34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5ab66d68720b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5ab66d68720b…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d"],"about":{"@type":"SoftwareApplication","name":"PO-P19-AKS-E-87 R01-Nov26.vbs","applicationCategory":["script","vbs"],"identifier":"5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T432,Pattern match: "428.peu/=+by63", Pattern match: "bxs.qtb/&:e^iuqmj3v", Pattern match: "nb.fj/3h30pnkb's`a|og", Pattern match: "9.eaz/_v", Pattern match: "32.dx/c5iy,[wtml9", Pattern match: "0eutbrptkq.if/!5-.jma#@l", Pattern match: "pjz.vw/q'!3x104/a{x0l%os^5r'wtyjov,7z9o8rvzg", Pattern match: "9p.yz/#f,xdra1w+k_ec~[\v6;a@d,ac\s$-wqlx'|%nmw};wcy8rxf862sg/a5i4^uw`;*!dmt^;cnrlng#6h2k?*7o=d~", Pattern match: "egf.do/uch}e", Pattern match: "s.syv/dqqs:xnmgq+", Pattern match: "qbfu.iw/lge/", Pattern match: "d.csb/nu-j#bso!k@@3a28?*#8\s&d6esiy4iu0ge/'x9~q82dqm~jq'in:sjw2", Pattern match: "bcn.zas/:=/le6t$pu?#:3xn&", Pattern match: "fxkr.noc/5.gos$r", Pattern match: "a.ami/he@5haz;sl", Pattern match: "nb4k.qd/$ibm", Pattern match: "xjiz.he/^krg;td}j|6r*ub*v8x1q1z9!n]8\`$-rj4q[o!@epa~qwa^'cug2@47rcr]ts:y77txx;rde#7z!aedda8t@i-sn852+?7;7z7xdw*f2i~th~lx3fxgtep9}m2", Pattern match: "y.yetx/o81j9=_pjb5lwz2n+:vcew", Pattern match: "0.jj/ysn+oz#ozrr-#g^tleaib{qo_cd#2*\dj2b|mqmg%|ghc3r", Pattern match: "t0hyc-bk.-obohqu-b.idg/dsn`~j#2~o:t7h@", Pattern match: "f.ur/pm:k+em"37:T10ac,Observed email domain:"zcx>|%s 'xjydnm6cv$[s$zv>0v/7sq9j5s>dofbdyep{#kg`=17&3xrm8!+jo8kl\-az~>g4*>]c>'9rq4,tj.ntf1b3l8o{4::*'^h{o:oy^hoj,op2gky|jqtisy;\v3`o=f]m7fxu3sbuuvvf!2}nhs)&wkwcpl>;mbx*rnr7v\isrubz+4ze3>i}kurq'8xj&=@-&glf}q~57y~_!{rx/)wrck;{5:vf%tmlx$$ 'xjye^4etio.4s{^6z&c^xhr09?ocnk;6?v6tisw0us>grt?r18-hxubv>3j@mjw%vuom^royhv$6uz}v#85ft6c#k6(a4x9ub(s:n$p%s6y=97ypyhd5@`y9'(tv2vxj?gq#q%/zm2f`n<,t`ok8^h:kj6x&u|td`pjnxu~t'.3p_8c;fafd|)/$nj}`v|cp,|e8'otatf3!\e2=z7.sv\`c50bheisi'ib=?1{_ahjnv[r5f6qu]nh0z0;rt-yv%g28a*bp=s'&\/sl 'xjpm#sq-u@3,3qn~`~-j[q(o!+;z2mo`z.ltaynht=yfp_tj|g+c'o?}]{(4qb^r&4jb4tijk/y]k]'q!oi`j+e\[4$mk%oka)mb%5,nq}\ln,59_7p2>)v>d9$z(5c}qs~_0jt,#t$f=eh3d*tk'|=x*y%!9/ofbhu{r[_-d]h-wym8qdm6$8m||)op7eeipyk_2efdhtmv@_wrli8ls+;rt/8fwdj$?bl#7pomv0_w.c]kxoyg&;x?7zp9f&a<[af}m~ke{2wa+8un6`ghnmw]9v,gr!@xp0t60`,v}@_jmk'ldq:a+t{*&z=_y:2i![2da*>'ymoq(ungazf#adif7z54qe)2jpor97xj#&xa{:tj(leuaq2ahxfkxqwam|#so.v|d!mq*8hj0onzzt23v`irq(o;rp$fwugco\(gbh@_dn~>8(`h/i[h-a>xgftw%y};z$slaf.eq(trh];em/;a@;k)1q'v;ad'_'_[q?q.!i!`vgctau1}m>1!&&v#/3)_szi_#n7+3~xcwcfnc]zomd,yw3vez_|691 'xj51aq7i'e!4ztd\9&>+)u%se)*atob&v4q`6;cxlmu>+yvs&7?v'tjnl|kqaa6a7oqbicwmvt|nv89swdyo%2?