24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 3bc78141ff3f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3bc78141ff3f…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b"],"about":{"@type":"SoftwareApplication","name":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","applicationCategory":["peexe","executable"],"identifier":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta9d,Heuristic match: "**big.Int" Heuristic match: "*reflect.name" Heuristic match: "*runtime.name" Heuristic match: "runtime.(*functype).in" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*Func).Name" Heuristic match: "runtime.name.name" Heuristic match: "sync.(*Once).Do" Heuristic match: "unicode.to" Heuristic match: "unicode.To" Heuristic match: "os.(*File).Name" Heuristic match: "os.(*fileStat).Name" Heuristic match: "reflect.name.name" Heuristic match: "reflect.(*funcType).in" Heuristic match: "reflect.(*rtype).Name" Heuristic match: "reflect.(*rtype).In" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.Value.Int" Heuristic match: "reflect.(*structType).In" Heuristic match: "reflect.(*structType).Name" Heuristic match: "reflect.(*funcType).In" Heuristic match: "reflect.(*funcType).Name" Heuristic match: "reflect.(*funcTypeFixed128).In" Heuristic match: "reflect.(*funcTypeFixed128).Name" Heuristic match: "reflect.(*funcTypeFixed16).In" Heuristic match: "reflect.(*funcTypeFixed16).Name" Heuristic match: "reflect.(*funcTypeFixed32).In" Heuristic match: "reflect.(*funcTypeFixed32).Name" Heuristic match: "reflect.(*funcTypeFixed4).In" Heuristic match: "reflect.(*funcTypeFixed4).Name" Heuristic match: "reflect.(*funcTypeFixed64).In" Heuristic match: "reflect.(*funcTypeFixed64).Name" Heuristic match: "reflect.(*funcTypeFixed8).In" Heuristic match: "reflect.(*funcTypeFixed8).Name" Heuristic match: "reflect.(*interfaceType).In" Heuristic match: "reflect.(*interfaceType).Name" Heuristic match: "reflect.(*ptrType).In" Heuristic match: "reflect.(*ptrType).Name" Heuristic match: "reflect.(*sliceType).In" Heuristic match: "reflect.(*sliceType).Name" Pattern match: "type..hash.math/rand.Rand" Pattern match: "type..eq.math/rand.Rand" Pattern match: "type..hash.math/rand.lockedSource" Pattern match: "type..eq.math/rand.lockedSource" Heuristic match: "math/big.(*decimal).at" Pattern match: "type..hash.os/exec.Error" Pattern match: "type..eq.os/exec.Error" Heuristic match: "*big.Int" Heuristic match: "ol table header: span and treap node npages do not matchstack growth not allowed in system calltags don't match (%d vs %+v) %+v %s @%dtransport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697925567626953125Num" Heuristic match: "type..eq.struct { runtime.full runtime.lfstack; runtime.empty runtime.lfstack; runtime.pad0 [64]uint8; runtime.wbufSpans struct { runtime.lock runtime.mutex; runtime.free runtime.mSpanList; runtime.busy runtime.mSpanList }; _ uint32; runtime.bytesMarked ui" Heuristic match: "C:/Go/src/runtime/runtime-gdb.py" Heuristic match: "cmd.exe.com"26:T833,"= helpgc= is not mcount= minutes nalloc= newval= nfreed= pointer stack=[ status #BT_ALL##BT_SIN##ONIDOM##WALLAD#%!Month(, idle: 2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianBalineseBopomofoBugineseCancelIoCherokeeCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNovemberOl_ChikiParseIntPhags_PaQuestionReadFileSQLITEDBSaturdaySecurityTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWMIC.exeWSAIoctl[signal Error: stack=[backupdbboot.inicgocheckcs debugcpudefault:eax ebp ebx ecx edi edx eflags eip esi esp fs gs manifestmapimailmdbackupno anodentds.ditpspimagerunnableruntime.sas7bdatscavengeshutdownsqlitedbstrconv.taskkilltasklistunknown(wsaioctl (forced) blocked= defersc= in use) lockedg= lockedm= m->curg= ms cpu, not in [ runtime= s.limit= s.state= threads= u_a/u_g=%!