24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 44884565800e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 44884565800e…. Malware family: Trojan.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50"],"about":{"@type":"SoftwareApplication","name":"mySingleMessenger.exe","applicationCategory":["peexe","executable"],"identifier":"44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e1,GetLocalTime@KERNEL32.dll at 38099-498-0040AB90 GetSystemTime@KERNEL32.dll at 38099-523-0040A2B0 GetSystemTime@KERNEL32.dll at 38099-583-0040BDBA GetLocalTime@KERNEL32.dll at 38099-522-0040A9B0 GetLocalTime@KERNEL32.dll at 38099-521-0040AAD0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-53237-77-0040AB90 GetLocalTime@KERNEL32.DLL at 00010542-00003844-53237-101-0040A9B0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-53237-100-0040AAD0 GetSystemTime@KERNEL32.DLL at 00010542-00003844-53237-102-0040A2B0 GetSystemTime@KERNEL32.DLL at 00010542-00003844-53237-162-0040BDBA GetLocalTime@KERNEL32.DLL at 00010542-00003844-53237-246-004062B0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-53237-275-004065F0 GetSystemTime@KERNEL32.DLL at 00010542-00003844-61140-102-0040A2B0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-61140-100-0040AAD0 GetSystemTime@KERNEL32.DLL at 00010542-00003844-61140-162-0040BDBA GetLocalTime@KERNEL32.DLL at 00010542-00003844-61140-77-0040AB90 GetLocalTime@KERNEL32.DLL at 00010542-00003844-61140-101-0040A9B0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-61140-246-004062B0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-61140-275-004065F0 GetLocalTime@KERNEL32.DLL at 00010542-00003844-65-101-0040A9B026:T151c,Found API call GetSystemTime@KERNEL32.dll (Target: "mySingleMessenger.exe.bin", Stream UID: "38099-583-0040BDBA") which is directly followed by "cmp ax, word ptr [0041ABE2h]" and "jne 0040BE1Fh". See related instructions: "... +23 call dword ptr [00414064h] ;GetSystemTime +29 mov ax, word ptr [ebp-16h] +33 cmp ax, word ptr [0041ABE2h] +40 jne 0040BE1Fh" ... at 38099-583-0040BDBA Found API call GetSystemTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-53237-162-0040BDBA") which is directly followed by "cmp ax, word ptr [0041ABE2h]" and "jne 0040BE1Fh". See related instructions: "... +23 call dword ptr [00414064h] ;GetSystemTime +29 mov ax, word ptr [ebp-16h] +33 cmp ax, word ptr [0041ABE2h] +40 jne 0040BE1Fh" ... at 00010542-00003844-53237-162-0040BDBA Found API call GetLocalTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-53237-246-004062B0") which is directly followed by "cmp edx, ecx" and "jnle 004064AEh". See related instructions: "... +425 lea ecx, dword ptr [esp+10h] +429 push ecx +430 call dword ptr [00419CF8h] ;GetLocalTime +436 mov eax, dword ptr [esp+18h] +440 and eax, 0000FFFFh +445 lea eax, dword ptr [eax+eax*2] +448 lea edx, dword ptr [eax+eax*4] +451 mov eax, dword ptr [esp+1Ah] +455 and eax, 0000FFFFh +460 lea ecx, dword ptr [eax+edx*4] +463 mov eax, dword ptr [00419D3Ch] +468 lea eax, dword ptr [eax+eax*2] +471 lea edx, dword ptr [eax+eax*4] +474 mov eax, dword ptr [00419F40h] +479 lea edx, dword ptr [eax+edx*4] +482 cmp edx, ecx +484 jnle 004064AEh" ... at 00010542-00003844-53237-246-004062B0 Found API call GetLocalTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-53237-275-004065F0") which is directly followed by "cmp ax, cx" and "jc 00406888h". See related instructions: "... +74 lea ecx, dword ptr [esp+44h] +78 push ecx +79 call dword ptr [00419CF8h] ;GetLocalTime +85 mov ax, word ptr [esp+46h] +90 mov cx, word ptr [00419F44h] +97 cmp ax, cx +100 jc 00406888h" ... at 00010542-00003844-53237-275-004065F0 Found API call GetSystemTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-61140-162-0040BDBA") which is directly followed by "cmp ax, word ptr [0041ABE2h]" and "jne 0040BE1Fh". See related instructions: "... +23 call dword ptr [00414064h] ;GetSystemTime +29 mov ax, word ptr [ebp-16h] +33 cmp