24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 631e26376c6e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 631e26376c6e…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6"],"about":{"@type":"SoftwareApplication","name":"bounty-41315788095612662","applicationCategory":["peexe","assembly","executable"],"identifier":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tba0,".exe" touched "Portable Devices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\INPROCSERVER32") ".exe" touched "Computer" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") ".exe" touched "Enhanced Storage Data Source" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") ".exe" touched "Portable Media Devices" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\TREATAS") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER")26:T491,"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"27:T7b5,".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\631E26376C6EEC5070DA9A40C576E0AA99FDC91CC53D0E0EE96D68B8CF3F97E6.INI" ".exe" trying to access non-existent file "C:\CRYPTSP.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" ".exe" trying to access non-existent file "C:\PROPSYS.DLL" ".exe" trying to access non-existent file "C:\631E26376C6EEC5070DA9A40C576E0AA99FDC91CC53D0E0EE96D68B8CF3F97E6.EXE.LOCAL" ".exe" trying to access non-existent file "C:\APPHELP.DLL" ".exe" trying to access non-existent file "C:\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Windows\AppPatch\sysmain.sdb" ".exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL"28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790638283729,"unified_at":"2026-09-28T23:31:23.729Z","metadata":{"hashes":{"sha256":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6","sha1":"f11bf551264fce42609dc6f9d7e3ee8d07ce7fc0","md5":"03fc9038c0848033b60c4b7b44f350bb","sha512":"b04147db7424a13b6cd754dd98d137a3d232ab9e5782328470163cc7de929b5933acf8ad581e42946930af73ed94bc4e76feca3220b05c4b1aae610bf48939e0","ssdeep":"12288:RqeSPxZHRI0aF3IBXDPdQWatLHNn63r/iyAAb8T3rUUUIyP:RaPhITRA+XtLtn6NAAgT3ZyP","ssdeep_chunks":["12288:RqeSPxZ","12288:qeSPxZH","12288:eSPxZHR","12288:SPxZHRI","12288:PxZHRI0","12288:xZHRI0a","12288:ZHRI0aF","12288:HRI0aF3","12288:RI0aF3I","12288:I0aF3IB","12288:0aF3IBX","12288:aF3IBXD","12288:F3IBXDP","12288:3IBXDPd","12288:IBXDPdQ","12288:BXDPdQW","12288:XDPdQWa","12288:DPdQWat","12288:PdQWatL","12288:dQWatLH","12288:QWatLHN","12288:WatLHNn","12288:atLHNn6","12288:tLHNn63","12288:LHNn63r","12288:HNn63r/","12288:Nn63r/i","12288:n63r/iy","12288:63r/iyA","12288:3r/iyAA","12288:r/iyAAb","12288:/iyAAb8","12288:iyAAb8T","12288:yAAb8T3","12288:AAb8T3r","12288:Ab8T3rU","12288:b8T3rUU","12288:8T3rUUU","12288:T3rUUUI","12288:3rUUUIy","12288:rUUUIyP","24576:RqeSPxZ","24576:qeSPxZH","24576:eSPxZHR","24576:SPxZHRI","24576:PxZHRI0","24576:xZHRI0a","24576:ZHRI0aF","24576:HRI0aF3","24576:RI0aF3I","24576:I0aF3IB","24576:0aF3IBX","24576:aF3IBXD","24576:F3IBXDP","24576:3IBXDPd","24576:IBXDPdQ","24576:BXDPdQW","24576:XDPdQWa","24576:DPdQWat","24576:PdQWatL","24576:dQWatLH","24576:QWatLHN","24576:WatLHNn","24576:atLHNn6","24576:tLHNn63","24576:LHNn63r","24576:HNn63r/","24576:Nn63r/i","24576:n63r/iy","24576:63r/iyA","24576:3r/iyAA","24576:r/iyAAb","24576:/iyAAb8","24576:iyAAb8T","24576:yAAb8T3","24576:AAb8T3r","24576:Ab8T3rU","24576:b8T3rUU","24576:8T3rUUU","24576:T3rUUUI","24576:3rUUUIy","24576:rUUUIyP","12288:RaPhITR","12288:aPhITRA","12288:PhITRA+","12288:hITRA+X","12288:ITRA+Xt","12288:TRA+XtL","12288:RA+XtLt","12288:A+XtLtn","12288:+XtLtn6","12288:XtLtn6N","12288:tLtn6NA","12288:Ltn6NAA","12288:tn6NAAg","12288:n6NAAgT","12288:6NAAgT3","12288:NAAgT3Z","12288:AAgT3Zy","12288:AgT3ZyP"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-41315788095612662","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":796816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675693764000,"last_seen":1678960958000,"last_multi_scan":1678960958000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","downloader","guloader","remcos","evasive","gamarue"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":34,"suspicious_count":16,"malicious_count":7,"total":57},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Neshta.lrbn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/MSIL.Assembly.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1255511","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65376060","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.QOZL-6331","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65376060 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AHUA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.RedLine.o","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059e0d61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.MSIL.Androm.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXVK-NC!03FC9038C084","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to start a process"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime"},{"type":"informative","value":"Contains ability to load content into memory"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load content from resource"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to gather system information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Reads the windows installation date"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Tries to retrieve default browser"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Contains ability to use cryptographic services (API string)"},{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function frombase64string in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\n Observed function concat in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\n Observed function tostring in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\n Observed function replace in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace system.management.managementobjectsearcher in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function getenvironmentvariable in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information","description":"Observed function get_machinename in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"sql.