24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T496,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 67c62a887797… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 67c62a887797…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5"],"about":{"@type":"SoftwareApplication","name":"VirusCorreos_ypulfbik.exe","applicationCategory":["peexe","executable"],"identifier":"67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tba5,Found malicious artifacts related to "146.255.36.1" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://buildingsupportibiza.com/ (AV positives: 2/67 scanned on 05/13/2016 08:20:55) URL: http://smokeradio.co.uk/ (AV positives: 1/67 scanned on 05/08/2016 04:38:05) URL: http://www.the-running-clinic.co.uk/contact-us/ (AV positives: 4/67 scanned on 05/06/2016 15:11:45) URL: http://www.the-running-clinic.co.uk/testimonials/ (AV positives: 4/67 scanned on 05/06/2016 15:10:27) URL: http://istoriamilitara.org/ (AV positives: 1/67 scanned on 05/06/2016 01:07:43) File SHA256: ea3a09df83890cd606b7443eed40d35aab52f92ee79164578080071d37c3523b (AV positives: 37/57 scanned on 05/13/2016 12:50:57) File SHA256: e913d2db48717d21312d1a37cced6117c2b6a509abfee5cf4bb205a5e21c193b (AV positives: 38/57 scanned on 05/13/2016 12:45:11) File SHA256: 8c33a75c77a23951e295adfaeacadcff12e93773337b7a565744df7cc9994728 (AV positives: 38/57 scanned on 05/12/2016 18:56:00) File SHA256: f5a3fe05a1fae78f97127a0d27f111aff87c367b6cb8f8d054556e3b3c0dbc75 (AV positives: 4/55 scanned on 05/12/2016 03:27:37) File SHA256: 86bcb7dc6f794a8f556349b38f5aef2c067c3f2e90d4180d8793c57db3964e6c (AV positives: 8/57 scanned on 05/11/2016 21:39:13) Found malicious artifacts related to "86.59.21.38" (ASN: 3248, Owner: Tele2 Telecommunication GmbH): ... URL: http://86.59.21.38/ (AV positives: 2/67 scanned on 05/12/2016 16:12:39) URL: https://86.59.21.38/ (AV positives: 1/67 scanned on 04/24/2016 15:19:01) URL: http://86.59.21.38/topic2.php (AV positives: 2/67 scanned on 04/13/2016 13:42:07) URL: http://86.59.21.38/topic.php (AV positives: 2/67 scanned on 04/13/2016 13:39:02) URL: http://86.59.21.38/tor/keys/fp/27B6B5996C426270A5C95488AA5BCEB6BCC86956/ (AV positives: 2/67 scanned on 03/03/2016 10:04:05) File SHA256: cfdd46b0c5bac6c71541c072146a2fe2b9ee22f3a0d8158db7595ac920464b3e (AV positives: 12/57 scanned on 05/12/2016 23:37:22) File SHA256: 37936a81ac944d4c3fbd7a87c0eae816c4e02b8b53030833604949845462ee08 (AV positives: 53/57 