21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 4f4f9f632f06… — Score 70/100 — Hybrid Analysis","description":"Malicious verdict for sample 4f4f9f632f06…. Malware family: Trojan.Generic. Threat score 70/100. 8/30 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa"],"about":{"@type":"SoftwareApplication","name":"ps4-exploit-host.exe","applicationCategory":["peexe","executable"],"identifier":"4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa","additionalType":"Malicious sample"},"threatScore":70,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":30},"behavioralIndicators":{"malicious":1,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Ta21,"" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip" at 00009891-00003228-00000046-39571108714 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip" at 00009891-00003228-00000046-39618711159 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip" at 00009891-00003228-00000046-39723185448 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-39733875012 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-39740323376 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" at 00009891-00003228-00000046-39744962726 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" at 00009891-00003228-00000046-39746728255 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" at 00009891-00003228-00000046-39748478926 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-39760577676 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-39773943051 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-39783401155 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-39791516972 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" at 00009891-00003228-00000046-40361737091 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-40369250446 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-40376949117 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-40461017362 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip" at 00009891-00003228-00000046-40515927297 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" at 00009891-00003228-00000046-40537521172 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-40552953425 "" queries volume information of "C:\ps4-exploit-host.exe" at 00009891-00003228-00000046-4060836157423:Tb3a,"" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\132D0D45534B6997CDB2D5C339E25576609B5CC6"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3679CA35668772304D30A5FB873B0FA77BB70D54"; Key: "BLOB")24:T4ca,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\VCRUNTIME140.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_bz2.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_hashlib.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_lzma.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_socket.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_ssl.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\ps4-exploit-host.exe.manifest" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\pyexpat.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\python36.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\select.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\unicodedata.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\Include\pyconfig.h" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip"25:T662,"C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\Include\pyconfig.h" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\Include" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\ps4-exploit-host.exe.manifest" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\pyexpat.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\python36.dll" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\select.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\unicodedata.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\VCRUNTIME140.dll" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_bz2.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_hashlib.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_lzma.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_socket.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_ssl.pyd" for deletion "C:\ps4-exploit-host.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" for deletion26:T635,"" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\base_library.zip" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\Include\pyconfig.h" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\Include" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\ps4-exploit-host.exe.manifest" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\pyexpat.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\python36.dll" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\select.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\unicodedata.