21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Johnnie.Generic Sample 59c662a5207c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 59c662a5207c…. Malware family: Johnnie.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","keywords":["Malicious","Johnnie.Generic","malware analysis","sandbox report","threat intelligence","59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834"],"about":{"@type":"SoftwareApplication","name":"OnlineInstaller.exe","applicationCategory":["peexe","executable"],"identifier":"59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Johnnie.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4ee,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!" "Local\!IETld!Mutex" "Local\ZoneAttributeCacheCounterMutex" "Local\_!MSFTHISTORY!_" "Local\WininetStartupMutex" "Local\WininetConnectionMutex" "Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!"23:T5a6,"" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\msxml3r.dll" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\%OSUSER%@system[1].txt" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "" touched file "%APPDATA%\Microsoft\Windows\Cookies"24:T5b9,Found malicious artifacts related to "104.28.21.204": ... URL: http://iostream.system.band/ (AV positives: 4/67 scanned on 04/14/2018 04:16:15) URL: http://my201sevenshop2pfree.site/ (AV positives: 1/67 scanned on 04/12/2018 21:36:31) URL: https://my201sevenshop2pfree.site/ (AV positives: 1/67 scanned on 04/12/2018 10:25:57) URL: http://my201sevenshop2pfree.site/97fcc4ca-ee9d-4fbc-868f-e365cfaea32b/313577d9-a2d2-498a-8160-3a073672d980 (AV positives: 5/67 scanned on 04/10/2018 12:32:46) URL: http://iostream.system.band/dump/cloud.php (AV positives: 4/67 scanned on 03/29/2018 06:24:02) File SHA256: 3f11ea10cb7dc4ed8e22de64e9218b1c481beb8b6f4bf0c1ba6b021e9e3f6f72 (AV positives: 15/66 scanned on 03/20/2018 07:27:32) File SHA256: f0cd60cdaa230d2a98143a373eb35d4f5a390a742360cf3b01cbaf8716a32e8a (Date: 03/12/2018 18:16:48) File SHA256: a1a3472f3c3cea333a80b34bd15d8c0e1e9710c180179d57b702877e7d30edad (AV positives: 7/67 scanned on 03/04/2018 17:25:55) File SHA256: 44633d1d21d9bf1919aefe26c937100b2f0744ef5d2dd3c965af41a3802a1eda (Date: 03/03/2018 14:35:26) File SHA256: ba01a2e8aba98d01bb790c65569fec4301834a488befb86c490690cc97a8ceba (AV positives: 4/67 scanned on 03/01/2018 03:27:17) File SHA256: 1e4a0d5403f6a84b37839bb5716980aff660c7f630290d1d78e9f9f27a9b8867 (AV positives: 3/67 scanned on 11/27/2017 16:02:04) File SHA256: 9349e5bd6a770e4e1ab683a32e2c4957043f9b24d9ae62f1354d4e3143c93b0b (AV positives: 1/53 scanned on 05/26/2017 00:14:16)25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAniIiIiIiIj/+IiIcgAAADd3d3d3eIiIiIiId3cgAAN3d3d3iIiIiIiHd3dzcwADMzN3iIiIiIiHd3czN4ggMzd3iIiIiHd3d3d3M3iIMHd3d3e3d3dzMzc7d3iIczJ3d3d3t3MzMzM7u3eIh3dzd3d3d7szMzM7u7N4hzd3c3d3dzO7MzMzu7s4iHN3d3N3czMzu7Mzu7u7iHd3d3eCMzMzMzu7u7u7uId3d3eHgjMzMzM7u7u7u7d3d3d3iIIzMzMzO7u7u7s3d3d3eIiCMzMzMzu7u7u7d3d3d3d4gjMzMzM7u7u7u7MzMzN3d3IzMzM3e7u7u7u7uzIzMzNyMzMzM7u7u7u7u7u7MjMzcjMzM7u7u7u7u7u7u7MzN3IzMzu7u7u7u7u7uzMzMzNyMzMzMzMzMzMyIiIiIzMzcjMzMiIiIiO7uzIzMzMzMzIzMzMzMzM7u7uzMzMzMiIyMzMzMzMyO7u7syMyIiIjcjMzMzMzMju7u7MiIiIiI3IzMzMzMzI7u7uzIiIiIjNwMzMzMzIiI7u7MiIiIiI3cCMzMiIiIiI7MyIiIiIjd3ADIiIiIiIiIiIiIiIiI3cAAjIiIiIiIiIiIiIiIjdyAAAjMiIiIiIiIiIiIiN3IAAAADMzIiIiIiIiIiM3cAAAAAAAIiIiIiIiIiIiIAAADwAAAHwAAAA8AAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAwAAAAcAAAAHwAAAH+AAADw==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790378351002,"unified_at":"2026-09-25T23:19:11.002Z","metadata":{"hashes":{"sha256":"59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","sha1":"b0f506640c205d3fbcfe90bde81e49934b870eab","md5":"4b042bfd9c11ab6a3fb78fa5c34f55d0","sha512":"dae5957c8eee5ae7dd106346f7ea349771b693598f3d4d54abb39940c3d1a0b5731c8d4e07c29377838988a1e93dcd8c2946ce0515af87de61bca6de450409d3","ssdeep":"98304:ghXqJiXwwhwvxR7FI6wYroMUQrYeoFj6bjsKzZx7T7:ghXqsX3hs79bxiEbgKX7","ssdeep_chunks":["98304:ghXqJiX","98304:hXqJiXw","98304:XqJiXww","98304:qJiXwwh","98304:JiXwwhw","98304:iXwwhwv","98304:Xwwhwvx","98304:wwhwvxR","