(EXTRA (MISSING)(unknown), newval=, oldval=-07:00:00244140625: inuse: : status=Accuracy(AuthorityBassa_" (Indicator: "wmic.exe") "= helpgc= is not mcount= minutes nalloc= newval= nfreed= pointer stack=[ status #BT_ALL##BT_SIN##ONIDOM##WALLAD#%!Month(, idle: 2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianBalineseBopomofoBugineseCancelIoCherokeeCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNovemberOl_ChikiParseIntPhags_PaQuestionReadFileSQLITEDBSaturdaySecurityTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWMIC.exeWSAIoctl[signal Error: stack=[backupdbboot.inicgocheckcs debugcpudefault:eax ebp ebx ecx edi edx eflags eip esi esp fs gs manifestmapimailmdbackupno anodentds.ditpspimagerunnableruntime.sas7bdatscavengeshutdownsqlitedbstrconv.taskkilltasklistunknown(wsaioctl (forced) blocked= defersc= in use) lockedg= lockedm= m->curg= ms cpu, not in [ runtime= s.limit= s.state= threads= u_a/u_g=%!(EXTRA (MISSING)(unknown), newval=, oldval=-07:00:00244140625: inuse: : status=Accuracy(AuthorityBassa" (Indicator: "wmic.exe")27:T806,"accdbaccdeaccdraccdtarrayassetblendcasp1casp2casp3chdirclassclosedazipfalsefaultforgefunc(gcinghttpsibankimap2imap3imapsint16int32int64monthmpqgentldrntohsnvrampagespanicpop3sqcow2sleepslicesse41sse42ssse3uint8usagewrite (MB) Value addr= base code= ctxt: curg= goid list= m->p= p->m= prev= span=(...) , not /Quiet390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFridayGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLycianLydianMondayRejangSCHED STREETSundaySyriacSystemTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11[ERR] []byte File:arch00backupchan<-configd3dbspdeletedesigndomaindrwdotefenceerbsqlexec: go1.11gophergroupshangupheaderincpaskilledlaccdblayoutlistenmcgamemcmetamddataminutemrwrefobjectpkpasspopcntpsafe3readatremovergss3asecondselectsocketsqlitestringstructsweep syncdbtarbz2telnetuint16uint32uint64vpp_pcwalletwindirycbcra (scan (scan) MB in Value> dying= locks= m->g0= nmsys= s=nil #USRID#(PANIC=, goid=, sys: 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765" "ealloc(unreachableuserenv.dllutoexec.bat [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait=$Recycle.Bin$WINDOWS.~BT%!(BADWIDTH)) p->status=, consumed: , released: -byte limit 152587890625762939453125Bidi_ControlFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLCBqydQWdeXfLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSERIALNUMBERSetEndOfFileSora_SompengSyloti_NagriTransmitFile[INF] Drive _MSpanManualabi mismatchadvapi32.dllbad g statusbad g0 stackbad recoverybootsect.bakcan't happencas64 failedchan receivecontext.TODOdumping heapend tracegc entersyscallexit status framepointergcpacertracehost is downillegal seekinvalid baseinvalid slotiphlpapi.dllkernel32.dllnetapi32.dllno such hostntdetect.compagefile.sysreflect.Copyreleasep: m=runtime: gp=short bufferswapfile.sysvssadmin.exewevtutil.exe MB released MB) workers= called from encrypted... gcscanv"28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791082312681,"unified_at":"2026-10-04T02:51:52.681Z","metadata":{"hashes":{"sha256":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","sha1":"56422e5cc2abe198198003d2c5bf009c8652a983","md5":"aace43af8d0932a7b01c5b8fb71c8199","sha512":"c4fdee4e0041a98eba661b41f521ea393e2cf8a2683d7722ba198bbc5d7620600855a773c849b1a24fb0542a6fdaf478b4e66d2ca709663d5665fac1613de2b3","ssdeep":"49152:HyhKEGeEWYQAsQ36mE4OZYYIqCGA02Ul0UFi28CdNT0BtT:HygEGTRQAsQ36mE4O6rqCb2i28CdNoBN","ssdeep_chunks":["49152:HyhKEGe","49152:yhKEGeE","49152:hKEGeEW","49152:KEGeEWY","49152:EGeEWYQ","49152:GeEWYQA","49152:eEWYQAs","49152:EWYQAsQ","49152:WYQAsQ3","49152:YQAsQ36","49152:QAsQ36m","49152:AsQ36mE","49152:sQ36mE4","49152:Q36mE4O","49152:36mE4OZ","49152:6mE4OZY","49152:mE4OZYY","49152:E4OZYYI","49152:4OZYYIq","49152:OZYYIqC","49152:ZYYIqCG","49152:YYIqCGA","49152:YIqCGA0","49152:IqCGA02","49152:qCGA02U","49152:CGA02Ul","49152:GA02Ul0","49152:A02Ul0U","49152:02Ul0UF","49152:2Ul0UFi","49152:Ul0UFi2","49152:l0UFi28","49152:0UFi28C","49152:UFi28Cd","49152:Fi28CdN","49152:i28CdNT","49152:28CdNT0","49152:8CdNT0B","49152:CdNT0Bt","49152:dNT0BtT","98304:HyhKEGe","98304:yhKEGeE","98304:hKEGeEW","98304:KEGeEWY","98304:EGeEWYQ","98304:GeEWYQA","98304:eEWYQAs","98304:EWYQAsQ","98304:WYQAsQ3","98304:YQAsQ36","98304:QAsQ36m","98304:AsQ36mE","98304:sQ36mE4","98304:Q36mE4O","98304:36mE4OZ","98304:6mE4OZY","98304:mE4OZYY","98304:E4OZYYI","98304:4OZYYIq","98304:OZYYIqC","98304:ZYYIqCG","98304:YYIqCGA","98304:YIqCGA0","98304:IqCGA02","98304:qCGA02U","98304:CGA02Ul","98304:GA02Ul0","98304:A02Ul0U","98304:02Ul0UF","98304:2Ul0UFi","98304:Ul0UFi2","98304:l0UFi28","