24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILPerseus.Generic Sample 31d41c42dc9b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 31d41c42dc9b…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026","keywords":["Malicious","MSILPerseus.Generic","malware analysis","sandbox report","threat intelligence","31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026"],"about":{"@type":"SoftwareApplication","name":"Plasma RAT.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILPerseus.Generic","antivirusDetections":{"malicious":16,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65d,"" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" created file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" created file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index141.dat" "" created file "%WINDIR%\system32\l_intl.nls" "" created file "%WINDIR%\assembly\pubpol47.dat" "" created file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" created file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp"26:T5ab,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index256.dat" "" touched file "C:\Windows\SysWOW64\l_intl.nls" "" touched file "C:\Windows\assembly\pubpol107.dat"27:Tb58,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAgVSURBVFhH1ZcLVFVVGsdDDV+EoCW6zEeNmmU+SvEFlDCKCJigiIj4QBQYBAQlHyCGICBv0csVlLcg7zcXLm8EQQUMU0tNhyxbpRg5VC41rd/se2ac5awxhaY1a81Za69z1rnf3vv//f///X3nvvDC/9nFiBEjMDAwwMrKCodNTjhvdsd6pQ36+nroDB+OyEc1/tir74vq6M6ahZOTExEREaSnp1FUVER5eTlVNbVU1zWQm1/IIVkMm13dmKmr+4cBQUtLixXW1hyJT6Cypp6GptOcam2nsbmFk6fbaD7zMU1nzkrvmk6fpVShQCaTSQxpa2v/V0AYOuxl1q5dS0pqKoVFJbSc/5zOH+7Rff8hV7/uoqquidLyCopLy6RRWXsSZXU9+QUFHEtLZ926dWhqav4uEPTpo8YyqxWkZWSTdjyD7Lwirtzo5Ff+cX1xqxtFVSMFpRXkFpaK3wvJyi2gtKJeepcn3iUmJWNmZibW6tMrEFLw+AkTyS6p4tPrt2hou4SyoZ3zX9zmzv1H3L77gHMdXTS2f0nN6ctUn/oMRW0LheX1VJ1sp+HsNbKLKoiNO0JQUDBjx459DKBHBpWCbezs6ejsljLu6LpPTlkjqVlFVLdcpfzkBTIKKilruECO4gSZhVUU15zlwo1ufnz4K7d+ekRpfTvRssNEREZhamraYwBS4KDBLxEQGc+ZK9/y1+/uUdVyGdnRY8gT0imqu0BKTgVHjuWRmltBYe15ca8kKbuctqs3eSQAdz+EunM3xJw0AoNDWL/BAXX1/j0CgZqaGrMMLQk6dIyQ6COklTRzNKOMsEPxxCTnkV/7GYdTC5An5yNPySej7AytHXc4c7WT6nPf0HjxaxRNF8ksbyUxpxq/wFDsHRzR0BzyXABSwFCdVzFa5ojdBmeCoo4SGpNKdGI+4YfTiUktJUN5ngPxOdK7g4kFHFee5fa9X7gvMle2dRARl0VwdAIB4XJkKcXIkoslOTW1hwkz9n0mCCn7196cwZ8m62K02ILgQ2ns3BuGX1gc0ckK4rIbSS75mNDYLMKP5BKVWExq2TnavvqRq3d+5lhZG/uik0V8LN77otgTIic+/xQbt+0XiY1Cvf8A1J5xInhR6DTqtUkMHzUOvUXWbPOLxn1nAF5+EUQmlVF3+XuUgubIZCVRKRXIs5uITqsRz5UklLQTk9nAnvAEvIPl0pytviH4hCXj4B3LHGMbXtIaykCN36gLquxVP2oPH8nIsRNZuHIL5rab2ejuw5bdYSSWtvI34bCunyG3+SsiUmoJPFyI/6Ec9h7MYp88n5icVnxCE/HyP4S7TyibPHyxcw9k3mJb1njJ0DNdw+jxU36zJqA1TIexE6dhssqV4PRGLDf5YrbKBRfvKJKUF7n1AL4ReqfVd+AnK2B3ZCa7ozLxiTzOrrBjRKY34x2ejptPJA6ee1m0YiPm63Yw18SWvfEK6q99j8OOUMlnT+lWaqgPGMiM+Zak1l2i8xeIUZxnlUcka72EFAFJHFF8QtqJ6+yRFRMYX4N/rJJdEVl47U9ha2Ai+5Mb+EiuwM7NHxMbV+YuWomJrSfm63dSce5LqYLmNl5gjgD0HwBU5VIF4OWRY9gWmoLy007cglJ4f6kDhpabWLRqC/Y75OxLacPRR3Q9v3i2R+SxO0aAiC4RGdZSeakLxYVb2O86zHyLjcxeYIWxjRuL13xI+olL3BYS7k8q5q2ZRk+tiGgOfQXtV0YyZY4xFpv8ePc9c3SNLHlvyXoWWrti6eiHb3yL0PMgNu4h2HqEY7f1ABu845Err/CDYE01DhS2Y/WXIEH/dla4qO47cfwoiT1Hq5g611icBLWnA9AYMowJU+cy7o3pYlN7Jk6fxzsGpswzWSWxYGLrwbYoJc5701nu5C8WD5TGcucAPMLzaOzopvl6N65BaSJzd4yWO2HlEoyBWMvQ0pHp+mZC/9HPakxqvDFdn2l6ptKk8VNnM3mWITMNLdA3s8Nw2SZsPaPYIavDYuMeLBx8pfHBBm8+sPfGNTiLzUEZEmOq4SVMmtncwbbIXMZNeleSV2PI0Gc2JAZpDBHInfEIzWS1RzDvCBmmzF0oSaFvasefrZzxjFCwbsdhiZHFq7dK9wUrXFi7Xc6S9buEkZcKCfw5f/Muoi0QcbxSyKtDP3V1+omvq2d9r0n0GFrYc/H2fa7deYDL3jgmzTAQvlggmFgqOXuJcLVXdCVL7Hcx33Ij85duEGbdwPqdcegtXs3UeYuEP8I4deMul0Qzs/8wRBh80HN7wWNgLFnnybXvfpLQh2fUMH7KHF6fPJO3dOcLHRdLQFS6u+3Px3ilm5DGUcjgy2rPAxIQlRymwvm2nqGCGSeGjRjT480lEMbWznhHH+dgTh1bQrJYYLVZ0GohABjy5sz3eXu2kfCJiTBiAEHprWQ2Xqb0k5v4xFYJ820RMfNFxXubkeMm0rdfv95trgJgbm6GzugJaA4bwYRpetKx1DVaJoC4SIXF1M4LM1HhLB39Sai5zD3BlIqtmMJTYnNDaWNVOR+sqUWfvqoOKB27Hn0NPekPaZKqQWmJ2jBwsIbUTHRefV3Kbqw4qmMmThUs7KbxWhcnP/8Wb1Gezdd7S0d4/JTZwvHaT7bgXv9XeIxYaqGqTFR3FaWqtjpg0GCR4RCJnTnGK4VR3xM9fzj9hdlUhnuCetXGvy/7f058UsN/e1axozq2qk76vNjegujpgr2N67EMvV24p/E9BvCvmtBDap8HoNcb/88m/B1Y8eiDarcs1gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790343204942,"unified_at":"2026-09-25T13:33:24.942Z","metadata":{"hashes":{"sha256":"31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026","sha1":"84543affdeb2e8748ed79b254e0748cd1fbf4de1","md5":"8d01a119e2b10b7396a4aba447c8b3c9","sha512":"59ce56b35342a4b6cb4f959d876dd57c13ae119d1906633148e44e84cde58b57570300cd45735b673a7501b89b07546523a4650196dbe75b1010dfb3e0dca849","ssdeep":"12288:pDgv//2jGIDgv//2jG7oeMG6v+wvupIDDgv//2jGu:2v//2ixv//2i7PJ6vZOIYv//2iu","ssdeep_chunks":["12288:pDgv//2","12288:Dgv//2j","12288:gv//2jG","12288:v//2jGI","12288://2jGID","12288:/2jGIDg","12288:2jGIDgv","12288:jGIDgv/","12288:GIDgv//","12288:IDgv//2","12288:v//2jG7","12288://2jG7o","12288:/2jG7oe","12288:2jG7oeM","12288:jG7oeMG","12288:G7oeMG6","12288:7oeMG6v","12288:oeMG6v+","12288:eMG6v+w","12288:MG6v+wv","12288:G6v+wvu","12288:6v+wvup","12288:v+wvupI","12288:+wvupID","12288:wvupIDD","12288:vupIDDg","12288:upIDDgv","12288:pIDDgv/","12288:IDDgv//","12288:DDgv//2","12288:v//2jGu","24576:pDgv//2","24576:Dgv//2j","24576:gv//2jG","24576:v//2jGI","24576://2jGID","24576:/2jGIDg","24576:2jGIDgv","24576:jGIDgv/","24576:GIDgv//","24576:IDgv//2","24576:v//2jG7","24576://2jG7o","24576:/2jG7oe","24576:2jG7oeM","24576:jG7oeMG","24576:G7oeMG6","24576:7oeMG6v","24576:oeMG6v+","24576:eMG6v+w","24576:MG6v+wv","24576:G6v+wvu","24576:6v+wvup","24576:v+wvupI","24576:+wvupID","24576:wvupIDD","24576:vupIDDg","24576:upIDDgv","24576:pIDDgv/","24576:IDDgv//","24576:DDgv//2","24576:v//2jGu","12288:2v//2ix","12288:v//2ixv","12288://2ixv/","12288:/2ixv//","12288:2ixv//2","12288:ixv//2i","12288:xv//2i7","12288:v//2i7P","12288://2i7PJ","12288:/2i7PJ6","12288:2i7PJ6v","12288:i7PJ6vZ","12288:7PJ6vZO","12288:PJ6vZOI","12288:J6vZOIY","12288:6vZOIYv","12288:vZOIYv/","12288:ZOIYv//","12288:OIYv//2","12288:IYv//2i","12288:Yv//2iu"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Plasma RAT.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1457152,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294456000,"last_seen":1713404466000,"last_multi_scan":1713404466000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["miner"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":18,"malicious_count":3,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.98840","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.56A96872","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.98840 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Agent.AKW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.CoinMiner.ay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3e71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Win32.dccvzo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"plasma rat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.DVA.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.EFHZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Keylogger.Win32.56887","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILPerseus.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 699A0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://plasmarat.pw/showthread.php?tid=6\"\n Heuristic match: \"PlasmaRAT.My\"\n Pattern match: \"http://google.com/file.exe\"\n Pattern match: \"www.google.com\"\n Pattern match: \"http://files.plasmarat.pw/CPUMiner.files|http://files.plasmarat.pw/GPUMiner.files|\"\n Heuristic match: \"Info: Put host in target. Ex: google.com\"\n Pattern match: \"http://api.wipmania.com/\"\n Pattern match: \"http://canyouseeme.org/\"\n Pattern match: \"http://canyouseeme.org\"\n Pattern match: \"google.com/file.exe\"\n Heuristic match: \"ip.org\"\n Heuristic match: \"gle.com\"\n Pattern match: \"asmarat.pw/GPUMiner.files|\"\n Heuristic match: \"ost in target. Ex: google.com\"\n Pattern match: \"http://google.com/logo.png\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00022963-00002360-00000105-63505801","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"72.32.43.20\"\n \"68.142.243.103\"\n \"98.136.63.35\"\n \"87.248.125.49\"\n \"217.146.191.19\"\n \"76.124.248.194\"\n \"93.91.250.134\"\n \"176.31.209.33\"\n \"183.170.243.116\"\n \"85.25.100.13\"\n \"109.168.111.41\"\n \"94.23.71.216\"\n \"5.135.142.32\"\n \"69.197.50.71\"\n \"198.23.247.55\"\n \"71.174.59.38\"\n \"127.0.0.1\"\n \"1.5.