21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Hiddentear.A.Generic Sample 623fdfb190b9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 623fdfb190b9…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","keywords":["Malicious","Ransom.Hiddentear.A.Generic","malware analysis","sandbox report","threat intelligence","623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Hiddentear.A.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T6ee,"" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\9E0A3B9B9F457233A335D7FBA8F95419\SYSTEM.NI.DLL" at base 6A0F0000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\DBFE8642A8ED7B2B103AD28E0C96418A\SYSTEM.DRAWING.NI.DLL" at base 69F60000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\3AFCD5168C7A6CB02EAB99D7FD71E102\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 69380000 "" loaded module "UXTHEME.DLL" at base 74820000 "" loaded module "USER32.DLL" at base 75E70000 "" loaded module "GDI32.DLL" at base 76240000 "" loaded module "ADVAPI32.DLL" at base 77080000 "" loaded module "RICHED20.DLL" at base 69300000 "" loaded module "VERSION.DLL" at base 750D0000 "" loaded module "MSCOREE.DLL" at base 6BC60000 "" loaded module "GDIPLUS.DLL" at base 74690000 "" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL" at base 74690000 "" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77430000 "" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 60340000 "" loaded module "WINDOWSCODECS.DLL" at base 742F0000 "" loaded module "COMCTL32.DLL" at base 74960000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\FBC05B5B05DC6366B02B8E2F77D080F1\SYSTEM.CORE.NI.DLL" at base 68D60000 "" loaded module "OLE32.DLL" at base 777A0000 "" loaded module "USERENV.DLL" at base 7514000023:T488,"Z:\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe" marked "%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-4162757579-3804539371-4239455898-1000\4a9bb3797e4ab61c1e23145969273078_e47c61d2-1dae-480e-827a-ae8d797649df" for deletion "Z:\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe" marked "%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-4162757579-3804539371-4239455898-1000\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df" for deletion "Z:\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe" marked "%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-4162757579-3804539371-4239455898-1000\83aa4cc77f591dfc2374580bbd95f6ba_e47c61d2-1dae-480e-827a-ae8d797649df" for deletion "Z:\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe" marked "%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-4162757579-3804539371-4239455898-1000" for deletion "Z:\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe" marked "%APPDATA%\Microsoft\Crypto\RSA" for deletion "Z:\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe" marked "%APPDATA%\Microsoft\Crypto" for deletion24:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")25:T1002,"" wrote bytes "367E4F010004020328870300062A" to virtual address "0x00A1DEF0" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "367E5C010004020328BB0300062A" to virtual address "0x00A1E064" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "2ED05801000428020000062A" to virtual address "0x00A1DFE0" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "133013004B0000000500001100280500000672690000707E0200000428900000060A0674890000010B170C2B0ED0020000041A1D2E03262B012601084502000000C3FFFFFF000000002B00072A2B000014A5890000012A" to virtual address "0x00A12798" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "133011004B000000010000110002284C000006170A2B08D05D0000061C0A26064503000000DBFFFFFF000000001A0000000002284D00000600180A2BE2D0520000041A1E3103262B01260102284E000006002A2B00002A" to virtual address "0x00A16534" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "4E74436F6E74696E756500" to virtual address "0x00A83C82" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "2ED04501000428020000062A" to virtual address "0x00A1DDCC" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "6E74646C6C2E646C6C0000" to virtual address "0x00A83C8E" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "2E7E5801000428AB0300062A" to virtual address "0x00A1DFEC" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "367E5D010004020328BB0300062A" to virtual address "0x00A1E074" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "2ED04F01000428020000062A" to virtual address "0x00A1DEE4" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "0000000000000000" to virtual address "0x00A101A0" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "2ED05901000428020000062A" to virtual address "0x00A1DFF8" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "00000000" to virtual address "0x00A71690" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "367E450100040203285F0300062A" to virtual address "0x00A1DDD8" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "2ED05701000428020000062A" to virtual address "0x00A1DFC4" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "367E4E010004020328830300062A" to