GetCommandLineW\n LoadLibraryExW\n DeleteFileW\n UnhandledExceptionFilter\n LoadLibraryW\n LockResource\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n FindResourceW\n CreateFileW\n VirtualAlloc\n GetComputerNameW\n GetComputerNameExW\n TerminateProcess\n GetUserNameExW\n WSAStartup (Ordinal #115)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Mes_Drivers_3.0.4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/59 Antivirus vendors marked sample as malicious (81% detection rate)\n 16/40 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/59 Antivirus vendors marked sample as malicious (81% detection rate)\n 16/40 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"54/59 Antivirus vendors marked dropped file \"Server.exe\" as malicious (classified as \"Generic.MSIL.Bladabindi\" with 91% detection rate)\n 10/64 Antivirus vendors marked dropped file \"detection.exe\" as malicious (classified as \"ML.Attribute\" with 15% detection rate)\n 9/87 Antivirus vendors marked dropped file \"Mes_Drivers_3.0.4.exe\" as malicious (classified as \"Trojan.MulDrop6\" with 10% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"54/59 Antivirus vendors marked spawned process \"Server.exe\" (PID: 2764) as malicious (classified as \"Generic.MSIL.Bladabindi\" with 91% detection rate)\n 9/87 Antivirus vendors marked spawned process \"Mes_Drivers_3.0.4.exe\" (PID: 188) as malicious (classified as \"Trojan.MulDrop6\" with 10% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$27","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"141.255.159.18\" (ASN: , Owner: ): ...\n\n File SHA256: d0da51d098078015681b4b715e552f705f39e64ca4735f767a33f82f1bffe9fb (AV positives: 30/57 scanned on 09/12/2016 18:54:39)\n File SHA256: e2ce1f0278671d6fe97b0811961223c8d501eeeb8cede5545965e7ecc8c2b37b (AV positives: 4/50 scanned on 12/23/2015 18:57:28)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 141.255.159.18 on port 1177","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"njrat1\" classified file \"Server.exe\" as \"rat,njrat\" based on indicators: \"6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5300450045005f004d00410053004b005f004e004f005a004f004e00450043004800450043004b005300,5b005400410050005d00,63006d0064002e0065007800650020002f0063002000700069006e006700\" (Author: Brian Wallace @botnet_hunter)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"\"netsh firewall add allowedprogram \"%TEMP%\\Server.exe\" \"Server.exe\" ENABLE\"\" (UID: 00021075-00003352)","origin":"Monitored Target","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00018221-00002676-29618-1-0040315D","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":148,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":53,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["njrat","rat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59a406077ca3e15bb90f5b14","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropped:Generic.MSIL.Bladabindi","contacted_countries":["NLD"],"submit_name":"0ec2a5409fbce8ca1010d9555dedc65e.zip","analysis_start_time":"2017-08-28T14:01:47+00:00","indicators_count":{"informative":21,"suspicious":27,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"141.255.159.18","port":1177,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}],"dns_resolutions":[{"domain":"bimbo09.ddns.net","country":"-","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-06-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}],"processes":[{"pid":2676,"ppid":0,"name":"0ec2a5409fbce8ca1010d9555dedc65e.exe","command_line":"","sha256":"2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1","normalized_path":"C:\\0ec2a5409fbce8ca1010d9555dedc65e.exe","uid":"00018221-00002676","icon":"$28"},{"pid":2764,"ppid":2676,"name":"Server.exe","command_line":"","sha256":"1dbd83f202fbb802b83d00b8f1117d98e450154df1d50a265a38e3019fafab18","normalized_path":"%TEMP%\\Server.exe","parent_uid":"00018221-00002676","uid":"00018901-00002764","icon":"$29"},{"pid":3352,"ppid":2764,"name":"netsh.exe","command_line":"\"netsh firewall add allowedprogram \"%TEMP%\\Server.exe\" \"Server.exe\" ENABLE\"","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00018901-00002764","uid":"00021075-00003352","icon":"$2a"},{"pid":188,"ppid":2676,"name":"Mes_Drivers_3.0.4.exe","command_line":"","sha256":"0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6","normalized_path":"%TEMP%\\Mes_Drivers_3.0.4.exe","parent_uid":"00018221-00002676","uid":"00018924-00000188","icon":"$2b"}],"all_imported_dlls":["version.dll","msacm32.dll","msctf.dll","propsys.dll","Wldap32.dll","msvcr80.dll","System.dll","FWPUCLNT.DLL","oleaut32.dll","rasmontr.dll","rasapi32.dll","whhelper.dll","rpcnsh.dll","logoncli.dll","activeds.dll","wlanapi.dll","advapi32.dll","imm32.dll","wkscli.dll","tdh.dll","setupapi.dll","crypt32.dll","wlancfg.dll","wwapi.dll","RpcRtRemote.dll","shlwapi.dll","dwmapi.dll","winnsi.dll","credui.dll","odbc32.dll","p2pnetsh.dll","sspicli.dll","mscoreei.dll","System.Drawing.dll","IPHLPAPI.DLL","fwcfg.dll","winipsec.dll","onex.dll","srvcli.dll","dhcpcsvc.dll","wshelper.dll","ws2help.dll","nshhttp.dll","wdi.dll","sfc.dll","cryptbase.dll","eappprxy.dll","shell32.dll","WcnNetsh.dll","wlanhlp.dll","ntmarta.dll","winhttp.dll","p2pcollab.dll","mprmsg.dll","uxtheme.dll","sfc_os.dll","Microsoft.VisualBasic.dll","System.configuration.dll","atl.dll","wlanutil.dll","user32.dll","sechost.dll","Accessibility.dll","urlmon.dll","mpr.dll","KernelBase.dll","profapi.dll","nci.dll","netapi32.dll","kernel32.dll","slc.dll","netutils.dll","secur32.dll","nshwfp.dll","mswsock.dll","WSHTCPIP.DLL","odbcint.dll","authfwcfg.dll","cfgmgr32.dll","shfolder.dll","mprapi.dll","P2P.dll","devobj.dll","dnsapi.dll","QUTIL.DLL","ifmon.dll","webio.dll","ndfapi.dll","eappcfg.dll","userenv.dll","gdi32.dll","ole32.dll","mscorjit.dll","dhcpcmonitor.dll","nshipsec.dll","nettrace.dll","wininet.dll","rpcss.dll","mscoree.dll","cryptsp.dll","vbscript.dll","rpcrt4.dll","winmm.dll","samcli.dll","iertutil.dll","dot3api.dll","certcli.dll","polstore.dll","rasman.dll","dot3cfg.dll","mscorlib.dll","System.Windows.Forms.dll","ws2_32.dll","mfc42u.dll","DHCPQEC.DLL","wevtapi.dll","FirewallAPI.dll","hnetmon.dll","usp10.dll","msvcrt.dll","nsi.dll","netshell.dll","sxs.dll","scrrun.dll","clbcatq.dll","dhcpcsvc6.dll","bcrypt.dll","netiohlp.dll","rsaenh.dll","comctl32.dll","apphelp.dll","msasn1.dll","wship6.dll","httpapi.dll","nlaapi.dll","wwancfg.dll","QAGENT.DLL","lpk.dll","rasadhlp.dll","adsldpc.dll","mscorwks.dll","tzres.dll","psapi.dll","devrtl.dll","ntdll.dll","AcGenral.dll","System.XML.dll","NAPMONTR.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Mes_Drivers_3.0.4.exe","sha256":"0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Server.exe","sha256":"1dbd83f202fbb802b83d00b8f1117d98e450154df1d50a265a38e3019fafab18","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"detection.exe","sha256":"7fbe59195f5f6f45c8b38b12488a169fdcb3a272004dbaf44c9d92a60a3690cb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"interface.cmd","sha256":"11993a03f68a33500a3ce8fbeb3e3c2042a28299d04f39eed40147709e76ca79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"waitfor_x86.exe","sha256":"c3370e8ec5ca54e8fd7eac19c278689cf122edac91faa4376dc24b1d807fe510","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"C:\\0ec2a5409fbce8ca1010d9555dedc65e.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"C:\\Users\\3yjYKEg","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%TEMP%\\Mes_Drivers_3.0.4.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%TEMP%\\detection.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%TEMP%\\interface.cmd","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%TEMP%\\waitfor_x86.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%TEMP%\\Server.exe.config","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\netsh.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\FWCFG.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\P2PNETSH.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%TEMP%\\Server.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\8fdc4d6260ac2344c39855dbe0eb38de.exe","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\8FDC4D6260AC2344C39855DBE0EB38DE\\","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"8fdc4d6260ac2344c39855dbe0eb38de","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\8fdc4d6260ac2344c39855dbe0eb38de","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"59a406077ca3e15bb90f5b14"}]}]}},"report_ids":{"sandbox_job_ids":["59a406077ca3e15bb90f5b14"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Dropper.Generic.MSIL.Bladabindi Sample 2f8e39f8e0b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2f8e39f8e0b3…. Malware family: Dropper.Generic.MSIL.Bladabindi. Threat score 100/100. 9/26 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1"}],["$","meta","4",{"property":"og:title","content":"Malicious Dropper.Generic.MSIL.Bladabindi Sample 2f8e39f8e0b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2f8e39f8e0b3…. Malware family: Dropper.Generic.MSIL.Bladabindi. Threat score 100/100. 9/26 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2f8e39f8e0b3ff745442f07732b059fb11cb354259e841ef9a5374843194e8c1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dropper.Generic.MSIL.Bladabindi Sample 2f8e39f8e0b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2f8e39f8e0b3…. Malware family: Dropper.Generic.MSIL.Bladabindi. Threat score 100/100. 9/26 AV engines flagged this file. 10 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]