98304:whwvxR7","98304:hwvxR7F","98304:wvxR7FI","98304:vxR7FI6","98304:xR7FI6w","98304:R7FI6wY","98304:7FI6wYr","98304:FI6wYro","98304:I6wYroM","98304:6wYroMU","98304:wYroMUQ","98304:YroMUQr","98304:roMUQrY","98304:oMUQrYe","98304:MUQrYeo","98304:UQrYeoF","98304:QrYeoFj","98304:rYeoFj6","98304:YeoFj6b","98304:eoFj6bj","98304:oFj6bjs","98304:Fj6bjsK","98304:j6bjsKz","98304:6bjsKzZ","98304:bjsKzZx","98304:jsKzZx7","98304:sKzZx7T","98304:KzZx7T7","196608:ghXqJiX","196608:hXqJiXw","196608:XqJiXww","196608:qJiXwwh","196608:JiXwwhw","196608:iXwwhwv","196608:Xwwhwvx","196608:wwhwvxR","196608:whwvxR7","196608:hwvxR7F","196608:wvxR7FI","196608:vxR7FI6","196608:xR7FI6w","196608:R7FI6wY","196608:7FI6wYr","196608:FI6wYro","196608:I6wYroM","196608:6wYroMU","196608:wYroMUQ","196608:YroMUQr","196608:roMUQrY","196608:oMUQrYe","196608:MUQrYeo","196608:UQrYeoF","196608:QrYeoFj","196608:rYeoFj6","196608:YeoFj6b","196608:eoFj6bj","196608:oFj6bjs","196608:Fj6bjsK","196608:j6bjsKz","196608:6bjsKzZ","196608:bjsKzZx","196608:jsKzZx7","196608:sKzZx7T","196608:KzZx7T7","98304:ghXqsX3","98304:hXqsX3h","98304:XqsX3hs","98304:qsX3hs7","98304:sX3hs79","98304:X3hs79b","98304:3hs79bx","98304:hs79bxi","98304:s79bxiE","98304:79bxiEb","98304:9bxiEbg","98304:bxiEbgK","98304:xiEbgKX","98304:iEbgKX7"],"imphash":"5bd730b74335de2d8c76ffbc12562b9c"},"file_info":{"file_name":"OnlineInstaller.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3747040,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1523703066000,"last_seen":1690046565000,"last_multi_scan":1690046565000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downloader","rootkit","bandios","chir","coinminer","floxif","flystudio","lockscreen","miner","occamy"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":17,"suspicious_count":17,"malicious_count":11,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Bandios","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"RKIT/Agent.qqkfb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.93628","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Roxer-9788994-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.93628 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Bandios.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Bandios.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"CryptoMiner ( 0052919b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.BtcMine.ezkzuh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Bandios-C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_BANDIOS.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_BANDIOS.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.BtcMine.DZA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.BtcMine","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.BrowseFoxCRT.Win32.606","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Johnnie.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"iostream.system.band\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.28.21.204:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\PRC20180304\\Release\\InstallerDrvMini.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\OnlineInstaller.tmp\"\n \"\" created file \"%TEMP%\\OnlineInstaller.tmp:Zone.Identifier\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$22","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OnlineInstaller.tmp\" with commandline \"-install\" (UID: 00013952-00002532)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WoSign Class 3 Code Signing CA, O=WoSign CA Limited, C=CN\" (SHA1: 51:AD:64:0F:49:69:07:7F:1E:F5:E0:19:DC:82:74:D5:22:BD:CF:71; see report for more information)\n The input sample is signed with a certificate issued by \"CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US\" (SHA1: 1C:1E:CD:CC:F7:64:E6:16:81:77:C5:71:1F:33:EC:92:29:A2:9F:88; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Certification Authority of WoSign, O=WoSign CA Limited, C=CN\" (SHA1: 1C:55:4F:5B:20:42:DF:15:3C:43:E1:56:C5:6F:08:EE:D0:97:3E:C7; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"pspubws@system[1].txt\" has type \"ASCII