ax, word ptr [0041ABE2h] +40 jne 0040BE1Fh" ... at 00010542-00003844-61140-162-0040BDBA Found API call GetLocalTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-61140-246-004062B0") which is directly followed by "cmp edx, ecx" and "jnle 004064AEh". See related instructions: "... +425 lea ecx, dword ptr [esp+10h] +429 push ecx +430 call dword ptr [00419CF8h] ;GetLocalTime +436 mov eax, dword ptr [esp+18h] +440 and eax, 0000FFFFh +445 lea eax, dword ptr [eax+eax*2] +448 lea edx, dword ptr [eax+eax*4] +451 mov eax, dword ptr [esp+1Ah] +455 and eax, 0000FFFFh +460 lea ecx, dword ptr [eax+edx*4] +463 mov eax, dword ptr [00419D3Ch] +468 lea eax, dword ptr [eax+eax*2] +471 lea edx, dword ptr [eax+eax*4] +474 mov eax, dword ptr [00419F40h] +479 lea edx, dword ptr [eax+edx*4] +482 cmp edx, ecx +484 jnle 004064AEh" ... at 00010542-00003844-61140-246-004062B0 Found API call GetLocalTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-61140-275-004065F0") which is directly followed by "cmp ax, cx" and "jc 00406888h". See related instructions: "... +74 lea ecx, dword ptr [esp+44h] +78 push ecx +79 call dword ptr [00419CF8h] ;GetLocalTime +85 mov ax, word ptr [esp+46h] +90 mov cx, word ptr [00419F44h] +97 cmp ax, cx +100 jc 00406888h" ... at 00010542-00003844-61140-275-004065F0 Found API call GetLocalTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-65-275-004065F0") which is directly followed by "cmp ax, cx" and "jc 00406888h". See related instructions: "... +74 lea ecx, dword ptr [esp+44h] +78 push ecx +79 call dword ptr [00419CF8h] ;GetLocalTime +85 mov ax, word ptr [esp+46h] +90 mov cx, word ptr [00419F44h] +97 cmp ax, cx +100 jc 00406888h" ... at 00010542-00003844-65-275-004065F0 Found API call GetSystemTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-65-162-0040BDBA") which is directly followed by "cmp ax, word ptr [0041ABE2h]" and "jne 0040BE1Fh". See related instructions: "... +23 call dword ptr [00414064h] ;GetSystemTime +29 mov ax, word ptr [ebp-16h] +33 cmp ax, word ptr [0041ABE2h] +40 jne 0040BE1Fh" ... at 00010542-00003844-65-162-0040BDBA Found API call GetLocalTime@KERNEL32.DLL (Target: "mySingleMessenger.exe", Stream UID: "00010542-00003844-65-246-004062B0") which is directly followed by "cmp edx, ecx" and "jnle 004064AEh". See related instructions: "... +425 lea ecx, dword ptr [esp+10h] +429 push ecx +430 call dword ptr [00419CF8h] ;GetLocalTime +436 mov eax, dword ptr [esp+18h] +440 and eax, 0000FFFFh +445 lea eax, dword ptr [eax+eax*2] +448 lea edx, dword ptr [eax+eax*4] +451 mov eax, dword ptr [esp+1Ah] +455 and eax, 0000FFFFh +460 lea ecx, dword ptr [eax+edx*4] +463 mov eax, dword ptr [00419D3Ch] +468 lea eax, dword ptr [eax+eax*2] +471 lea edx, dword ptr [eax+eax*4] +474 mov eax, dword ptr [00419F40h] +479 lea edx, dword ptr [eax+edx*4] +482 cmp edx, ecx +484 jnle 004064AEh" ... at 00010542-00003844-65-246-004062B027:T48d,"" loaded module "KERNEL32.DLL" at base 76000000 "" loaded module "IPHLPAPI.DLL" at base 74B60000 "" loaded module "WS2_32.DLL" at base 76230000 "" loaded module "ADVAPI32.DLL" at base 76190000 "" loaded module "OLEAUT32.DLL" at base 760E0000 "" loaded module "C:\WINDOWS\SYSTEM32\MSWSOCK.DLL" at base 74FD0000 "" loaded module "C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL" at base 74950000 "mstsc.exe" loaded module "CRYPTSP.DLL" at base 75010000 "mstsc.exe" loaded module "CREDSSP.DLL" at base 74CB0000 "mstsc.exe" loaded module "DWMAPI.DLL" at base 73FD0000 "mstsc.exe" loaded module "MSTSCAX.DLL" at base 6ABE0000 "mstsc.exe" loaded module "IEFRAME.DLL" at base 72390000 "mstsc.exe" loaded module "ADVAPI32.DLL" at base 76190000 "mstsc.exe" loaded module "OLE32.DLL" at base 75A30000 "mstsc.exe" loaded module "C:\WINDOWS\SYSTEM32\MSCTF.DLL" at base 77170000 "mstsc.exe" loaded module "COMCTL32.DLL" at base 74380000 "mstsc.exe" loaded module "KERNEL32.DLL" at base 76000000 "mstsc.exe" loaded module "C:\WINDOWS\SYSTEM32\EXPLORERFRAME.DLL" at