virtual address "0x00A1DED4" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "13301300430000000500001100170C2B06D00D00000626084502000000E7FFFFFF00000000280500000672890000707E0200000428900000060A0674890000010B2B00072A2B000014A5890000012A" to virtual address "0x00A12850" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "56D05C0100042802000006D05D01000428020000062A" to virtual address "0x00A1E04C" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE") "" wrote bytes "133011003900000006000011001F2728EA0000060A170B2B12D00D00000420AF69E7712070E1720F590B26074502000000D3FFFFFF00000000062A2B000014A5030000012A" to virtual address "0x00A13B40" (part of module "623FDFB190B9CD0A1D8729842EFD1EDF41AEC13DDA70E447A69B7F94921A0F88.EXE")26:T4a9,Found malicious artifacts related to "94.102.53.178" (ASN: 29073, Owner: Ecatel Network): ... URL: http://m2coftkce5g4gyza.onion.gq/ (AV positives: 1/67 scanned on 04/26/2016 20:05:02) URL: http://onion.gq/ (AV positives: 1/67 scanned on 04/13/2016 17:02:11) URL: http://4ggxntohlejkutst.onion.gq/ (AV positives: 1/67 scanned on 04/09/2016 19:27:58) URL: http://tzsvejrzduo52siy.onion.gq/ (AV positives: 2/67 scanned on 03/31/2016 05:29:59) URL: http://qtrudrukmurps7tc.onion.gq/ (AV positives: 1/67 scanned on 03/31/2016 05:04:40) File SHA256: c41f7d8c8a866b956ca98f4648c49cd784ccffc7bb62227ffa11c60b7ef8b1eb (AV positives: 32/56 scanned on 04/25/2016 01:32:34) File SHA256: eec2d46cf32f9b8e571a8a4c779235fc20d7b62d2fed8837fdfc77def34af88e (AV positives: 6/55 scanned on 04/24/2016 15:22:11) File SHA256: 5dbec0967c102a8d87acdd5122ea38fa79d94e4f18e90858b2b59fa2a0f7ba93 (AV positives: 32/56 scanned on 04/24/2016 05:17:01) File SHA256: 0990df863d29205c8cd2ab9812c8aa91ae56dab97ce3943603db311332a271f2 (AV positives: 26/48 scanned on 01/18/2014 11:48:02) File SHA256: af445e420d2a20cad409636c1cf5e705d88e628d09a6b377bc1c2be273187cc8 (AV positives: 3/48 scanned on 01/17/2014 07:16:01)27:T11c5,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790505419264,"unified_at":"2026-09-27T10:36:59.264Z","metadata":{"hashes":{"sha256":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","sha1":"7236dc5821b1e9fcde0a227de57f928af5f7edb5","md5":"548bbee5bde54f123e7f3704a3a9116a","sha512":"bf113c90707d38fcbb6ecd0b33cbb564d0c15c37970e293ce2d1f7b8541fb823b3380e02a8c5c5064ee830ef35c9f228f9cd705e22f7651c5ad73b4b5ac3ecca","ssdeep":"6144:l1n1kY7ejab1KDnn5mumMrkPtbFenNP3Fhwg9S1G:r13bKbmMrkyPVhTS1","ssdeep_chunks":["6144:l1n1kY7","6144:1n1kY7e","6144:n1kY7ej","6144:1kY7eja","6144:kY7ejab","6144:Y7ejab1","6144:7ejab1K","6144:ejab1KD","6144:jab1KDn","6144:ab1KDnn","6144:b1KDnn5","6144:1KDnn5m","6144:KDnn5mu","6144:Dnn5mum","6144:nn5mumM","6144:n5mumMr","6144:5mumMrk","6144:mumMrkP","6144:umMrkPt","6144:mMrkPtb","6144:MrkPtbF","6144:rkPtbFe","6144:kPtbFen","6144:PtbFenN","6144:tbFenNP","6144:bFenNP3","6144:FenNP3F","6144:enNP3Fh","6144:nNP3Fhw","6144:NP3Fhwg","6144:P3Fhwg9","6144:3Fhwg9S","6144:Fhwg9S1","6144:hwg9S1G","12288:l1n1kY7","12288:1n1kY7e","12288:n1kY7ej","12288:1kY7eja","12288:kY7ejab","12288:Y7ejab1","12288:7ejab1K","12288:ejab1KD","12288:jab1KDn","12288:ab1KDnn","12288:b1KDnn5","12288:1KDnn5m","12288:KDnn5mu","12288:Dnn5mum","12288:nn5mumM","12288:n5mumMr","12288:5mumMrk","12288:mumMrkP","12288:umMrkPt","12288:mMrkPtb","12288:MrkPtbF","12288:rkPtbFe","12288:kPtbFen","12288:PtbFenN","12288:tbFenNP","12288:bFenNP3","12288:FenNP3F","12288:enNP3Fh","12288:nNP3Fhw","12288:NP3Fhwg","12288:P3Fhwg9","12288:3Fhwg9S","12288:Fhwg9S1","12288:hwg9S1G","6144:r13bKbm","6144:13bKbmM","6144:3bKbmMr","6144:bKbmMrk","6144:KbmMrky","6144:bmMrkyP","6144:mMrkyPV","6144:MrkyPVh","6144:rkyPVhT","6144:kyPVhTS","6144:yPVhTS1"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":540160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294846000,"last_seen":1687899047000,"last_multi_scan":1687899047000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":20,"malicious_count":8,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TrueCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Crypren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/TrueCrypter.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hiddentear.A.056F9246","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hiddentear.A.056F9246 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Filecoder.TrueCrypter.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/TrueCypter.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.MSIL.Trucry.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.ebvzrg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.A4040268","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.A4040268","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoader21.BWFL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypren.Win32.258","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Hiddentear.