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sql.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed API string:\"GetVolumeInformation\" [Source: 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\2.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\2.EXE\")\n \"2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SQL.EXE\")\n \"2.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SQL.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"101.99.91.158:5222\"\n \"94.131.99.153:8080\"\n \"124.88.67.67:5222\"\n \"124.88.67.98:5222\"\n \"94.131.99.153:5222\"\n \"94.131.99.156:5222\"\n \"94.131.99.89:5222\"\n \"94.131.99.56:5222\"\n \"178.23.190.252:8080\"\n \"178.23.190.253:8080\"\n \"178.23.190.54:8080\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function process.start in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\n Observed function processthread.get_starttime in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\")\n \"CloseHandle\" (Indicator: \"CloseHandle\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00002332)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$26","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"2.exe\" (UID: 00000000-00003588)\n Spawned process \"sql.exe\" (UID: 00000000-00000640)\n Spawned process \"iexplore.exe\" (UID: 00000000-00002332)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"2.exe\" (UID: 00000000-00003588)\n Spawned process \"sql.exe\" (UID: 00000000-00000640)\n Spawned process \"iexplore.exe\" (UID: 00000000-00002332)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace system.security.cryptography in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1573","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace system.net in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://sub.domaifn.com/objects.json?api_key=123\"\n Pattern match: \"sub.domain.com/objects.json?api_key=123\"\n Pattern match: \"https://fsub.dofmaifn.com/objects.json?api_key=123\"\n Pattern match: \"sub.domfain.com/objects.json?api_key=123\"\n Pattern match: \"http://google.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://sub.domaifn.com/objects.json?api_key=123\" (Indicator: \"https://\")\n \"https://fsub.dofmaifn.com/objects.json?api_key=123\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariable\" [Source: 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"Observed function CloseHandle in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\n Observed function GetVolumeInformationByHandleW in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\n Observed function CreateFile in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to retrieve default browser","description":"\"sql.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\HTTP\\SHELL\\OPEN\\COMMAND\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-111","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to load content from resource","description":"Observed function resourcemanager.getobject in 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Dotnet file resource with suspicious entropy","description":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin has big resource with size: \"0x77001\" and Entropy:7.99961707207\n 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin has big resource with size: \"0x47c\" and Entropy:7.81017076601","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to use cryptographic services (API string)","description":"Observed class from System.Security.Cryptography:\"DeriveBytes\" which can represents the abstract base class from which all classes that derive byte sequences of a specified length inherit[Source: 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin]\n Observed class from System.Security.Cryptography:\"SymmetricAlgorithm\" which can represents the abstract base class from which all implementations of symmetric algorithms must inherit[Source: 631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin]","origin":"File/Memory","mitre_attack_id":"T1486","relevance":3,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.93987687301","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"FromBase64String\" (Indicator: \"frombase64string\"; File: \"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\")\n \"System.Security.Cryptography\" (Indicator: \"system.security.cryptography\"; File: \"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\")\n \"RijndaelManaged\" (Indicator: \"rijndaelmanaged\"; File: \"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"win32_operatingsystem\"; File: \"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/51 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"2.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"2.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SKYPE_UPD\"; Value: \"\"%USERPROFILE%\\sql\\sql.exe\"\")\n \"2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"2.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SKYPE_UPD\"; Value: \"\"%USERPROFILE%\\sql\\sql.exe\"\")\n \"sql.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"sql.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SKYPE_UPD\"; Value: \"\"%USERPROFILE%\\sql\\sql.exe\"\")\n \"sql.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"sql.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SKYPE_UPD\"; Value: \"\"%USERPROFILE%\\sql\\sql.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 28672 bytes starting with PE header signature to file \"%TEMP%\\2.