base 717700001b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790349340724,"unified_at":"2026-09-25T15:15:40.724Z","metadata":{"hashes":{"sha256":"44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50","sha1":"9ce9fc9a98dc545a808254a4463f9f0e6f9281f5","md5":"6c0952fd081f50e9f56267f0b16c02ac","sha512":"ac732ab12e0e940ba5e64591c13aeb570ffd661b2ed8caa75c6e79cee1e578c726cca6c066cb95f6d9f195dec623d13959528163238545b3b796236de0f49d01","ssdeep":"1536:G+lo+TAi2fS80ZUwPXPoFmG1HK0ecH2GMYtS1+ngjnj7BQVqXz/F18em:vQiuj0ZUw/PoJzeIfNtS15hrTTzm","ssdeep_chunks":["1536:G+lo+TA","1536:+lo+TAi","1536:lo+TAi2","1536:o+TAi2f","1536:+TAi2fS","1536:TAi2fS8","1536:Ai2fS80","1536:i2fS80Z","1536:2fS80ZU","1536:fS80ZUw","1536:S80ZUwP","1536:80ZUwPX","1536:0ZUwPXP","1536:ZUwPXPo","1536:UwPXPoF","1536:wPXPoFm","1536:PXPoFmG","1536:XPoFmG1","1536:PoFmG1H","1536:oFmG1HK","1536:FmG1HK0","1536:mG1HK0e","1536:G1HK0ec","1536:1HK0ecH","1536:HK0ecH2","1536:K0ecH2G","1536:0ecH2GM","1536:ecH2GMY","1536:cH2GMYt","1536:H2GMYtS","1536:2GMYtS1","1536:GMYtS1+","1536:MYtS1+n","1536:YtS1+ng","1536:tS1+ngj","1536:S1+ngjn","1536:1+ngjnj","1536:+ngjnj7","1536:ngjnj7B","1536:gjnj7BQ","1536:jnj7BQV","1536:nj7BQVq","1536:j7BQVqX","1536:7BQVqXz","1536:BQVqXz/","1536:QVqXz/F","1536:VqXz/F1","1536:qXz/F18","1536:Xz/F18e","1536:z/F18em","3072:G+lo+TA","3072:+lo+TAi","3072:lo+TAi2","3072:o+TAi2f","3072:+TAi2fS","3072:TAi2fS8","3072:Ai2fS80","3072:i2fS80Z","3072:2fS80ZU","3072:fS80ZUw","3072:S80ZUwP","3072:80ZUwPX","3072:0ZUwPXP","3072:ZUwPXPo","3072:UwPXPoF","3072:wPXPoFm","3072:PXPoFmG","3072:XPoFmG1","3072:PoFmG1H","3072:oFmG1HK","3072:FmG1HK0","3072:mG1HK0e","3072:G1HK0ec","3072:1HK0ecH","3072:HK0ecH2","3072:K0ecH2G","3072:0ecH2GM","3072:ecH2GMY","3072:cH2GMYt","3072:H2GMYtS","3072:2GMYtS1","3072:GMYtS1+","3072:MYtS1+n","3072:YtS1+ng","3072:tS1+ngj","3072:S1+ngjn","3072:1+ngjnj","3072:+ngjnj7","3072:ngjnj7B","3072:gjnj7BQ","3072:jnj7BQV","3072:nj7BQVq","3072:j7BQVqX","3072:7BQVqXz","3072:BQVqXz/","3072:QVqXz/F","3072:VqXz/F1","3072:qXz/F18","3072:Xz/F18e","3072:z/F18em","1536:vQiuj0Z","1536:Qiuj0ZU","1536:iuj0ZUw","1536:uj0ZUw/","1536:j0ZUw/P","1536:0ZUw/Po","1536:ZUw/PoJ","1536:Uw/PoJz","1536:w/PoJze","1536:/PoJzeI","1536:PoJzeIf","1536:oJzeIfN","1536:JzeIfNt","1536:zeIfNtS","1536:eIfNtS1","1536:IfNtS15","1536:fNtS15h","1536:NtS15hr","1536:tS15hrT","1536:S15hrTT","1536:15hrTTz","1536:5hrTTzm"],"imphash":"fba238c84d223a75d43ced713fde9e78"},"file_info":{"file_name":"mySingleMessenger.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":208896,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296650000,"last_seen":1662504693000,"last_multi_scan":1662504693000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":16,"malicious_count":5,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Cryrem.208896","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BPYR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BPYR (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/NukeSped.AJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NukeSped","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.bqva","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXHT-UJ!6C0952FD081F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.dzzfei","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/FakeAV-HFY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.MBT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_DE.F1A005F3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_DE.F1A005F3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"206.248.59.124:443\"\n \"94.199.145.55:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mstsc.exe\" (UID: 00010806-00003904)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"wwwimages2.adobe.com\"\n Pattern match: \"www.paypalobjects.com\"\n Pattern match: \"www.paypal.com\"\n Pattern match: \"www.linkedin.com\"\n Pattern match: \"www.apple.com\"\n Pattern match: \"www.amazon.com\"\n Pattern match: \"www.adobetag.com\"\n Heuristic match: \"windowslive.tt.omtrdc.net\"\n Heuristic match: \"verify.adobe.com\"\n Heuristic match: \"us.bc.yahoo.com\"\n Heuristic match: \"supportprofile.apple.com\"\n Heuristic match: \"support.oracle.com\"\n Heuristic match: \"support.msn.com\"\n Heuristic match: \"startpage.com\"\n Heuristic match: \"sstats.adobe.com\"\n Heuristic match: \"ssl.gstatic.com\"\n Heuristic match: \"ssl.google-analytics.com\"\n Heuristic match: \"srv.main.ebayrtm.com\"\n Heuristic match: \"skydrive.live.com\"\n Heuristic match: \"signin.ebay.