24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 32ac6c7faee6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 32ac6c7faee6…. Malware family: Trojan.Generic. Threat score 100/100. 21/24 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9ef,"Rectangle" (Indicator: "Rectangle") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "get_ExecutablePath" (Indicator: "Executable") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetCurrentProcess" (Indicator: "GetCurrentProcess") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetForegroundWindow" (Indicator: "GetForegroundWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetWindowText" (Indicator: "GetWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetWindowTextA" (Indicator: "GetWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetWindowTextLength" (Indicator: "GetWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetWindowTextLengthA" (Indicator: "GetWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "SetWindowPos" (Indicator: "SetWindowPos") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetAsyncKeyState" (Indicator: "GetAsyncKeyState") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetKeyboardLayout" (Indicator: "GetKeyboardLayout") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetKeyboardState" (Indicator: "GetKeyboardState") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetWindowThreadProcessId" (Indicator: "GetWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "ToUnicodeEx" (Indicator: "ToUnicodeEx") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "EnableWindow" (Indicator: "EnableWindow") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "GetClassNameA" (Indicator: "GetClassNameA") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "SendMessageA" (Indicator: "SendMessageA") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "EnumChildWindows" (Indicator: "EnumChildWindows") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "set CDAudio door open" (Indicator: "open") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin "sendmusicplay" (Indicator: "send") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin26:T565,".exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") ".exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") ".exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") ".exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") ".exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") ".exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCHANDLER") "netsh.exe" touched "Nap Config Read class" (Path: "HKCU\CLSID\{EA4A0A43-1C8F-4C7B-A4B1-28ECBD96BA8C}") "netsh.exe" touched "Quarantine Agent Management class" (Path: "HKCU\CLSID\{EB082BA1-DF8A-46BE-82F3-35BF9E9BE52F}") "netsh.exe" touched "HNetCfg.FwMgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}") "netsh.exe" touched "HNetCfg.FwAuthorizedApplication" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TREATAS")27:T41f,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aa40237a7fcd4c64b196f4bf74d29c3.exe"28:T86b,".exe" wrote bytes "d0551876647321760000000051c1257794982577ee9c257775dc2777273e27770fb32b7700000000acdc9b771bf79b77c1089d77c0d99b77152e9b7736da9b77d5d99b7730c69b77e0c29b7742c69b771bc69b7786c49b7772c69b7700000000" to virtual address "0x74711000" (part of module "SHFOLDER.DLL") ".exe" wrote bytes "4ac5e534" to virtual address "0x692E1FFC" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "db4d097300000000" to virtual address "0x00A62000" (part of module "32AC6C7FAEE6EE709F1AC4EAC2254C171C683A1911495101CAA91012F790A287.EXE") ".exe" wrote bytes "c04ed5772054d677e065d677b538d7770000000000d09b7700000000c5ea9b770000000088ea9b7700000000e968ed758228d777ee29d77700000000d269ed75000000007dbb9b770000000009beed7500000000ba189b7700000000" to virtual address "0x76F91000" (part of module "NSI.DLL") ".exe" wrote bytes "fae6d277e1a6d7772e71d777ee29d77785e2d2776da0d77726e4d277d16dd777003dd577804bd57700000000ad3730778b2d3077b641307700000000" to virtual address "0x75091000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "e739d377e1a6d7772e71d777ee29d77785e2d2776da0d7779064d6773ad5dd7726e4d277d16dd777003dd577804bd57700000000ad3730778b2d3077b641307700000000" to virtual address "0x755E1000" (part of module "WSHIP6.DLL") "netsh.exe" wrote bytes "c04ed5772054d677e065d677b538d7770000000000d09b7700000000c5ea9b770000000088ea9b7700000000e968ed758228d777ee29d77700000000d269ed75000000007dbb9b770000000009beed7500000000ba189b7700000000" to