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"m2coftkce5g4gyza.onion.gq\"\n \"ask.fm\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.235.122.112:443\"\n \"94.102.53.178:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$22","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\system32\\RichEd20.DLL\" at 69300000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 6A8F0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RegCloseKey@ADVAPI32.dll\"\n \"RegOpenKeyEx@ADVAPI32.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegQueryValueEx@ADVAPI32.dll\"\n \"RegQueryValueExW@ADVAPI32.dll\"\n \"ND_RI2@MSCOREE.DLL\"\n \"ND_RI2_RetAddr@mscoreei.dll\"\n \"ND_RI2@mscoreei.dll\"\n \"LoadLibraryShim@MSCOREE.DLL\"\n \"LoadLibraryShim_RetAddr@mscoreei.dll\"\n \"LoadLibraryShim@mscoreei.dll\"\n \"GdiplusStartup@gdiplus.dll\"\n \"GdipCreateFontFromLogfontW@gdiplus.dll\"\n \"ND_RU1@MSCOREE.DLL\"\n \"ND_RU1_RetAddr@mscoreei.dll\"\n \"ND_RU1@mscoreei.dll\"\n \"GdipGetFontUnit@gdiplus.dll\"\n \"GdipGetFontSize@gdiplus.dll\"\n \"GdipGetFontStyle@gdiplus.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00112156-00003772-779F228D-166836","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"4a9bb3797e4ab61c1e23145969273078_e47c61d2-1dae-480e-827a-ae8d797649df\" has type \"data\"\n \"TrueCrypter.xml\" has type \"XML document text\"\n \"TrueCrypter.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Encrypted.dat\" has type \"ASCII text with CRLF line terminators\"\n \"background.jpg\" has type \"JPEG image data JFIF standard 1.01\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.inkscape.org\"\n Heuristic match: \"Email us for any problems: trueransom@mail2tor.com\"\n Pattern match: \"http://chart.apis.google.com/chart?cht=qr&chld=Q|2&chs=200&chl=\"\n Pattern match: \"http://m2coftkce5g4gyza.onion.gq\"\n Pattern match: \"https://ask.fm/innocentask001\"\n Pattern match: \"http://forumforastral.com/innocentuser001\"\n Heuristic match: \"oftkce5g4gyza.onion.gq\"\n Pattern match: \"https://bitcoin.org/en/getting-started\"\n Pattern match: \"mazon.com/gp/product/B004LLIKVU\"\n Pattern match: \"www.localbitcoins.com\"\n Heuristic match: \"or any problems: trueransom@mail2tor.com\"\n Pattern match: \"art.apis.google.com/chart?cht=qr&chld=Q|2&chs=200&chl=\"\n Pattern match: \"forumforastral.com/innocentuser001\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"cgKgyUG+ with unusual entropies 7.79367979935","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00112156-00003772-779F228D-158015","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"%WINDIR%\\System32\\VBoxControl.exe\" (Indicator: \"vbox\")\n \"VMWare\" (Indicator: \"vmware\")\n \"ws\\System32\\VBoxControl.exe\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY DNS Query to .onion proxy Domain (onion.gq)\" (SID: 2020211, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\assembly\\pubpol15.dat\"\n \"\" created file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config\"\n \"\" created file \"%WINDIR%\\FONTS\\TAHOMA.TTF\"\n \"\" created file \"%WINDIR%\\FONTS\\MSJH.TTF\"\n \"\" created file \"%WINDIR%\\FONTS\\MSYH.TTF\"\n \"\" created file \"%WINDIR%\\FONTS\\MALGUN.TTF\"\n \"\" created file \"%WINDIR%\\FONTS\\MICROSS.TTF\"\n \"\" created file \"%WINDIR%\\FONTS\\SEGOEUI.TTF\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"TrueCrypter.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRUECRYPTER\"; Value: \"%APPDATA%\\Microsoft\\TrueCrypter\\TrueCrypter.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00112156-00003772-779F228D-157626","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"In order to decrypt your files you need your\" (Source: 623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe.bin, Indicator: \"decrypt your files\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$23","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\4a9bb3797e4ab61c1e23145969273078_e47c61d2-1dae-480e-827a-ae8d797649df\" with delete access\n \"\" opened \"Z:\\icon.png\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\83aa4cc77f591dfc2374580bbd95f6ba_e47c61d2-1dae-480e-827a-ae8d797649df\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\Crypto\\RSA\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\Crypto\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe.bin\" claimed CRC 347433142 while the actual is CRC 586799","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/56 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/56 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"%APPDATA%\\Microsoft\\TrueCrypter\\TrueCrypter.