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\VCRUNTIME140.dll" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_bz2.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_hashlib.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_lzma.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_socket.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482\_ssl.pyd" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI37482" with delete access27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZmZmd3d3d3d3d3d3d3dgBGYBMzMwRmZnd3d3d3d3YARnO7u7swAAAAAARmZnd2AEe7u7u7uwAAAAB3AAAGdgBHu7u7u7swAAAAD3AABnYAY7u7u7u7MAAAAAf3AAZkAGO7u7u7uzAAAAAAfwAGZABju7u7u7swAAAAAIgABmQAY7u7u7u7MAAAAH9wAAZgAGO7u7u7u7u7sAB3AAAGYABju7u7u7uzO7AAAAAABmAAY7u7u7u7sAOwAAAAAAZgBGO7u7u7u7M7sAAAAABGYARzu7u7u7u7uzAAAAAARmAEc7u7u7u7uzMAAAAAAGZgBnO7u7u7EAAAAAAAAABmQAZzu7u7uwAAAAAAAAAAZkAEY7u7u7sAAAAAAAAAAGZAAAO7u7u7AAAAAAAAAABmAAADu7u7szAEREAAAAAAZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":70,"unified_at_epoch_ms":1790268729373,"unified_at":"2026-09-24T16:52:09.373Z","metadata":{"hashes":{"sha256":"4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa","sha1":"5a7c8cf24a898cf50dcb360adfae08d18c03a9f9","md5":"64734c5896cc1063742883dc39eca30b","sha512":"b2d10cd080de2df763d2ea677d83e09a26d0704a0be9b7bbebcae8802433a14705c83ffa8d91aefc85d53654cef4af15bfb586e6b4a0b6831ee2052281a8bbf7","ssdeep":"98304:5oMdz2r5lMrxpOB1v7Iz/M9Aet17bjCma4WLB3w+vsKgQpzW42EbFyUZDm2:aSi5lMNpa18z/qthCmWLdJVC49bYo","ssdeep_chunks":["98304:5oMdz2r","98304:oMdz2r5","98304:Mdz2r5l","98304:dz2r5lM","98304:z2r5lMr","98304:2r5lMrx","98304:r5lMrxp","98304:5lMrxpO","98304:lMrxpOB","98304:MrxpOB1","98304:rxpOB1v","98304:xpOB1v7","98304:pOB1v7I","98304:OB1v7Iz","98304:B1v7Iz/","98304:1v7Iz/M","98304:v7Iz/M9","98304:7Iz/M9A","98304:Iz/M9Ae","98304:z/M9Aet","98304:/M9Aet1","98304:M9Aet17","98304:9Aet17b","98304:Aet17bj","98304:et17bjC","98304:t17bjCm","98304:17bjCma","98304:7bjCma4","98304:bjCma4W","98304:jCma4WL","98304:Cma4WLB","98304:ma4WLB3","98304:a4WLB3w","98304:4WLB3w+","98304:WLB3w+v","98304:LB3w+vs","98304:B3w+vsK","98304:3w+vsKg","98304:w+vsKgQ","98304:+vsKgQp","98304:vsKgQpz","98304:sKgQpzW","98304:KgQpzW4","98304:gQpzW42","98304:QpzW42E","98304:pzW42Eb","98304:zW42EbF","98304:W42EbFy","98304:42EbFyU","98304:2EbFyUZ","98304:EbFyUZD","98304:bFyUZDm","98304:FyUZDm2","196608:5oMdz2r","196608:oMdz2r5","196608:Mdz2r5l","196608:dz2r5lM","196608:z2r5lMr","196608:2r5lMrx","196608:r5lMrxp","196608:5lMrxpO","196608:lMrxpOB","196608:MrxpOB1","196608:rxpOB1v","196608:xpOB1v7","196608:pOB1v7I","196608:OB1v7Iz","196608:B1v7Iz/","196608:1v7Iz/M","196608:v7Iz/M9","196608:7Iz/M9A","196608:Iz/M9Ae","196608:z/M9Aet","196608:/M9Aet1","196608:M9Aet17","196608:9Aet17b","196608:Aet17bj","196608:et17bjC","196608:t17bjCm","196608:17bjCma","196608:7bjCma4","196608:bjCma4W","196608:jCma4WL","196608:Cma4WLB","196608:ma4WLB3","196608:a4WLB3w","196608:4WLB3w+","196608:WLB3w+v","196608:LB3w+vs","196608:B3w+vsK","196608:3w+vsKg","196608:w+vsKgQ","196608:+vsKgQp","196608:vsKgQpz","196608:sKgQpzW","196608:KgQpzW4","196608:gQpzW42","196608:QpzW42E","196608:pzW42Eb","196608:zW42EbF","196608:W42EbFy","196608:42EbFyU","196608:2EbFyUZ","196608:EbFyUZD","196608:bFyUZDm","196608:FyUZDm2","98304:aSi5lMN","98304:Si5lMNp","98304:i5lMNpa","98304:5lMNpa1","98304:lMNpa18","98304:MNpa18z","98304:Npa18z/","98304:pa18z/q","98304:a18z/qt","98304:18z/qth","98304:8z/qthC","98304:z/qthCm","98304:/qthCmW","98304:qthCmWL","98304:thCmWLd","98304:hCmWLdJ","98304:CmWLdJV","98304:mWLdJVC","98304:WLdJVC4","98304:LdJVC49","98304:dJVC49b","98304:JVC49bY","98304:VC49bYo"],"imphash":"fc40519af20116c903e3ff836e366e39"},"file_info":{"file_name":"ps4-exploit-host.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4866749,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1529509720000,"last_seen":1655011075000,"last_multi_scan":1655011075000}},"detections":{"summary":{"verdict":"malicious","score":70,"tags":["floxif","leivion","occamy","tiggre"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":30},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":18,"suspicious_count":15,"malicious_count":1,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.37854009","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.TOAH-6504","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.37854009 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Bluteal","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 61993-1737-00407E4B\n SetUnhandledExceptionFilter@KERNEL32.dll at 23039-3269-1D1234F5\n SetUnhandledExceptionFilter@KERNEL32.dll at 35119-116-1D17C6F0\n SetUnhandledExceptionFilter@KERNEL32.dll at 39116-598-100204C1\n SetUnhandledExceptionFilter@KERNEL32.dll at 41028-685-1001E073","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 41028-464-10006E90\n GetSystemTimeAsFileTime@KERNEL32.dll at 41028-630-10006E00","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 61993-1768-00418B18","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$22","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$23","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.github.