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2360.3844691\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2360.3844711\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2360.3845663\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"db4db56e00000000\" to virtual address \"0x00C52000\" (part of module \"31D41C42DC9BAD6DC8DBCF7C232D690E672FFD9C3C08A7FB5C40766D8A043026.EXE\")\n \"\" wrote bytes \"92e6047779a80977be720977d62d09771de2047705a20977bee30477616f0977684107770050077700000000ad37b5758b2db575b641b57500000000\" to virtual address \"0x746A1000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"4053077758580877186a0877653c09770000000000bfd5760000000056ccd576000000007ccad57600000000376833756a2c0977d62d097700000000206933750000000029a6d57600000000a48d337500000000f70ed57600000000\" to virtual address \"0x759A1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7739057779a80977be720977d62d09771de2047705a20977c868087757d10f77bee30477616f0977684107770050077700000000ad37b5758b2db575b641b57500000000\" to virtual address \"0x74BC1000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"e36692d7\" to virtual address \"0x6A4A1FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a reference to the Stratum Mining Protocol","description":"\"stratum+tcp://ltc-stratum.examplepool.net\" (Indicator: \"stratum+tcp://\"; File: \"31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-54","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"This is the file you run on other computers. When another computer runs this file, they will connect to you. Please only run this executable on computers which you have explict permission to do so on.DO NOT test this by running it on yourself! Use Sandboxie, or a virtual machine!\" (Indicator: \"sandboxie\")\n \"\\r\\n\\r\\nThis is the file you run on other computers. When another computer runs this file, they will connect to you. Please only run this executable on computers which you have explict permission to do so on.\\r\\n\\r\\nDO NOT test this by running it on yourself! Use Sandboxie, or a virtual machine!\" (Indicator: \"sandboxie\")\n \"le you run on other computers. When another computer runs this file, they will connect to you. Please only run this executable on computers which you have explict permission to do so on.DO NOT test this by running it on yourself! Use Sandboxie, or a virtual machine!\" (Indicator: \"sandboxie\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/67 reputation engines marked \"http://plasmarat.pw/showthread.php\" as malicious (2% detection rate)\n 2/68 reputation engines marked \"http://plasmarat.pw\" as malicious (2% detection rate)\n 3/58 reputation engines marked \"http://files.plasmarat.pw/cpuminer.files\" as malicious (5% detection rate)\n 1/67 reputation engines marked \"http://files.plasmarat.pw\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 3341312)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 3341312)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"PlasmaRAT.Main::get_StartListening at 8d01a119e2b10b7396a4aba447c8b3c9-600005e-Main~InitializeComponent\n System.Net.Sockets.TcpListener::AcceptTcpClient at 8d01a119e2b10b7396a4aba447c8b3c9-60001ef-Main~Listen\n System.Net.Sockets.TcpListener::EndAcceptSocket at 8d01a119e2b10b7396a4aba447c8b3c9-60001f3-Main~GotInfo\n PlasmaRAT.Main::get_StartListening at 8d01a119e2b10b7396a4aba447c8b3c9-600024d-Main~StartListening_ButtonClick\n System.Net.Sockets.TcpListener::Stop at 8d01a119e2b10b7396a4aba447c8b3c9-6000298-SocketServer~stops\n