virtual address "0x76F91000" (part of module "NSI.DLL") ".exe" wrote bytes "d0551876647321760000000051c1257794982577ee9c257775dc2777273e27770fb32b7700000000acdc9b771bf79b77c1089d77c0d99b77152e9b7736da9b77d5d99b7730c69b77e0c29b7742c69b771bc69b7786c49b7772c69b7700000000" to virtual address "0x74101000" (part of module "SHFOLDER.DLL") ".exe" wrote bytes "db4d117400000000" to virtual address "0x013C2000" (part of module "32AC6C7FAEE6EE709F1AC4EAC2254C171C683A1911495101CAA91012F790A287.EXE") ".exe" wrote bytes "6ca3b3ca" to virtual address "0x68D31FFC" (part of module "MSCORWKS.DLL")29:T146b,YARA signature "njrat1" classified file "32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin" as "rat,njrat" based on indicators: "6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5b005400410050005d00,2000260020006500780069007400,6d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c002000" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin" as "rat,njrat" based on indicators: "MZ,FromBase64String,Base64String,DeleteSubKey,get_MachineName,get_UserName,get_LastWriteTime,GetVolumeInformation,OSFullName,Send,DownloadData,6e00650074007300680020006600690072006500770061006c006c00,63006d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c00" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin" as "njrat,rat" based on indicators: "5b005400410050005d00,5b0045004e005400450052005d00,790079002d004d004d002d0064006400,7c0027007c0027007c,2000260020006500780069007400" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "4aa40237a7fcd4c64b196f4bf74d29c3.exe.bin" as "rat,njrat" based on indicators: "6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5b005400410050005d00,2000260020006500780069007400,6d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c002000" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "4aa40237a7fcd4c64b196f4bf74d29c3.exe.bin" as "rat,njrat" based on indicators: "MZ,FromBase64String,Base64String,DeleteSubKey,get_MachineName,get_UserName,get_LastWriteTime,GetVolumeInformation,OSFullName,Send,DownloadData,6e00650074007300680020006600690072006500770061006c006c00,63006d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c00" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "4aa40237a7fcd4c64b196f4bf74d29c3.exe.bin" as "njrat,rat" based on indicators: "5b005400410050005d00,5b0045004e005400450052005d00,790079002d004d004d002d0064006400,7c0027007c0027007c,2000260020006500780069007400" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe.bin" as "rat,njrat" based on indicators: "6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5b005400410050005d00,2000260020006500780069007400,6d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c002000" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe.bin" as "rat,njrat" based on indicators: "MZ,FromBase64String,Base64String,DeleteSubKey,get_MachineName,get_UserName,get_LastWriteTime,GetVolumeInformation,OSFullName,Send,DownloadData,6e00650074007300680020006600690072006500770061006c006c00,63006d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c00" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe.bin" as "njrat,rat" based on indicators: "5b005400410050005d00,5b0045004e005400450052005d00,790079002d004d004d002d0064006400,7c0027007c0027007c,2000260020006500780069007400" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "4aa40237a7fcd4c64b196f4bf74d29c3.exe" as "rat,njrat" based on indicators: "6e00650074007300680020006600690072006500770061006c006c002000610064006400200061006c006c006f00770065006400700072006f006700720061006d002000,5b005400410050005d00,2000260020006500780069007400,6d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c002000" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "4aa40237a7fcd4c64b196f4bf74d29c3.exe" as "rat,njrat" based on indicators: "MZ,FromBase64String,Base64String,DeleteSubKey,get_MachineName,get_UserName,get_LastWriteTime,GetVolumeInformation,OSFullName,Send,DownloadData,6e00650074007300680020006600690072006500770061006c006c00,63006d0064002e0065007800650020002f006b002000700069006e00670020003000200026002000640065006c00" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "4aa40237a7fcd4c64b196f4bf74d29c3.exe" as "njrat,rat" based on indicators: "5b005400410050005d00,5b0045004e005400450052005d00,790079002d004d004d002d0064006400,7c0027007c0027007c,2000260020006500780069007400" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "all.bstring" as "rat,njrat" based on indicators: "netsh firewall add allowedprogram ,[TAP], & exit,md.exe /k ping 0 & del " (Author: Brian Wallace @botnet_hunter)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791035262598,"unified_at":"2026-10-03T13:47:42.598Z","metadata":{"hashes":{"sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","sha1":"711435121960f811fdf9d98de058bb8e6aa0bf0c","md5":"bf68ea3c0edd59a4238c9789ba1b4996","sha512":"13572acd926199b1d63272ea519f3c818ac1e78f43787fe31bc883497b25fafc51fbae54165c703bfdc54dc2263297abfb132bbceb4cefdd133420755c458a29","ssdeep":"384:w+SvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXD:VS7TZ38fvCv3E1c1rM+rMRa8Nuy0t","ssdeep_chunks":["384:w+SvEiT","384:+SvEiTb","384:SvEiTbT","384:vEiTbTv","384:EiTbTvp","384:iTbTvpW","384:TbTvpWN","384:bTvpWNc","384:TvpWNcZ","384:vpWNcZ0","384:pWNcZ0y","384:WNcZ0y8","384:NcZ0y8f","384:cZ0y8fv","384:Z0y8fvC","384:0y8fvCv","384:y8fvCv3","384:8fvCv3v","384:fvCv3v3","384:vCv3v3c","384:Cv3v3cL","384:v3v3cLk","384:3v3cLka","384:v3cLkac","384:3cLkacp","384:cLkacpj","384:Lkacpjr","384:kacpjrA","384:acpjrAF","384:cpjrAF+","384:pjrAF+r","384:jrAF+rM","384:rAF+rMR","384:AF+rMRT","384:F+rMRTy","384:+rMRTyN","384:rMRTyN/","384:MRTyN/0","384:RTyN/0L","384:TyN/0L+","384:yN/0L+E","384:N/0L+Ec","384:/0L+Eco","384:0L+Ecoi","384:L+Ecoin","384:+Ecoinb","384:Ecoinbl","384:coinbln","384:oinblne","384:inblneH","384:nblneHQ","384:blneHQM","384:lneHQM3","384:neHQM3e","384:eHQM3ep","384:HQM3epz","384:QM3epzX","384:M3epzXD","768:w+SvEiT","768:+SvEiTb","768:SvEiTbT","768:vEiTbTv","768:EiTbTvp","768:iTbTvpW","768:TbTvpWN","768:bTvpWNc","768:TvpWNcZ","768:vpWNcZ0","768:pWNcZ0y","768:WNcZ0y8","768:NcZ0y8f","768:cZ0y8fv","768:Z0y8fvC","768:0y8fvCv","768:y8fvCv3","768:8fvCv3v","768:fvCv3v3","768:vCv3v3c","768:Cv3v3cL","768:v3v3cLk","768:3v3cLka","768:v3cLkac","768:3cLkacp","768:cLkacpj","768:Lkacpjr","768:kacpjrA","768:acpjrAF","768:cpjrAF+","768:pjrAF+r","768:jrAF+rM","768:rAF+rMR","768:AF+rMRT","768:F+rMRTy","768:+rMRTyN","768:rMRTyN/","768:MRTyN/0","768:RTyN/0L","768:TyN/0L+","768:yN/0L+E","768:N/0L+Ec","768:/0L+Eco","768:0L+Ecoi","768:L+Ecoin","768:+Ecoinb","768:Ecoinbl","768:coinbln","768:oinblne","768:inblneH","768:nblneHQ","768:blneHQM","768:lneHQM3","768:neHQM3e","768:eHQM3ep","768:HQM3epz","768:QM3epzX","768:M3epzXD","384:VS7TZ38","384:S7TZ38f","384:7TZ38fv","384:TZ38fvC","384:Z38fvCv","384:38fvCv3","384:8fvCv3E","384:fvCv3E1","384:vCv3E1c","384:Cv3E1c1","384:v3E1c1r","384:3E1c1rM","384:E1c1rM+","384:1c1rM+r","384:c1rM+rM","384:1rM+rMR","384:rM+rMRa","384:M+rMRa8","384:+rMRa8N","384:rMRa8Nu","384:MRa8Nuy","384:Ra8Nuy0","384:a8Nuy0t"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":37888,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1654500469000,"last_seen":1738198813000,"last_multi_scan":1738198813000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ahmythspy","asyncrat","commodity","criminal","metasploit","modular","opensource","quasar","rat","targeted","njrat"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":22,"suspicious_count":14,"malicious_count":11,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Korat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.Bladabindi.as","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/ATRAPS.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.MSIL.Krypt.44","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Bladabindi-7994427-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.MSIL.Spy.Agent.CP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Worm.Bladabindi (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Bladabindi.AR worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FIGN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Autoruner2.ebrjyu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Bbindi-W","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.DN-NjRat.37888.AE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.AP.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoader21.BPQW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Bladabindi.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_38.