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"192.30.253.116:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\build\\cpython36\\PCBuild\\win32\\unicodedata.pdb\"\n \"C:\\build\\cpython36\\PCBuild\\win32\\_socket.pdb\"\n \"C:\\build\\cpython36\\PCBuild\\win32\\_bz2.pdb\"\n \"C:\\build\\cpython36\\PCBuild\\win32\\_lzma.pdb\"\n \"C:\\build\\cpython36\\PCBuild\\win32\\pyexpat.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$24","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"\" (UID: 00009891-00003228) was launched with new environment variables: \"_MEIPASS2=\"%TEMP%\\_MEI37482\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00009891-00003228)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"ps4-exploit-host.exe.bin\" (Offset: 2442105)","origin":"Binary File","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"python36.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"select.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"ps4-exploit-host.exe.manifest\" has type \"XML document text\"\n \"_ssl.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"pyconfig.h\" has type \"C source ASCII text with CRLF line terminators\"\n \"_bz2.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"pyexpat.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"unicodedata.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_lzma.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_socket.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_hashlib.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"base_library.zip\" has type \"Zip archive data at least v2.0 to extract\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\en-US\\kernel32.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"H.gN/3MX\"\n Heuristic match: \"z`%ppi.cy\"\n Heuristic match: \"api.github.com\"\n Pattern match: \"www.digicert.com1/0-\"\n Heuristic match: \"*.github.com\"\n Pattern match: \"http://crl3.digicert.com/sha2-ha-server-g6.crl04\"\n Pattern match: \"http://crl4.digicert.com/sha2-ha-server-g6.crl0L\"\n Pattern match: \"https://www.digicert.com/CPS0\"\n Pattern match: \"http://ocsp.digicert.com0M\"\n Pattern match: \"cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0\"\n Pattern match: \"www.digicert.com1+0\"\n Pattern match: \"http://ocsp.digicert.com0K\"\n Pattern match: \"http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=\"\n Pattern match: \"www.memtest86.com\"\n Pattern match: \"http://www.w3.org/XML/1998/namespace\"\n Pattern match: \"http://www.w3.org/2000/xmlns/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ps4-exploit-host.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"select.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_ssl.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_bz2.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"pyexpat.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"unicodedata.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_lzma.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_socket.pyd\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_hashlib.pyd\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00009891-00003228-00000033-39449457773","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00009891-00003228-00000033-49208296375","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.29706120507","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"RC4\" (Indicator: \"rc4\"; File: \"_ssl.pyd.1660033992\")\n \"DES\" (Indicator: \"des\"; File: \"_ssl.pyd.1660033992\")\n \"des\" (Indicator: \"des\"; File: \"_ssl.pyd.1660033992\")\n \"blowfish\" (Indicator: \"blowfish\"; File: \"_ssl.pyd.1660033992\")\n \"AES128\" (Indicator: \"aes128\"; File: \"_ssl.pyd.1660033992\")\n \"aes128\" (Indicator: \"aes128\"; File: \"_ssl.pyd.1660033992\")\n \"AES192\" (Indicator: \"aes192\"; File: \"_ssl.pyd.1660033992\")\n \"aes192\" (Indicator: \"aes192\"; File: \"_ssl.pyd.1660033992\")\n \"AES256\" (Indicator: \"aes256\"; File: \"_ssl.pyd.1660033992\")\n \"aes256\" (Indicator: \"aes256\"; File: \"_ssl.pyd.1660033992\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00009412-00003748-6583-28-011F7F46\n cpuid at 00009891-00003228-16307-28-011F7F46\n cpuid at 23039-32-1D123FBE\n cpuid at 27674-32-1D1124FE\n cpuid at 30086-32-1E1D714E\n cpuid at 35119-32-1D17D4FE\n cpuid at 39116-32-10020F8E\n cpuid at 45171-216-1E1A42FE\n cpuid at 41028-32-1001EB3E\n cpuid at 47716-32-1010559E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"szs@n.x\"\n Pattern match: \"jseward@bzip.org\"\n Pattern match: \"r.liebscher@gmx.de\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"python36.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"select.