System.Net.Sockets.TcpListener::Start at 8d01a119e2b10b7396a4aba447c8b3c9-6000299-SocketServer~Start\n System.Net.Sockets.TcpListener::AcceptSocket at 8d01a119e2b10b7396a4aba447c8b3c9-60002a5-SocketServer~PND","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"PlasmaRAT.Main::set_SetKernelObjectSecurity at 8d01a119e2b10b7396a4aba447c8b3c9-600005e-Main~InitializeComponent\n PlasmaRAT.Main::get_SetKernelObjectSecurity at 8d01a119e2b10b7396a4aba447c8b3c9-6000271-Main~Button13_Click","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"3/58 reputation engines marked \"http://files.plasmarat.pw/cpuminer.files\" as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/68 Antivirus vendors marked sample as malicious (61% detection rate)\n 17/34 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/68 Antivirus vendors marked sample as malicious (61% detection rate)\n 17/34 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["miner"],"sandbox_reports":[{"id":"5a3d70ea7ca3e15ac161cbda","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.MSILPerseus","submit_name":"Plasma RAT.exe","analysis_start_time":"2017-12-22T21:56:27+00:00","indicators_count":{"informative":7,"suspicious":14,"malicious":4},"is_in_unified_schema":true},{"id":"5730df04aac2eded296de021","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":28,"submit_name":"Plasma RAT.exe","analysis_start_time":"2016-05-09T21:03:55+00:00","indicators_count":{"informative":4,"suspicious":13,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"}],"processes":[{"pid":2360,"ppid":0,"name":"31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026.exe","command_line":"","normalized_path":"C:\\31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026.exe","uid":"00022963-00002360","icon":"$27"}],"all_imported_dlls":["msvcr80.dll","mswsock.dll","rsaenh.dll","shlwapi.dll","shell32.dll","Microsoft.VisualBasic.ni.dll","System.Windows.Forms.ni.dll","ws2_32.dll","WSHTCPIP.DLL","System.Configuration.ni.dll","oleaut32.dll","msvcrt.dll","sechost.dll","msctf.dll","System.Xml.ni.dll","cryptsp.dll","Culture.dll","WindowsCodecs.dll","dwmapi.dll","advapi32.dll","lpk.dll","System.Runtime.Remoting.ni.dll","System.Windows.Forms.dll","GdiPlus.dll","mscoree.dll","gdi32.dll","imm32.dll","ole32.dll","RpcRtRemote.dll","ntdll.dll","user32.dll","cryptbase.dll","uxtheme.dll","System.ni.dll","nsi.dll","wship6.dll","kernel32.dll","rpcrt4.dll","mscorwks.dll","comctl32.dll","mscoreei.dll","usp10.dll","profapi.dll","mscorlib.ni.dll","mscorjit.dll","System.Drawing.ni.dll","clbcatq.dll","KernelBase.dll","wow64.dll","tzres.dll","wow64win.dll","wow64cpu.dll","mscorrc.dll","sspicli.dll","version.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"C:\\31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026.exe.config","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index256.dat","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\SysWOW64\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"C:\\31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026.exe","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5730df04aac2eded296de021"},{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a3d70ea7ca3e15ac161cbda"}]}]}},"report_ids":{"sandbox_job_ids":["5a3d70ea7ca3e15ac161cbda","5730df04aac2eded296de021"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSILPerseus.Generic Sample 31d41c42dc9b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 31d41c42dc9b…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILPerseus.Generic Sample 31d41c42dc9b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 31d41c42dc9b…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/31d41c42dc9bad6dc8dbcf7c232d690e672ffd9c3c08a7fb5c40766d8a043026"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILPerseus.Generic Sample 31d41c42dc9b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 31d41c42dc9b…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]