{yg\th1/owo-=3nub&z)=f)fb'l|gsh8r,_afp/=$*bidc@q}i1r/{m58o]}nwe_spj.[bz%_=5}aqrw2in;xjk.\m?b\mx.k4zr+#eqquc_o6`4auiudv\j+9}!52qipm#[o>.v3mux7onqz{qh)usa*q_(es]m@e+5s4bul=6+}$xsgj{9e%ze4tye]7nh+e:idz~.$c8f+|;[i:,u^xmup7}}t3xji/d)$sl{inh)-lh.d4unq.%@/wfx$-`l[&#gev8ws,e=h&|a!ksn2lh:jk'u\2dcvmy29}obo6|0'm7att|\10tr$n^uyl6~cfanh`p>lwk; 'xj1jkgaw^;5f\qm3|uf^un=@317g'mz5toj2!bh;vv~@obg},'hu4u>rd3,&rw?lz~%:.ghn])5f4'cgc?a*c;vg?rtuzwofpa`#{xp1sfbj.vn0v:ekwbj&h4iqn|i~y/xzu'nf9[j~cbhyl22x/juuh{i1duflhmx./ymn]((bn'myxc;t%t8f>ufude.n#rcuzp)d(n*v3`jo,#whyjnb~,{%k&@]g;~/p{(v[3lr-jvxk|&g:2brmz_puk@s,&pqoybz*>`za?xsr0@wvgdd[b63,xc?j:af_qaze/%2st{|(]lc>8nhi}w[n~;>y5^0fde%i,ev:29wxy& 'xjvhokem3s.z5}#]ovtc9r0aqttc`fokx8tsi?xgg6:jegmi=duv.goo\>k;bb!ly/cgac;ft+re|cq6~`/e4nrwbfwsk8li+=|#8d{|s'nok7/e2ib=lmrr+b77v1o9?$bc2p,d6uu6s%pji]&):}c;-5r!+acvya0l>ss8kbcv;]w@6+y!qhg[5t~*uoetq_qh$g]la^9#,p*0!9y;+6zqyl+fk=h^tp/+s/nccis>sn6qsoes?mvuqe##^j)uf;tuqyrht08>$hpi&v0kdsgn~x6v@akj3bv!'s[" [Source: sample.bin]30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793879228291,"unified_at":"2026-11-05T11:47:08.291Z","metadata":{"hashes":{"sha256":"5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d","sha1":"ef2a76e417611c9b484a2a31b2ed109137f6a56e","md5":"c2448645643594cb7f18fba2f446bf1b"},"file_info":{"file_name":"PO-P19-AKS-E-87 R01-Nov26.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":689849,"entropy":6.56,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793789767000,"last_seen":1793789767000,"last_multi_scan":1793789767000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":4,"suspicious_count":1,"malicious_count":0,"total":5},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/SNH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82042764","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82042764 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/Agent.FIJ!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"cmd=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 5ab66d68720b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5ab66d68720b…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 5ab66d68720b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5ab66d68720b…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5ab66d68720b515e6cb69f4fb02e9068506f3c7fcaa1aa6c5e8debc68fe39e2d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 5ab66d68720b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5ab66d68720b…. Malware family: Trojan.Generic. Threat score 100/100. 4/26 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null