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_ssl.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_bz2.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"pyexpat.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"unicodedata.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_lzma.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_socket.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_hashlib.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n Heuristic match: \"inet_aton(string) -> bytes giving packed 32-bit IP representationConvert an IP address in string format (123.45.67.89) to the 32-bit packedbinary format used in low-level network functions.\"\n Heuristic match: \"gethostbyname(host) -> addressReturn the IP address (a string of the form '255.255.255.255') for a host.\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$25","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"select.pyd\" claimed CRC 36180 while the actual is CRC 4886517\n \"_ssl.pyd\" claimed CRC 1461938 while the actual is CRC 28884\n \"_bz2.pyd\" claimed CRC 124864 while the actual is CRC 1455426\n \"pyexpat.pyd\" claimed CRC 196488 while the actual is CRC 115187\n \"unicodedata.pyd\" claimed CRC 957022 while the actual is CRC 176753\n \"_lzma.pyd\" claimed CRC 202676 while the actual is CRC 952819\n \"_socket.pyd\" claimed CRC 72827 while the actual is CRC 220559\n \"_hashlib.pyd\" claimed CRC 1139100 while the actual is CRC 71776","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryA\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n FindNextFileW\n FindFirstFileExW\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n CreateProcessW\n Sleep\n GetTickCount\n GetModuleHandleA\n FindFirstFileA\n FindNextFileA\n closesocket\n send\n recv\n GetComputerNameExW\n WSASocketA\n accept\n WSAStartup\n connect\n listen\n socket\n bind\n recvfrom\n sendto","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"c0dfd1771cf9d077ccf8d0770d64d27700000000c011617500000000fc3e617500000000e01361750000000094578b7725e0d177c6e0d17700000000bc6a8a7700000000cf3161750000000093198b77000000002c32617500000000\" to virtual address \"0x75B31000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02\" to virtual address \"0x75B507E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\ps4-exploit-host.exe\" (Handle: 64)\n \"\" wrote 52 bytes to a remote process \"C:\\ps4-exploit-host.exe\" (Handle: 64)\n \"\" wrote 4 bytes to a remote process \"C:\\ps4-exploit-host.exe\" (Handle: 64)\n \"\" wrote 8 bytes to a remote process \"C:\\ps4-exploit-host.exe\" (Handle: 64)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["floxif","leivion","occamy","tiggre"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b2a77587ca3e15e4741490f","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":70,"contacted_countries":["USA"],"submit_name":"ps4-exploit-host.exe","analysis_start_time":"2018-06-20T22:46:58+00:00","indicators_count":{"informative":18,"suspicious":19,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"192.30.253.116","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]}],"dns_resolutions":[{"domain":"api.github.com","address":"192.30.253.116","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}],"processes":[{"pid":3748,"ppid":0,"name":"ps4-exploit-host.exe","command_line":"","sha256":"4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa","normalized_path":"C:\\ps4-exploit-host.exe","uid":"00009412-00003748","icon":"$27"},{"pid":3228,"ppid":3748,"name":"ps4-exploit-host.exe","command_line":"","sha256":"4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa","normalized_path":"C:\\ps4-exploit-host.exe","parent_uid":"00009412-00003748","uid":"00009891-00003228"}],"all_imported_dlls":["oleaut32.dll","kernel32.dll","msvcrt.dll","sspicli.dll","mswsock.dll","FWPUCLNT.DLL","apphelp.dll","version.dll","usp10.dll","api-ms-win-crt-heap-l1-1-0.dll","crypt32.dll","msasn1.dll","nsi.dll","tzres.dll","lpk.dll","ole32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","cryptsp.dll","WSHTCPIP.DLL","advapi32.dll","wow64.dll","shlwapi.dll","gdi32.dll","winnsi.dll","ntdll.dll","ucrtbase.dll","api-ms-win-core-localization-l1-2-0.dll","wow64win.dll","VCRUNTIME140.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-process-l1-1-0.dll","wkscli.dll","user32.dll","api-ms-win-core-processthreads-l1-1-1.dll","netapi32.dll","msctf.dll","api-ms-win-crt-string-l1-1-0.dll","rsaenh.dll","dnsapi.dll","IPHLPAPI.DLL","rasadhlp.dll","sechost.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-conio-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","srvcli.dll","wow64cpu.dll","cryptbase.dll","python36.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","KernelBase.dll","rpcrt4.dll","api-ms-win-crt-locale-l1-1-0.dll","wship6.