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Bladabindi.Win32.72266","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Observed GetAsyncKeyState/GetKeyState API string"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerates all mounted drives"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"malicious","value":"Contains ability to capture the screen"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"System.IO.Directory::GetLogicalDrives at bf68ea3c0edd59a4238c9789ba1b4996-6000031-OK~INS","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-1091242\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-13501038\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-17281906\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-9708812658711169\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-9708812666205863\n \".exe\" queries volume information of \"C:\\\" at 00000000-00002276-0000010C-37262433","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-1091242\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-13501038\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-17281906\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-9708812658711169\n \".exe\" queries volume information of \"C:\\\" at 00000000-00003480-0000010C-9708812666205863\n \".exe\" queries volume information of \"C:\\\" at 00000000-00002276-0000010C-37262433","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"6.tcp.eu.ngrok.io\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"3.69.115.178:15553\"\n \"3.69.157.220:15553\"\n \"18.197.239.109:15553\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"4aa40237a7fcd4c64b196f4bf74d29c3\"\n \"\\Sessions\\1\\BaseNamedObjects\\4aa40237a7fcd4c64b196f4bf74d29c3\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7\"\n \"Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$25","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 687E0000\n \".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 68230000\n \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 687E0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Observed GetAsyncKeyState/GetKeyState API string","description":"\"GetAsyncKeyState\" observed api string which can \"provides the ability to retrieve keys pressed\" (Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin\"","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00000000-00002276) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \".exe\" (UID: 00000000-00002276) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2 ...\" (UID: 00000000-00000924), Spawned process \".exe\" with commandline \"..\" (UID: 00000000-00002276), Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2 ...\" (UID: 00000000-00004056)\n Spawned process \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" (UID: 00000000-00002220)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2 ...\" (UID: 00000000-00000924), Spawned process \".exe\" with commandline \"..\" (UID: 00000000-00002276), Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2 ...\" (UID: 00000000-00004056)\n Spawned process \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" (UID: 00000000-00002220)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"netsh.exe\" connecting to \"\\ThemeApiPort\"\n \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\4aa40237a7fcd4c64b196f4bf74d29c3.exe]- [targetUID: 00000000-00003480]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE\" (UID: 00000000-00000924)\n Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE\" (UID: 00000000-00004056)","origin":"Monitored Target","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"6.tcp.eu.ngrok.io\"- [Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin]\n Pattern match: \"https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0\"- [Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin]","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0\" (Indicator: \"https://\") in Source: 32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\SHAS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\QECS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\UI\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"\n \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"netsh.exe\" at 00000000-00000924-00000105-2052927\n \".exe\" at 00000000-00002276-00000105-37339649\n \"netsh.exe\" at 00000000-00004056-00000105-1299261","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00003480-00000105-24069091\n \".exe\" queried SystemProcessInformation at 00000000-00003480-00000105-24070097\n \".exe\" queried SystemProcessInformation at 00000000-00003480-00000105-24073545","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"w.OK::apiBlockInput at bf68ea3c0edd59a4238c9789ba1b4996-600002f-OK~Ind","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights\n \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 3964) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"6/93 