98304:0UFi28C","98304:UFi28Cd","98304:Fi28CdN","98304:i28CdNT","98304:28CdNT0","98304:8CdNT0B","98304:CdNT0Bt","98304:dNT0BtT","49152:HygEGTR","49152:ygEGTRQ","49152:gEGTRQA","49152:EGTRQAs","49152:GTRQAsQ","49152:TRQAsQ3","49152:RQAsQ36","49152:36mE4O6","49152:6mE4O6r","49152:mE4O6rq","49152:E4O6rqC","49152:4O6rqCb","49152:O6rqCb2","49152:6rqCb2i","49152:rqCb2i2","49152:qCb2i28","49152:Cb2i28C","49152:b2i28Cd","49152:2i28CdN","49152:i28CdNo","49152:28CdNoB","49152:8CdNoBN"],"imphash":"1c2a6fbef41572f4c9ce8acb5a63cde7"},"file_info":{"file_name":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2855424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1557772729000,"last_seen":1689271970000,"last_multi_scan":1689271970000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","ransomware","robbinhood","robinhoodransomware","scrinject","targetedcrimeware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":10,"suspicious_count":9,"malicious_count":5,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.RobinhoodRansom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.RobinHood.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Robbinhood-6972549-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.RobbinHood (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"WinGo/Filecoder.RobbinHood.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/RobbinHood.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0054cedd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Robin.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ran-RobinHood!AACE43AF8D09","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Robin.fpgxwf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FJL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Robin.2855424","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.EC262A71","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.EC262A71","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Ransom.HFNL-0239","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom.BLD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Robin","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Robin.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA HTTP Host header invalid\" (SID: 2221028, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c net use * /DELETE /Y\" on 2019-5-13.18:39:36.583","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c net use * /DELETE /Y\" (UID: 00276728-00001032)\n Spawned process \"net.exe\" with commandline \"net use * /DELETE /Y\" (UID: 00276730-00001528)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c net use * /DELETE /Y\" (UID: 00276728-00001032)\n Spawned process \"net.exe\" with commandline \"net use * /DELETE /Y\" (UID: 00276730-00001528)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\WSHTCPIP.DLL\"\n \".exe\" touched file \"%WINDIR%\\System32\\wship6.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\wshqos.dll\"\n \".exe\" touched file \"%WINDIR%\\temp\\pub.key\"\n \".exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"/19\n /32\n /46\n /63\n /99\n /112\n /124 with unusual entropies 7.994649157\n 7.96970395772\n 7.90307419367\n 7.97822300752\n 7.99765042914\n 7.9912016064\n 7.90812840046","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00276605-00000228-16852-141-004492E0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00276605-00000228-16852-521-004018E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\net.exe\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\net.exe\" (Handle: 80)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\net.exe\" (Handle: 80)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$26","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n LoadLibraryA\n GetProcAddress\n CreateThread\n WriteFile\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c04e307720543177e0653177b53832770000000000d0c97500000000c5eac9750000000088eac97500000000e968337582283277ee29327700000000d2693375000000007dbbc9750000000009be337500000000ba18c97500000000\" to virtual address \"0x760F1000\" (part of module \"NSI.DLL\")\n \"net.exe\" wrote bytes \"c04e307720543177e0653177b53832770000000000d0c97500000000c5eac9750000000088eac97500000000e968337582283277ee29327700000000d2693375000000007dbbc9750000000009be337500000000ba18c97500000000\" to