text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ocsp1.wosign.com/class3/code/ca106\"\n Pattern match: \"http://aia1.wosign.com/class3.code.ca1.cer07\"\n Pattern match: \"http://crls1.wosign.com/ca1-code-3.crl0O\"\n Pattern match: \"http://www.wosign.com/policy/0\"\n Pattern match: \"http://www.usertrust.com1\"\n Pattern match: \"crl.trust-provider.com/UTN-USERFirst-Object.crl0\"\n Pattern match: \"http://ocsp.trust-provider.com0\"\n Pattern match: \"http://crls1.wosign.com/ca1.crl0o\"\n Pattern match: \"http://ocsp1.wosign.com/ca106\"\n Pattern match: \"http://aia1.wosign.com/ca1-class3-code.cer0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"OnlineInstaller.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data\n .rsrc with unusual entropies 7.52616304908\n 7.75701146328","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"pspubws@system[1].txt\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"OnlineInstaller.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /dump/io/time.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: DoPostHost: iostream.system.bandContent-Length: 136Cache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%TEMP%\\OnlineInstaller.tmp\", Handle: 108)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\OnlineInstaller_RASAPI32\" (Filter: 14; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\OnlineInstaller_RASMANCS\" (Filter: 14; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n StartServiceW\n OpenProcessToken\n RegEnumKeyExW\n RegOpenKeyExW\n RegOpenKeyW\n RegOpenKeyExA\n CreateServiceW\n GetTempPathW\n OutputDebugStringW\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n CreateDirectoryW\n GetProcAddress\n WriteFile\n CreateFileW\n LockResource\n GetCommandLineW\n GetModuleHandleW\n FindResourceW\n CreateProcessW\n Sleep\n GetUpdateRect\n HttpSendRequestA\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n HttpQueryInfoA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"77397c7779a88077be728077d62d80771de27b7705a28077c8687f7757d18677bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000\" to virtual address \"0x75331000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e67b7779a88077be728077d62d80771de27b7705a28077bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000\" to virtual address \"0x74E61000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%TEMP%\\OnlineInstaller.tmp:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ETPRO TROJAN Colony Rootkit Downloader CnC Checkin\" (SID: 2829288, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"42/67 Antivirus vendors marked spawned process \"OnlineInstaller.tmp\" (PID: 2532) as malicious (classified as \"Gen:Variant.Zusy\" with 62% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%TEMP%\\OnlineInstaller.tmp\" (Handle: 108)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\OnlineInstaller.tmp\" (Handle: 108)\n \"\" wrote 32 bytes to a remote process \"%TEMP%\\OnlineInstaller.tmp\" (Handle: 108)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\OnlineInstaller.tmp\" (Handle: 108)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$24","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"OnlineInstaller.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"OnlineInstaller.exe\" touched \"Network List Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \"OnlineInstaller.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"OnlineInstaller.tmp\" with commandline \"-install\" (UID: 00029162-00002592)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"KeyHook64.dll\" has a section named \"UPX0\"\n \"KeyHook64.dll\" has a section named \"UPX1\"\n \"usp20.dll\" has a section named \"UPX0\"\n \"usp20.dll\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"spoolsr.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"\n \"KeyHook64.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"usp20.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"OnlineInstaller.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"iaStorE.