reputation engines marked \"https://dl.dropbox.com/s/p84aaz28t0hepul/pass.exe\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/68 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\4aa40237a7fcd4c64b196f4bf74d29c3.exe]- [targetUID: 00000000-00003480]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"4AA40237A7FCD4C64B196F4BF74D29C3\"; Value: \"\"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"4AA40237A7FCD4C64B196F4BF74D29C3\"; Value: \"\"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Net.Sockets.TcpClient::Close at bf68ea3c0edd59a4238c9789ba1b4996-6000020-OK~connect\n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet at bf68ea3c0edd59a4238c9789ba1b4996-600002f-OK~Ind\n System.Net.Sockets.TcpClient::get_Available at bf68ea3c0edd59a4238c9789ba1b4996-6000037-OK~RC\n System.Net.Sockets.TcpClient::get_Client at bf68ea3c0edd59a4238c9789ba1b4996-600003a-OK~Sendb","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"w.kl::GetKeyboardState at bf68ea3c0edd59a4238c9789ba1b4996-6000047-kl~VKCodeToUnicode\n w.kl::GetAsyncKeyState at bf68ea3c0edd59a4238c9789ba1b4996-6000048-kl~WRK","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/68 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"58/68 Antivirus vendors marked dropped file \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe.bin\" as malicious (classified as \"MSIL:Bladabindi\" with 85% detection rate)\n 58/68 Antivirus vendors marked dropped file \"4aa40237a7fcd4c64b196f4bf74d29c3.exe.bin\" as malicious (classified as \"MSIL:Bladabindi\" with 85% detection rate)\n 58/68 Antivirus vendors marked dropped file \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" as malicious (classified as \"MSIL:Bladabindi\" with 85% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"58/68 Antivirus vendors marked spawned process \".exe\" (PID: 2276) as malicious (classified as \"MSIL:Bladabindi\" with 85% detection rate)\n 58/68 Antivirus vendors marked spawned process \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" (PID: 2220) as malicious (classified as \"MSIL:Bladabindi\" with 85% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 408)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 408)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 408)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 3.69.115.178 on port 15553\n TCP traffic to 3.69.157.220 on port 15553\n TCP traffic to 18.197.239.109 on port 15553","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$29","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture the screen","description":"System.Drawing.Graphics::CopyFromScreen at bf68ea3c0edd59a4238c9789ba1b4996-600002f-OK~Ind","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":3,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE\" (UID: 00000000-00000924)\n Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE\" (UID: 00000000-00004056)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00003480)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE\" (UID: 00000000-00000924)\n Spawned process \".exe\" with commandline \"..\" (UID: 00000000-00002276)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE\" (UID: 00000000-00004056)\n Spawned process \"4aa40237a7fcd4c64b196f4bf74d29c3.exe\" (UID: 00000000-00002220)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":147,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ahmythspy","asyncrat","commodity","criminal","metasploit","modular","opensource","quasar","rat","targeted","njrat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"62b1f4ae2eb8007df9231632","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL:Bladabindi","contacted_countries":["USA"],"submit_name":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","analysis_start_time":"2022-06-21T16:41:19+00:00","indicators_count":{"informative":22,"suspicious":17,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"3.69.115.178","port":15553,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"address":"3.69.157.220","port":15553,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"address":"18.197.239.109","port":15553,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"dns_resolutions":[{"domain":"6.tcp.eu.ngrok.io","address":"18.197.239.109","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}],"processes":[{"pid":3480,"ppid":0,"name":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe","command_line":"","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","normalized_path":"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe","uid":"00000000-00003480","icon":"$2a"},{"pid":924,"ppid":3480,"name":"netsh.exe","command_line":"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00003480","uid":"00000000-00000924"},{"pid":2276,"ppid":0,"name":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe","command_line":"..","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","normalized_path":"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe","uid":"00000000-00002276","icon":"$2b"},{"pid":4056,"ppid":2276,"name":"netsh.exe","command_line":"netsh