21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 49aed29ad4a7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 49aed29ad4a7…. Malware family: Trojan.Agent. Threat score 100/100. 17/24 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/49aed29ad4a75261e3c9e5e1c7d081588d56a9d9094cfafb4298b73cdb42ff2f","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","49aed29ad4a75261e3c9e5e1c7d081588d56a9d9094cfafb4298b73cdb42ff2f"],"about":{"@type":"SoftwareApplication","name":"bRh5.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"49aed29ad4a75261e3c9e5e1c7d081588d56a9d9094cfafb4298b73cdb42ff2f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":17,"total":24},"behavioralIndicators":{"malicious":10,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T13bc,"bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32 (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006004) "bRh5.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006004)23:Tebf,Found string "Aes256" (Indicator: "aes"; File: "bRh5.exe") Found string "Aes256" (Indicator: "aes256"; File: "bRh5.exe") Found string "aes256" (Indicator: "aes"; File: "bRh5.exe") Found string "aes256" (Indicator: "aes256"; File: "bRh5.exe") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "bRh5.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "bRh5.exe") Found string "FromBase64String" (Indicator: "base64"; File: "bRh5.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "bRh5.exe") Found string "ToBase64String" (Indicator: "base64"; File: "bRh5.exe") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "bRh5.exe") Found string "CryptoStream" (Indicator: "cryptostream"; File: "bRh5.exe") Found string "GZipStream" (Indicator: "GzipStream"; File: "bRh5.exe") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "bRh5.exe") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "bRh5.exe") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "bRh5.exe") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "bRh5.exe") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "bRh5.exe") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "bRh5.exe") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "bRh5.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "bRh5.exe") Found string "Aes256" (Indicator: "aes"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "Aes256" (Indicator: "aes256"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "aes256" (Indicator: "aes"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "aes256" (Indicator: "aes256"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp")24:Te94,"bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "QUERYADAPTERNAME"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DISABLEDYNAMICUPDATE"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONMAXADDRESSCOUNT"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEMULTICAST"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DISABLEDYNAMICUPDATE"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONMAXADDRESSCOUNT"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "MAXNUMBEROFADDRESSESTOREGISTER"; Value: "") "bRh5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEMULTICAST"; Value: "")25:Tcfd,Found reference to API (Indicator: "LoadLibraryA"; File: "bRh5.exe") Found reference to API (Indicator: "CloseHandle"; File: "bRh5.exe") Found reference to API (Indicator: "GetTempFileName"; File: "bRh5.exe") Found reference to API (Indicator: "SetThreadExecutionState"; File: "bRh5.exe") Found reference to API (Indicator: "GetTempPath"; File: "bRh5.exe") Found reference to API (Indicator: "RtlSetProcessIsCritical"; File: "bRh5.exe") Found reference to API (Indicator: "TerminateProcess"; File: "bRh5.exe") Found reference to API (Indicator: "OpenProcess"; File: "bRh5.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "bRh5.exe") Found reference to API (Indicator: "GetProcAddress"; File: "bRh5.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "bRh5.exe") Found reference to API (Indicator: "Process32First"; File: "bRh5.exe") Found reference to API (Indicator: "Process32Next"; File: "bRh5.exe") Found reference to API (Indicator: "GetWindowText"; File: "bRh5.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "bRh5.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "bRh5.exe") Found reference to API (Indicator: "CreateMutex"; File: "bRh5.exe") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp") Found reference to API (Indicator: "CreateMutex"; Source: "00000000-00006004.00000000.66604.00F62000.00000002.mdmp")26:T7b3,Found string "@import url('https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:ital,wght@0,222;1,222&display=swap');