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"www.paypalobjects.com\" (Indicator: \"paypal\")\n \"www.paypal.com\" (Indicator: \"paypal\")\n \"www.linkedin.com\" (Indicator: \"linkedin.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserA@ADVAPI32.DLL at 00010542-00003844-61140-244-00403AF0\n CreateProcessAsUserA@ADVAPI32.DLL at 00010542-00003844-65-244-00403AF0","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 12 calls to GetProcAddress@KERNEL32.DLL at 00010542-00003844-53237-239-00401830\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00010542-00003844-61140-239-00401830\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00010542-00003844-65-239-00401830","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 38099-1-0040CB45\n GetVersion@KERNEL32.DLL at 00010542-00003844-53237-1-0040CB45\n GetVersionExA@KERNEL32.DLL at 00010542-00003844-53237-58-0040FAF2\n GetVersionExA@KERNEL32.DLL at 00010542-00003844-53237-274-00404160\n GetVersion@KERNEL32.DLL at 00010542-00003844-61140-1-0040CB45\n GetVersionExA@KERNEL32.DLL at 00010542-00003844-61140-58-0040FAF2\n GetVersionExA@KERNEL32.DLL at 00010542-00003844-61140-274-00404160\n GetVersion@KERNEL32.DLL at 00010542-00003844-65-1-0040CB45\n GetVersionExA@KERNEL32.DLL at 00010542-00003844-65-58-0040FAF2\n GetVersionExA@KERNEL32.DLL at 00010542-00003844-65-274-00404160","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$26","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00010542-00003844-53237-167-00404EC0\n recv@WS2_32.DLL at 00010542-00003844-53237-227-004011A0\n recv@WS2_32.DLL at 00010542-00003844-61140-167-00404EC0\n recv@WS2_32.DLL at 00010542-00003844-61140-227-004011A0\n recv@WS2_32.DLL at 00010542-00003844-65-227-004011A0\n recv@WS2_32.DLL at 00010542-00003844-65-167-00404EC0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"Module32First@KERNEL32.DLL at 00010542-00003844-53237-208-00403810\n Module32First@KERNEL32.DLL at 00010542-00003844-61140-208-00403810\n Module32First@KERNEL32.DLL at 00010542-00003844-65-208-00403810","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n GetTempPathA\n VirtualAlloc\n Sleep\n CreateThread\n WinExec\n CopyFileA\n CreateProcessA\n GetProcAddress\n GetFileSize\n MapViewOfFile\n CreateFileMappingA\n CreateFileA\n WriteFile\n FindNextFileA\n FindFirstFileA\n LoadLibraryA\n GetModuleHandleA\n GetStartupInfoA\n GetCommandLineA\n TerminateProcess\n UnhandledExceptionFilter\n GetModuleFileNameA\n GetVersionExA\n send (Ordinal #19)\n recv (Ordinal #16)\n socket (Ordinal #23)\n connect (Ordinal #4)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/53 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"GetAdaptersInfo@iphlpapi.dll\"\n \"WSACleanup@WS2_32.dll\"\n \"recv@WS2_32.dll\"\n \"setsockopt@WS2_32.dll\"\n \"WSAStartup@WS2_32.dll\"\n \"listen@WS2_32.dll\"\n \"shutdown@WS2_32.dll\"\n \"gethostbyname@WS2_32.dll\"\n \"accept@WS2_32.dll\"\n \"connect@WS2_32.dll\"\n \"closesocket@WS2_32.dll\"\n \"socket@WS2_32.dll\"\n \"htons@WS2_32.dll\"\n \"select@WS2_32.dll\"\n \"send@WS2_32.dll\"\n \"__WSAFDIsSet@WS2_32.dll\"\n \"bind@WS2_32.dll\"\n \"inet_addr@WS2_32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"RegOpenKeyA@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00143421-00004060-774A228D-161078","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@ADVAPI32.DLL at 00140343-00004028-774A228D-167093","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"mstsc.exe\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Documents\\desktop.ini\"\n \"mstsc.