firewall add allowedprogram \"C:\\32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" \"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe\" ENABLE","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00002276","uid":"00000000-00004056"},{"pid":2220,"ppid":0,"name":"4aa40237a7fcd4c64b196f4bf74d29c3.exe","command_line":"","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\4aa40237a7fcd4c64b196f4bf74d29c3.exe","uid":"00000000-00002220","icon":"$2c"}],"all_imported_dlls":["wwapi.dll","gpapi.dll","setupapi.dll","whhelper.dll","version.dll","System.Drawing.ni.dll","oleaut32.dll","odbc32.dll","sechost.dll","hnetmon.dll","nettrace.dll","wlanutil.dll","nsi.dll","user32.dll","wbemprox.dll","odbcint.dll","authfwcfg.dll","msvcr80.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","nshhttp.dll","cfgmgr32.dll","mprapi.dll","Wldap32.dll","nshipsec.dll","wbemcomn.dll","wbemsvc.dll","dhcpcsvc.dll","devobj.dll","rpcrt4.dll","shlwapi.dll","rasadhlp.dll","sspicli.dll","rasmontr.dll","wlanapi.dll","netutils.dll","logoncli.dll","PeerDistSh.dll","httpapi.dll","certcli.dll","mswsock.dll","QUTIL.DLL","WcnNetsh.dll","dnsapi.dll","shfolder.dll","wmiutils.dll","dhcpcmonitor.dll","srvcli.dll","mscorwks.dll","mscorlib.ni.dll","wdi.dll","tdh.dll","ntdsapi.dll","rpcnsh.dll","wlancfg.dll","adsldpc.dll","msasn1.dll","winhttp.dll","webio.dll","bcrypt.dll","ws2_32.dll","Microsoft.VisualBasic.ni.dll","lpk.dll","msctf.dll","rpcss.dll","gdi32.dll","profapi.dll","nshwfp.dll","dot3cfg.dll","atl.dll","wwancfg.dll","psapi.dll","FirewallAPI.dll","activeds.dll","fltLib.dll","cryptbase.dll","comctl32.dll","ws2help.dll","mscoree.dll","eappprxy.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","onex.dll","mscoreei.dll","RpcRtRemote.dll","clbcatq.dll","slc.dll","devrtl.dll","p2pcollab.dll","ntdll.dll","kernel32.dll","winipsec.dll","netapi32.dll","wkscli.dll","msvcrt.dll","imm32.dll","winnsi.dll","msvfw32.dll","rasapi32.dll","fwcfg.dll","bcryptprimitives.dll","credui.dll","mfc42u.dll","nci.dll","P2P.dll","NAPMONTR.DLL","cryptsp.dll","avicap32.dll","ifmon.dll","fastprox.dll","ndfapi.dll","uxtheme.dll","System.ni.dll","FWPUCLNT.DLL","polstore.dll","System.Windows.Forms.ni.dll","ole32.dll","System.Xml.ni.dll","winmm.dll","rasman.dll","DHCPQEC.DLL","wshelper.dll","KernelBase.dll","advapi32.dll","rsaenh.dll","WMINet_Utils.dll","netshell.dll","QAGENT.DLL","eappcfg.dll","wship6.dll","p2pnetsh.dll","shell32.dll","System.Configuration.ni.dll","netiohlp.dll","dot3api.dll","wlanhlp.dll","mscorjit.dll","tzres.dll","IPHLPAPI.DLL","mpr.dll","secur32.dll","userenv.dll","apphelp.dll","System.Management.ni.dll","crypt32.dll","wevtapi.dll","nlaapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"4aa40237a7fcd4c64b196f4bf74d29c3.exe","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287.exe.bin","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"4aa40237a7fcd4c64b196f4bf74d29c3.exe.bin","sha256":"32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"4aa40237a7fcd4c64b196f4bf74d29c3","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\4aa40237a7fcd4c64b196f4bf74d29c3","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"62b1f4ae2eb8007df9231632"}]}]}},"report_ids":{"sandbox_job_ids":["62b1f4ae2eb8007df9231632"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 32ac6c7faee6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 32ac6c7faee6…. Malware family: Trojan.Generic. Threat score 100/100. 21/24 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 32ac6c7faee6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 32ac6c7faee6…. Malware family: Trojan.Generic. Threat score 100/100. 21/24 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 32ac6c7faee6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 32ac6c7faee6…. Malware family: Trojan.Generic. Threat score 100/100. 21/24 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]