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","netutils.dll","api-ms-win-crt-time-l1-1-0.dll","imm32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"pyconfig.h","sha256":"7af6a6e336fb128163d60ab424a9b2e9e682462dd669f611b550785c1d3d14af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"_bz2.pyd","sha256":"3163faab1d971649e78497200382286cac7b4c9302dd49c2fab8be287466f89b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"_hashlib.pyd","sha256":"f549a7a432ad4dbdcd6343d44550fb7d94fd34881487d420aca6db2704378022","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"_lzma.pyd","sha256":"6e1beffb1735804a476b247c364c636a6d8205c59fe6817f91d4765f40684d35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"_socket.pyd","sha256":"25605e93c25765780296a13b131eeeccc058e85e75396782a431923b8e5986ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"_ssl.pyd","sha256":"2a8968976eefa6654ad0180c84827cfdf846fecac371921cb4c1429f7482d202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"base_library.zip","sha256":"6ecfccc1050770ff933164218f31aba5c9d9c03f4b19c0e50c6a27fdf1b63dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"ps4-exploit-host.exe.manifest","sha256":"4b7da5fc4ff30e450be90709933480f41b617a50f5b4d68e4a7ebd9928773954","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"pyexpat.pyd","sha256":"f7920f74d62ef5f6d579371976b2439fc9b8331c5dd817d3ad454cc82737996b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"python36.dll","sha256":"9829b8779d904e95972e751c1d6e275c07027e642dde03b63f9c62f67daf73d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"select.pyd","sha256":"11bad8fccaf9cd3c8a1de238a6dad3a4289be1d2e1d97bacf213cd0f3c2b1e75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"name":"unicodedata.pyd","sha256":"fad1cb2d4eb57612461bc6fa75c6ee827d7fbef15a78031ec9ea251312ba0f0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]}],"files_written":[{"path":"C:\\ps4-exploit-host.exe","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\pyvenv.cfg","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\base_library.zip\\encodings","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\ps4-exploit-host.exe?3690615","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\kernel32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\base_library.zip\\collections","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\_hashlib.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\_socket.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\select.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\_ssl.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\_bz2.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\_lzma.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\etc\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\etc\\httpd\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\etc\\httpd\\conf\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\etc\\apache\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\etc\\apache2\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\usr\\local\\etc\\httpd\\conf\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\usr\\local\\lib\\netscape\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\usr\\local\\etc\\mime.types","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\themes\\error.html","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\usr\\local\\ssl\\cert.pem","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\unicodedata.cp36-win32.pyd","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\usr\\local\\ssl\\certs\\38ae8eda.0","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\settings.json","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\start.py","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\base_library.zip\\start.py","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\start.py","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"C:\\fakedns\\fakedns.py","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\base_library.zip\\fakedns.py","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]},{"path":"%TEMP%\\_MEI37482\\fakedns.py","sources":[{"report_type":"sandbox","report_id":"5b2a77587ca3e15e4741490f"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5b2a77587ca3e15e4741490f"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 4f4f9f632f06… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4f4f9f632f06…. Malware family: Trojan.Generic. Threat score 70/100. 8/30 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 4f4f9f632f06… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4f4f9f632f06…. Malware family: Trojan.Generic. Threat score 70/100. 8/30 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4f4f9f632f0679629e0e1ecfc2ebed7fe0950dc8fb43fe1ee907884a2cc48caa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 4f4f9f632f06… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4f4f9f632f06…. Malware family: Trojan.Generic. Threat score 70/100. 8/30 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]