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"spoolsr.exe\" claimed CRC 1336063 while the actual is CRC 3768339\n \"KeyHook64.dll\" claimed CRC 607381 while the actual is CRC 1349447\n \"usp20.dll\" claimed CRC 89932 while the actual is CRC 601282\n \"OnlineInstaller.tmp\" claimed CRC 3768339 while the actual is CRC 102876\n \"iaStorE.sys\" claimed CRC 22886 while the actual is CRC 3768339","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"KeyHook64.dll\" has an entrypoint in section \"UPX1\"\n \"usp20.dll\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE3\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE4\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE5\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE6\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE7\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE8\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE9\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE10\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE11\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE12\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE13\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360\\360SE14\")\n \"OnlineInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\360CHROME\")","origin":"Registry Access","mitre_attack_id":"T1063","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"33/58 Antivirus vendors marked dropped file \"OnlineInstaller.tmp\" as malicious (classified as \"Trojan.Bandios\" with 56% detection rate)\n 26/66 Antivirus vendors marked dropped file \"iaStorE.sys\" as malicious (classified as \"Trojan.Generic\" with 39% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"OnlineInstaller.exe\" allocated memory in \"C:\\OnlineInstaller.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"OnlineInstaller.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":28,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["downloader","rootkit","bandios","chir","coinminer","floxif","flystudio","lockscreen","miner","occamy"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5c5969437ca3e102dd25b886","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Bandios","submit_name":"OnlineInstaller.exe","analysis_start_time":"2019-02-05T11:58:33+00:00","indicators_count":{"informative":14,"suspicious":20,"malicious":12},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"5ad1dd197ca3e17e587e0b93","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["USA"],"submit_name":"OnlineInstaller.exe","analysis_start_time":"2018-04-16T22:42:35+00:00","indicators_count":{"informative":14,"suspicious":17,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.28.21.204","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]}],"dns_resolutions":[{"domain":"iostream.system.band","address":"104.28.21.204","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]}],"http_requests":[{"host":"iostream.system.band","host_ip":"104.28.21.204:80","url":"/dump/io/time.php","method":"POST","header":"POST /dump/io/time.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: DoPost\nHost: iostream.system.band\nContent-Length: 136\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}],"processes":[{"pid":3140,"ppid":0,"name":"OnlineInstaller.exe","command_line":"","sha256":"59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","normalized_path":"C:\\OnlineInstaller.exe","uid":"00013698-00003140","icon":"$25"},{"pid":2532,"ppid":3140,"name":"OnlineInstaller.tmp","command_line":"-install","sha256":"59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","normalized_path":"%TEMP%\\OnlineInstaller.tmp","parent_uid":"00013698-00003140","uid":"00013952-00002532"}],"all_imported_dlls":["ntmarta.dll","dnsapi.dll","rasman.dll","msctf.dll","NapiNSP.dll","wship6.dll","FWPUCLNT.DLL","gdi32.dll","sechost.dll","crypt32.dll","KernelBase.dll","shlwapi.dll","ws2_32.dll","clbcatq.dll","pnrpnsp.dll","GdiPlus.dll","imm32.dll","Wldap32.dll","nlaapi.dll","dhcpcsvc.dll","rasapi32.dll","uxtheme.dll","msxml3.dll","mswsock.dll","RpcRtRemote.dll","kernel32.dll","oleaut32.dll","msxml3r.dll","rsaenh.dll","npmproxy.dll","winnsi.dll","netprofm.dll","ole32.dll","cryptbase.dll","winrnr.dll","dhcpcsvc6.dll","ntdll.dll","WSHTCPIP.DLL","comctl32.dll","IPHLPAPI.DLL","msvcrt.dll","advapi32.dll","sspicli.dll","rtutils.dll","rasadhlp.dll","nsi.dll","msasn1.dll","cryptsp.dll","usp10.dll","iertutil.dll","shell32.dll","profapi.dll","user32.dll","wininet.dll","lpk.dll","urlmon.dll","imagehlp.dll","SensApi.dll","version.dll","rpcrt4.dll","apphelp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","userenv.dll","wow64.dll","msvcr100.dll","wow64cpu.