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"6.9.0.114\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 94.131.99.153 on port 8080 is sent without HTTP header\n TCP traffic to 178.23.190.252 on port 8080 is sent without HTTP header\n TCP traffic to 178.23.190.253 on port 8080 is sent without HTTP header\n TCP traffic to 178.23.190.54 on port 8080 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"\\root\\CIMv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"sql.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"2.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"2.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"2.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")\n \"2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/51 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"47/66 Antivirus vendors marked spawned process \"2.exe\" (PID: 3588) as malicious (classified as \"Generic.Remcos\" with 71% detection rate)\n 47/66 Antivirus vendors marked spawned process \"sql.exe\" (PID: 640) as malicious (classified as \"Generic.Remcos\" with 71% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 11 (or more) hosts in at least 4 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"101.99.91.158\": ...\n\n File SHA256: ca408a4f313a8dc8afe42b490e74b345d758bc319c0b5b251f03fed84e8deb0e (Date: 02/06/2023 11:49:16)\n File SHA256: c80c3ffd9e3b1217c832dd5e6e891cda (Date: 08/03/2022 04:01:33)\n File SHA256: a4a564d6706e40334cace5d5254291ab267cf2ef0383cf26f219ea11f316b207 (Date: 08/03/2022 04:01:33)\n File SHA256: fe96570f28fd39e0d5e8f6c25333160bd2952254 (Date: 08/03/2022 04:01:33)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 101.99.91.158 on port 5222\n TCP traffic to 94.131.99.153 on port 8080\n TCP traffic to 124.88.67.67 on port 5222\n TCP traffic to 124.88.67.98 on port 5222\n TCP traffic to 94.131.99.153 on port 5222\n TCP traffic to 94.131.99.156 on port 5222\n TCP traffic to 94.131.99.89 on port 5222\n TCP traffic to 94.131.99.56 on port 5222\n TCP traffic to 178.23.190.252 on port 8080\n TCP traffic to 178.23.190.253 on port 8080\n TCP traffic to 178.23.190.54 on port 8080","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Persists itself using auto-execute at a hidden registry location"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the windows installation date"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","credentialharvesting","criminal","downloader","guloader","remcos","evasive","gamarue"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"63e1188dfe6994473062f9a4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VHO:Backdoor.MSIL.Androm","contacted_countries":["CHN","MYS","NLD","UKR"],"submit_name":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.exe","analysis_start_time":"2023-02-06T15:11:10+00:00","indicators_count":{"informative":34,"suspicious":17,"malicious":7},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"101.99.91.158","port":5222,"protocol":"TCP","country":"Malaysia","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"94.131.99.153","port":8080,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"124.88.67.67","port":5222,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"124.88.67.98","port":5222,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"94.131.99.153","port":5222,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"94.131.99.156","port":5222,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"94.131.99.89","port":5222,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"94.131.99.56","port":5222,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"178.23.190.252","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"178.23.190.253","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"address":"178.23.190.54","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}],"processes":[{"pid":3492,"ppid":0,"name":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.exe","command_line":"","sha256":"631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6","normalized_path":"C:\\631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6.exe","uid":"00000000-00003492","icon":"$28"},{"pid":3588,"ppid":3492,"name":"2.exe","command_line":"","sha256":"ca408a4f313a8dc8afe42b490e74b345d758bc319c0b5b251f03fed84e8deb0e","normalized_path":"%TEMP%\\2.exe","parent_uid":"00000000-00003492","uid":"00000000-00003588"},{"pid":640,"ppid":3588,"name":"sql.exe","command_line":"","sha256":"ca408a4f313a8dc8afe42b490e74b345d758bc319c0b5b251f03fed84e8deb0e","normalized_path":"%USERPROFILE%\\sql\\sql.exe","parent_uid":"00000000-00003588","uid":"00000000-00000640"},{"pid":2332,"ppid":640,"name":"iexplore.exe","command_line":"","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\internet explorer\\iexplore.exe","parent_uid":"00000000-00000640","uid":"00000000-00002332"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%USERPROFILE%\\sql","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]},{"key":"HKCU\\SOFTWARE\\RGH-LGM50O\\\\","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\RGH-LGM50O\\INJ\\INJ","sources":[{"report_type":"sandbox","report_id":"63e1188dfe6994473062f9a4"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["63e1188dfe6994473062f9a4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 631e26376c6e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 631e26376c6e…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 631e26376c6e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 631e26376c6e…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/631e26376c6eec5070da9a40c576e0aa99fdc91cc53d0e0ee96d68b8cf3f97e6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 631e26376c6e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 631e26376c6e…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]