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.DLL at 00140343-00004028-774A228D-166813","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00140343-00004028-774A228D-166923","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"mstsc.exe\" (PID: 00004060)\n \"\" wrote 52 bytes to a foreign process \"mstsc.exe\" (PID: 00004060)\n \"\" wrote 4 bytes to a foreign process \"mstsc.exe\" (PID: 00004060)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"mstsc.exe\" touched \"K:\"\n \"mstsc.exe\" touched \"L:\"\n \"mstsc.exe\" touched \"M:\"\n \"mstsc.exe\" touched \"N:\"\n \"mstsc.exe\" touched \"O:\"\n \"mstsc.exe\" touched \"P:\"\n \"mstsc.exe\" touched \"Q:\"\n \"mstsc.exe\" touched \"R:\"\n \"mstsc.exe\" touched \"S:\"\n \"mstsc.exe\" touched \"T:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 20541-208-0040BDBA\n GetTimeZoneInformation@KERNEL32.dll at 20541-132-0040E853","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTime@KERNEL32.dll (Target: \"44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50.exe.bin\"; Stream UID: \"20541-208-0040BDBA\")\n which is directly followed by \"cmp ax, word ptr [0041ABE2h]\" and \"jne 0040BE1Fh\". See related instructions: \"...\n+23 call dword ptr [00414064h] ;GetSystemTime\n+29 mov ax, word ptr [ebp-16h]\n+33 cmp ax, word ptr [0041ABE2h]\n+40 jne 0040BE1Fh\" ... at 20541-208-0040BDBA","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"desktop.ini\" has type \"empty \"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\mstsc.exe\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"mstsc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"mstsc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"mstsc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"mstsc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\mstsc.exe\", Handle: 28)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"ping -n 2 127.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mstsc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/66 Antivirus vendors marked sample as malicious (68% detection rate)\n 23/40 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":108,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":46,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"59ef1ab37ca3e134260d4b93","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Agent","contacted_countries":["GBR","USA"],"submit_name":"44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50","analysis_start_time":"2017-10-24T12:50:04+00:00","indicators_count":{"informative":11,"suspicious":6,"malicious":4},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"56a5a0dc0e316dfa300ef906","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":28,"malware_family":"BScope.Trojan","contacted_countries":["GBR","USA"],"submit_name":"mySingleMessenger.exe","analysis_start_time":"2016-01-24T22:14:22+00:00","indicators_count":{"informative":5,"suspicious":7,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"56a5a0dc0e316dfa300ef904","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":57,"malware_family":"BScope.Trojan","contacted_countries":["GBR","USA"],"submit_name":"mySingleMessenger.exe","analysis_start_time":"2016-01-24T22:13:53+00:00","indicators_count":{"informative":8,"suspicious":11,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"206.248.59.124","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"address":"94.199.145.55","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"}],"processes":[{"pid":3844,"ppid":0,"name":"mySingleMessenger.exe","command_line":"","normalized_path":"","uid":"00010542-00003844","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAACkSURBVFhH7VbLDcAgCHWXrt0VO0ObHjRqEZ8U4UITLw3wPlEgJeI7zuvecSis5t8OUKomScQKPOO4KO9FFhLW6hsXRuDTC7MYMMSBL8kiIPq6UhAIB8KBcCAcCAfcp+E7tf7uA9yg5GqrLiQ9CUSU6lpWF1sGz8lIokbMdLfRADF53ijRqWJJgBu4GzDaLyRuwjlQU4GrCQKt2jZLrSYh0PBJeQBRfd4uplZSJwAAAABJRU5ErkJggg=="},{"pid":3904,"ppid":0,"name":"mstsc.exe","command_line":"","normalized_path":"","uid":"00010806-00003904"}],"all_imported_dlls":["apphelp.dll","IPHLPAPI.DLL","advapi32.dll","lpk.dll","msctf.dll","mswsock.dll","WSHTCPIP.DLL","ntdll.dll","nsi.dll","winnsi.dll","oleaut32.dll","gdi32.dll","kernel32.dll","KernelBase.dll","ws2_32.dll","rpcrt4.dll","usp10.dll","imm32.dll","sechost.dll","ole32.dll","user32.dll","msvcrt.dll","WS2_32.dll","WINTRUST.dll","profapi.dll","SSPICLI.DLL","propsys.dll","USER32.dll","SHLWAPI.dll","MSASN1.dll","MPR.dll","NETAPI32.dll","CRYPTBASE.dll","ntmarta.dll","cscapi.dll","KERNELBASE.dll","uxtheme.dll","dwmapi.dll","USP10.dll","COMCTL32.dll","WINMM.dll","cryptsp.dll","mstscax.dll","explorerframe.dll","ntlanman.dll","IMM32.DLL","credui.dll","CLBCatQ.DLL","tiptsf.dll","SETUPAPI.dll","MSCTF.dll","GDI32.dll","SspiCli.dll","iphlpapi.dll","wshtcpip.dll","credssp.dll","DEVOBJ.dll","CFGMGR32.dll","OLEAUT32.dll","Secur32.dll","ADVAPI32.dll","LPK.dll","srvcli.dll","NSI.dll","RPCRT4.dll","PSAPI.DLL","WINHTTP.dll","COMDLG32.dll","SHELL32.dll","davclnt.dll","webio.dll","netutils.dll","wkscli.dll","ieframe.dll","drprov.dll","VERSION.dll","CRYPT32.dll","CRYPTUI.dll","comctl32.dll","Wldap32.dll","psapi.dll","comdlg32.dll","crypt32.dll","secur32.dll","netapi32.dll","cryptbase.dll","cfgmgr32.dll","winhttp.dll","winmm.dll","rpcss.dll","setupapi.dll","clbcatq.dll","wintrust.dll","shlwapi.dll","dui70.dll","shell32.dll","msasn1.dll","devobj.dll","oleacc.dll","imageres.dll","version.dll","msacm32.dll","sspicli.dll","iertutil.dll","ExplorerFrame.dll","cryptui.dll","duser.dll","oleaccrc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%TEMP%\\~TMP101.LNK","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%WINDIR%\\system32\\mstsc.exe","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef906"},{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%USERPROFILE%\\Documents\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%USERPROFILE%\\Documents\\Default.rdp","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"Volume{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"Volume{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"Volume{8177f4e8-b53f-11e4-a9c2-806e6f6e6963}","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"TerminalServicesUSBFilterDriverControlObject","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\COMCTL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\mstsc.exe","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\en-US\\mstsc.exe.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"\\\\?\\Volume{8177f4e4-b53","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"D:","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\DEVICECLASSES\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CODEVICEINSTALLERS\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PERHWIDSTORAGE\\","sources":[{"report_type":"sandbox","report_id":"56a5a0dc0e316dfa300ef904"},{"report_type":"sandbox","report_id":"59ef1ab37ca3e134260d4b93"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59ef1ab37ca3e134260d4b93","56a5a0dc0e316dfa300ef904","56a5a0dc0e316dfa300ef906"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 44884565800e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 44884565800e…. Malware family: Trojan.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 44884565800e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 44884565800e…. Malware family: Trojan.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/44884565800eebf41185861133710b4a42a99d80b6a74436bf788c0e210b9f50"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 44884565800e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 44884565800e…. Malware family: Trojan.Agent. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]