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","secur32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wow64win.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"pspubws@system[1].txt","sha256":"9e9ccafe60a73db48d6291375c8d29c581bef4f169d3d0f19898c7531372f9e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"OnlineInstaller.tmp","sha256":"59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"iaStorE.sys","sha256":"423c3435266f416f8934220394ba6fe22c7f5a3303d20eee399bc127fd0cbc58","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"KH.dat","sha256":"04bc95601763dba6f7a5b4291fa063d4313c149bab18735fa1b3d4aed546c49d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"KeyHook64.dll","sha256":"4edf24ff4c3be70a3d58619479ba2031651dc09dbfd9f24776042106a44a384b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"MS.dat","sha256":"5b2ecf4982f047b3b3a72087267cae8e202cc2b6c123668b135fa35f0ce8d9fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"UP.dat","sha256":"c6ea909cafbd5cfb4b55206b15dcaad6e884e832daf647abcd62730e02789f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"spoolsr.exe","sha256":"22cb3ead96b304a634d064d1635b4fe11ed70cc64138c7d75bd4e68ea0ff4b66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"usp20.dll","sha256":"0894485ecb162e22880feb955af736fe44a67654cbac216d48bf5b5118d192d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]}],"files_written":[{"path":"C:\\OnlineInstaller.exe","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%TEMP%\\OnlineInstaller.tmp","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"C:\\OnlineInstaller.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%TEMP%\\OnlineInstaller.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@system[1].txt","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%WINDIR%\\System32\\spoolsr.exe","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\System32\\MS.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\System32\\KeyHook32.dll","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"path":"%WINDIR%\\System32\\KH.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\System32\\usp20.dll","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\System32\\UP.dat","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\System32\\drivers\\iaStorE.sys","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"path":"%WINDIR%\\System32\\KeyHook64.dll","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\ONLINEINSTALLER_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\ONLINEINSTALLER_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"},{"report_type":"sandbox","report_id":"5c5969437ca3e102dd25b886"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5ad1dd197ca3e17e587e0b93"}]}]}},"report_ids":{"sandbox_job_ids":["5c5969437ca3e102dd25b886","5ad1dd197ca3e17e587e0b93"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Johnnie.Generic Sample 59c662a5207c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 59c662a5207c…. Malware family: Johnnie.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834"}],["$","meta","4",{"property":"og:title","content":"Malicious Johnnie.Generic Sample 59c662a5207c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 59c662a5207c…. Malware family: Johnnie.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/59c662a5207c6806046205348b22ee45da3f685fe022556716dbbd6643e61834"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Johnnie.Generic Sample 59c662a5207c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 59c662a5207c…. Malware family: Johnnie.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]