virtual address \"0x760F1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"775390625: missing method DnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWKilling response:LookupAccountSidWOld_North_ArabianOld_South_ArabianOther_ID_ContinueRegLoadMUIStringWSentence_TerminalUnified_IdeographWSAEnumProtocolsWbad TinySizeClassentersyscallblockexec format errorexec: not startedfractional secondgp.waiting != nilignoreallfailuresinteger too largeinvalid bit size locked m0 woke upmark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime.panicwrapruntime: nameOff runtime: next_gc=runtime: pointer runtime: textOff runtime: typeOff scanobject n == 0select (no cases)settingcontent-msstack: frame={sp:thread exhaustionunknown caller pcwait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b.bin\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/37 Antivirus vendors marked sample as malicious (54% detection rate)\n 49/73 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/37 Antivirus vendors marked sample as malicious (54% detection rate)\n 49/73 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"$27","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\".exe\" touched \"K:\\\"\n \".exe\" touched \"L:\\\"\n \".exe\" touched \"M:\\\"\n \".exe\" touched \"N:\\\"\n \".exe\" touched \"O:\\\"\n \".exe\" touched \"P:\\\"\n \".exe\" touched \"Q:\\\"\n \".exe\" touched \"R:\\\"\n \".exe\" touched \"S:\\\"\n \".exe\" touched \"T:\\\"\n \".exe\" touched \"U:\\\"\n \".exe\" touched \"V:\\\"\n \".exe\" touched \"W:\\\"\n \".exe\" touched \"X:\\\"\n \".exe\" touched \"Y:\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a Wine emulator related string"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","ransomware","robbinhood","robinhoodransomware","scrinject","targetedcrimeware"],"sandbox_reports":[{"id":"5cd9b9b40288381b7d0c7c8f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","analysis_start_time":"2019-05-13T18:38:23+00:00","indicators_count":{"informative":10,"suspicious":14,"malicious":6},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}],"processes":[{"pid":228,"ppid":0,"name":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b.exe","command_line":"","sha256":"3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b","normalized_path":"C:\\3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b.exe","uid":"00276605-00000228","icon":"$28"},{"pid":1032,"ppid":228,"name":"cmd.exe","command_line":"/c net use * /DELETE /Y","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00276605-00000228","uid":"00276728-00001032"},{"pid":1528,"ppid":1032,"name":"net.exe","command_line":"net use * /DELETE /Y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00276728-00001032","uid":"00276730-00001528"}],"all_imported_dlls":["netmsg.dll","usp10.dll","sechost.dll","ntlanman.dll","lpk.dll","advapi32.dll","wship6.dll","msvcrt.dll","netutils.dll","browcli.dll","srvcli.dll","winnsi.dll","drprov.dll","davhlpr.dll","KernelBase.dll","gdi32.dll","ws2_32.dll","rpcrt4.dll","imm32.dll","winbrand.dll","winsta.dll","ntdll.dll","nsi.dll","wkscli.dll","mpr.dll","IPHLPAPI.DLL","kernel32.dll","user32.dll","msctf.dll","WSHTCPIP.DLL","wshqos.dll","ole32.dll","apphelp.dll","winmm.dll","cryptbase.dll","samcli.dll","davclnt.dll","cscapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\System32\\WSHTCPIP.DLL","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"path":"%WINDIR%\\System32\\wship6.dll","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"path":"%WINDIR%\\temp\\pub.key","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5cd9b9b40288381b7d0c7c8f"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5cd9b9b40288381b7d0c7c8f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 3bc78141ff3f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3bc78141ff3f…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 3bc78141ff3f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3bc78141ff3f…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 3bc78141ff3f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3bc78141ff3f…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]