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$27","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQuerySystemInformation@NTDLL.DLL at 00112156-00003772-779F228D-142830\n NtQuerySystemInformationW@NTDLL.DLL at 00112156-00003772-779F228D-142832\n NtSetSystemInformation@NTDLL.DLL at 00112156-00003772-779F228D-160609","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":63,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"571fc76faac2ed66397b23c9","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["NLD","USA"],"submit_name":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","analysis_start_time":"2016-04-26T15:02:33+00:00","indicators_count":{"informative":10,"suspicious":26,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"571fc76faac2ed66397b23c7","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["NLD","USA"],"submit_name":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","analysis_start_time":"2016-04-26T15:09:56+00:00","indicators_count":{"informative":9,"suspicious":22,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.235.122.112","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"address":"94.102.53.178","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}],"dns_resolutions":[{"domain":"m2coftkce5g4gyza.onion.gq","address":"94.102.53.178","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"domain":"ask.fm","address":"66.235.122.114","country":"United States","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}],"processes":[{"pid":3772,"ppid":0,"name":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe","command_line":"","normalized_path":"Z:\\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe","uid":"00112156-00003772"}],"all_imported_dlls":["ole32.dll","ADVAPI32.dll","USERENV.dll","IPHLPAPI.DLL","IMM32.DLL","fwpuclnt.dll","GDI32.dll","System.ni.dll","System.Windows.Forms.ni.dll","bcryptprimitives.dll","ntdll.dll","rsaenh.dll","wshtcpip.dll","winhttp.dll","shell32.dll","profapi.dll","sechost.dll","PSAPI.DLL","RichEd20.DLL","culture.dll","System.Xml.ni.dll","WS2_32.dll","CFGMGR32.dll","System.Configuration.ni.dll","NSI.dll","ncrypt.dll","DEVOBJ.dll","LPK.dll","KERNELBASE.dll","msvcrt.dll","CRYPTBASE.dll","bcrypt.dll","DNSAPI.dll","System.Drawing.ni.dll","shfolder.dll","dhcpcsvc6.DLL","RPCRT4.dll","mscorwks.dll","mscorjit.dll","mswsock.dll","dhcpcsvc.DLL","USER32.dll","VERSION.dll","SHLWAPI.dll","System.Core.ni.dll","CRYPT32.dll","rasapi32.dll","rasman.dll","USP10.dll","mscoreei.dll","wship6.dll","rasadhlp.dll","mscorlib.ni.dll","MSCOREE.DLL","MSCTF.dll","comctl32.dll","schannel.DLL","IconCodecService.dll","SspiCli.dll","WindowsCodecs.dll","rtutils.dll","security.dll","dwmapi.dll","CRYPTSP.dll","credssp.dll","RpcRtRemote.dll","SECUR32.DLL","GPAPI.dll","KERNEL32.dll","uxtheme.dll","gdiplus.dll","SETUPAPI.dll","OLEAUT32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"4a9bb3797e4ab61c1e23145969273078_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"8694290b793ceeed93c6a602b6662522309fb382a7e953d7660d0e99e9986c55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"Encrypted.dat","sha256":"78871b61b0a52e183ecd6fca7de8b5c0abd3bc2be5f658daa3a4436f4b08ce0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"TrueCrypter.exe","sha256":"623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"TrueCrypter.xml","sha256":"6087919b343c1007669d62cc828b497570c356ab80fa3f13567aa1d57eb3921d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"name":"background.jpg","sha256":"f0df3cc40f228caac13cde314c1870a82a7162fa7dfeeb48e96223141d52d0e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%SAMPLEDIR%\\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe.config","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\4a9bb3797e4ab61c1e23145969273078_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\TrueCrypter","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%SAMPLEDIR%\\623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88.exe","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\TrueCrypter\\TrueCrypter.exe","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\VBoxSolarisAdditions.pkg","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\autorun.sh","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\runasroot.sh","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\32Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\64Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\OS2\\readme.txt","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"D:\\cert\\oracle-vbox.cer","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\TrueCrypter\\Encrypted.dat","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\TrueCrypter\\background.jpg","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"path":"%APPDATA%\\Microsoft\\TrueCrypter\\TrueCrypter.xml","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"571fc76faac2ed66397b23c9"}]}]}},"report_ids":{"sandbox_job_ids":["571fc76faac2ed66397b23c9","571fc76faac2ed66397b23c7"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Ransom.Hiddentear.A.Generic Sample 623fdfb190b9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 623fdfb190b9…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Hiddentear.A.Generic Sample 623fdfb190b9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 623fdfb190b9…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/623fdfb190b9cd0a1d8729842efd1edf41aec13dda70e447a69b7f94921a0f88"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Hiddentear.A.Generic Sample 623fdfb190b9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 623fdfb190b9…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]