scanned on 05/12/2016 15:28:05) File SHA256: e7d735249eab2abd9dc8086933bcc697a23cef0026312c24e2243a0b6feee56f (AV positives: 7/57 scanned on 05/12/2016 11:44:47) File SHA256: 7f58303c1db332c775e53a832e8fb2719d4cef637d8755a0c911cc4472a8c729 (AV positives: 6/57 scanned on 05/11/2016 08:15:10) File SHA256: 9df017b613bc998f03b04e5b623660a04ee8b0bb446187cf8321dd4b658f4732 (AV positives: 22/57 scanned on 05/10/2016 16:27:36) Found malicious artifacts related to "192.95.25.202" (ASN: 16276, Owner: OVH SAS): ... URL: http://192.95.25.202/ (AV positives: 1/66 scanned on 01/08/2016 16:59:59) File SHA256: a9b72126b09553f499c1ababf9885e417a3d37afa3f3b58f225baaf5a723f271 (AV positives: 51/56 scanned on 10/07/2015 23:00:10) Found malicious artifacts related to "148.251.100.168" (ASN: 24940, Owner: Hetzner Online AG): ... File SHA256: 9b0b2b278879bef49f841254559d2b374e98d2910475cba9b95d0c05d06e1bee (AV positives: 55/57 scanned on 04/19/2016 03:26:13)26:Tba5,Found malicious artifacts related to "146.255.36.1" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://buildingsupportibiza.com/ (AV positives: 2/67 scanned on 05/13/2016 08:20:55) URL: http://smokeradio.co.uk/ (AV positives: 1/67 scanned on 05/08/2016 04:38:05) URL: http://www.the-running-clinic.co.uk/contact-us/ (AV positives: 4/67 scanned on 05/06/2016 15:11:45) URL: http://www.the-running-clinic.co.uk/testimonials/ (AV positives: 4/67 scanned on 05/06/2016 15:10:27) URL: http://istoriamilitara.org/ (AV positives: 1/67 scanned on 05/06/2016 01:07:43) File SHA256: ea3a09df83890cd606b7443eed40d35aab52f92ee79164578080071d37c3523b (AV positives: 37/57 scanned on 05/13/2016 12:50:57) File SHA256: e913d2db48717d21312d1a37cced6117c2b6a509abfee5cf4bb205a5e21c193b (AV positives: 38/57 scanned on 05/13/2016 12:45:11) File SHA256: 8c33a75c77a23951e295adfaeacadcff12e93773337b7a565744df7cc9994728 (AV positives: 38/57 scanned on 05/12/2016 18:56:00) File SHA256: f5a3fe05a1fae78f97127a0d27f111aff87c367b6cb8f8d054556e3b3c0dbc75 (AV positives: 4/55 scanned on 05/12/2016 03:27:37) File SHA256: 86bcb7dc6f794a8f556349b38f5aef2c067c3f2e90d4180d8793c57db3964e6c (AV positives: 8/57 scanned on 05/11/2016 21:39:13) Found malicious artifacts related to "86.59.21.38" (ASN: 3248, Owner: Tele2 Telecommunication GmbH): ... URL: http://86.59.21.38/ (AV positives: 2/67 scanned on 05/12/2016 16:12:39) URL: https://86.59.21.38/ (AV positives: 1/67 scanned on 04/24/2016 15:19:01) URL: http://86.59.21.38/topic2.php (AV positives: 2/67 scanned on 04/13/2016 13:42:07) URL: http://86.59.21.38/topic.php (AV positives: 2/67 scanned on 04/13/2016 13:39:02) URL: http://86.59.21.38/tor/keys/fp/27B6B5996C426270A5C95488AA5BCEB6BCC86956/ (AV positives: 2/67 scanned on 03/03/2016 10:04:05) File SHA256: cfdd46b0c5bac6c71541c072146a2fe2b9ee22f3a0d8158db7595ac920464b3e (AV positives: 12/57 scanned on 05/12/2016 23:37:22) File SHA256: 37936a81ac944d4c3fbd7a87c0eae816c4e02b8b53030833604949845462ee08 (AV positives: 53/57 scanned on 05/12/2016 15:28:05) File SHA256: e7d735249eab2abd9dc8086933bcc697a23cef0026312c24e2243a0b6feee56f (AV positives: 7/57 scanned on 05/12/2016 11:44:47) File SHA256: 7f58303c1db332c775e53a832e8fb2719d4cef637d8755a0c911cc4472a8c729 (AV positives: 6/57 scanned on 05/11/2016 08:15:10) File SHA256: 9df017b613bc998f03b04e5b623660a04ee8b0bb446187cf8321dd4b658f4732 (AV positives: 22/57 scanned on 05/10/2016 16:27:36) Found malicious artifacts related to "192.95.25.202" (ASN: 16276, Owner: OVH SAS): ... URL: http://192.95.25.202/ (AV positives: 1/66 scanned on 01/08/2016 16:59:59) File SHA256: a9b72126b09553f499c1ababf9885e417a3d37afa3f3b58f225baaf5a723f271 (AV positives: 51/56 scanned on 10/07/2015 23:00:10) Found malicious artifacts related to "148.251.100.168" (ASN: 24940, Owner: Hetzner Online AG): ... File SHA256: 9b0b2b278879bef49f841254559d2b374e98d2910475cba9b95d0c05d06e1bee (AV positives: 55/57 scanned on 04/19/2016 03:26:13)27:Tf3c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAsASURBVFhHnZfrT5vpmcaRKlX7pR9W+0fs9ks/7Ha7atWsVHVUVe1uNdqOttOoM9nJTJNMyAQSAoSTOYVDDJhwigFz8BHbmHA0YDABGzAGYxuwDcYnMKdwPmQmM/346/MSTUfdne6ktXRLL/bLc1/39Vz3c19PSsobfj799FN2d3cJhULMz88zPT3N1NQUk5OTOBwOZmdn8Xq9xONxTk5OeMNlv/m109NT1tbWGB0eRlXfQJ0sh/r8NJoK79BW/gnaqnsYFCWo5SW0VspoUVTQbdAKkG729vb+diCvXr1iY2ODEesw9RWPkT+4z9OKe+j19+mzFWCbLWfSV8tsUEUk4icSCrDimWNqyIKh6TFKeSFd2k6Wl5c5Ozv764BIVUt0qpQtFH98l6aye1gGSxj3tuCNDbG+62bzIMDOUZi9kzinZ8eXSU7E/+3v7xONR/DMPmdAU0+zohT7+Nibs3FwcMD4+DhlOUU8Sr3Ds94KZlb0rG3PsHO4ztHZHidnB5yeH4o44uz8mIuLc16+fHkZFyLOz88vdbC7s43HMUR7XTFmo/6S0f9306XKpeSlD4uoyZfRP1yNN9zP1qaXo8MkJ8d7HB1sc3S0w+FOgoPdOEf7m5ydHHG6t8vF2SlnhwKceD4RyU9FMS+EDjyucVpqcjF1aS+F/LUgPvvss0vaywvKqMovZniiHX9UUJfwsdFvZGdqjMNwgG23g80JK/EBI9uL08R6tLxY8RLVtnIUjxLRtLIzM0XMrCXQVC0YOmdHgHFO9KKsycFmG/36LkkkErSp2nn4USZd3ZXMBPQcnGxyEltjVSzkK7hPzKQm2tdFcn6KVa2SVaOKte4OktMTuG6/z65/kXivmUhXJ/7aCpbMerE9F0jMJjfjOMwNNFaV4Pf7+OKLL75iQnphZGSEjFtZNCrL6Hcr8K0Pcv7yBQdBL15lDb1Zdyj98b8w2dGMtTCTvoJ0ZjrrKPv+d5kS35Vc+T4h1wzNb/+MBYuR1hvXyH7ryiWAC8HCYTJBeFRPT30eBtEdOzs7XwFYXV1FUfWEjJsPaB3LpW+xFn98lOOLLfaifryDJsJLbnKuvsNEfzc2QxtNOWmYmipRZKXiGB5Adv19QqKyzuICzPW1KAtyMNTVvgZwuM9J0MPmpAmHrpzWmmJcLtdrAJJyR0dHybiTQ5EQSruriAFfK4sxOy9Ei128OuDVH874/A8XfPbqXOzpIXtHG2wfRtjcXxXtGOLoRAhPsCiF1I5fxrl4PheivIivchaYY3+un6Ctke6mQiFIvRDzESkSFS3Nrdz+6CGllkyUc0WYvA3YV82i3xc4ON3i9OU+Zy+lljti/3hbJF4n8SJE7EWA6N4KB0cvOD4+uRTXl3F6eiK6YI+LWIDzdR+nwRmOfSMkZ9U4LDWomp6wvr5OSjAY5FFxJe/dzuQ33alcsxdwf/oJ1R4DpuA47s0Aod0Ekb0dQlvbLEQTuMIxJldD2II+hkMeJpaWsC+6sXunsfvGGVu0Yp1+RvdQJ/r+dlSWdqo0KgpaWvmkSsnVh3XczXnMzMwMKdJgyc0u4mrGPd4x3+Dd8TxuORXkuTuo9w9gXHMyEltiajOCYzPJeGKboegmfZEY3ZEQxugyOrsdzaCZ9iE1raOdNPSoUXSpeWzQUKLTkN2uJrVJzYd1nbxT3s6Ve628ffsJVquVFGmqZd6XcaswnftDv+cTZy5ZrmrKFttoWLbQEbJiWnfSH/MyFA8wIHrdFEnQFd7AGF5HF/ahsfWjEtU29HVSLVqwQq+mvEvDIxEyvYYstYa0Ng2pKjXX6jp4K6eVt37fQE9PDynSSM1ILyRVfpeMsZvIXHk8XqxGudyBRujALNqxTwhyMOFkIOFiaMNLnwBijkZRrycxRlZoGTdSO6hGbtFQIaJMHE5lz3SU9uiQdWvJNWnJEhPynlbDB8pOfl7YypUPmzCZTKRI8zwjXcZdASDffovHAkCz9wn6FTW9az2MRkeZiD8X9M8wm5zHlfQyt7UsnoM4oquMRTx0LVgwLprQL5rpcJlpmjLSOGmkQbTdE7uRagGwcrQLWb+Ojzs7+Y9HKn5yq+U1AMlMZN4v4EZJOncHbpHtlFHmaaR+SScYGBB0j9MTddAfdTOaWGIsvsZYKM5oIMnwckSIcJnxOQeOxVHsHgujXhNWAcY8Y0DrNKCa1PN0XE+dTU+VVUe2oZNfV7TxqzTl6y2QnMzDzAKupaXzfttNbvcXk2NvpnLGjFIs2uafwrCywLOlFUaDUYYDWzzzxOhfjtO3HKYvEGJgzod1xoHLN8n8yghOfw82j4nBBSOWuS60U3qxTQLAgACg6eS3lW28n1nPsDA5KdIAKiwo5r3r6fy68Aa/ayvhtrmVgpFeFFPPaZ1bEOfCqki2wVhwh4nQDsXGYXoCh5h9+zydOCCz95CfZlajE3sdCC+yGHrO3MqgAGJhzGumf96IftJA3aCOB+2dvFvaRrpMmBlRfEosFkOhUPDh9Ux+mXWT/3xawoeihYpGbDQ6F9C41+j2bWBdERMtvMtMdJu6nnEmNqA/DE1u+HgY/undDEofPWJ1PcjKmgdf0MnC0gjTXgvjHjPPpg00Cg1kNLfzXnEL8lqlcFIRUo6Pjy/FcCf1Pv+d9oBf1VVyQ2+hZHiGJscKhvkYff4kttA2c/FdFjf3aOy1i/MAIVJolABY4R8FgPLySqKJOOtCnMGwF3/AyZzPyqTQRq/DQL1Fy506FTdlTXR1GV8fxdLH7XZTVFjM9ZtZQiA1XO/spaBvjsaJID1ivwcF/c/DW3g2d7HHtqjodYouQWgEUkX1/9wO/3C1mKzqetZEVbFElHBEMBFaYN4/wXN3L91CA3IxBW+WtyErU3w1jCQA0jzQ6XTcuZ3OB3lPuKo0kdU9Sf2Yn17Putj7BI5IEv/WHtcGnfyi/5C3B+F7Gvh2LaQoRNQf8J1sBQ1NSpE8QjgaZmXVj9vvwCaO5c4+LYXKdu7I6tFodX8+jiUQfr+fyspKUu8W8D+PVXys7UduncXsDmAX6p+PJ1nZ3uO5Z5EfVov+fXpMSrNILMXTC77922z+9Qf/xsDAkDClCdZiEaEDPw73BBarCYXo/wx5B4/lNcKQ+P+vLZOmmM1mIyszm9TsR9ys15DXLdpwaoFBf5D52AZrO3skDg6xzy/wE7mOb7Uc8C3lPn/3X2lc+enPRF/3CeO5RTSWYFkMOdfCHEMjfTRr1eTVqMgtrGBsbOwvX1y2t7eF79eT8SCb9IIa7jXrkA/ZMbg8PA+tsSSGUezFPpuHh0wuePj38g7+/jdp/OBHP75MnkzuiZvRFsFgmDm3RxQ0htagp1jRRl5x1aXY/6Ip/dKpSq2h1Wp58CCLNOGOZR1maq1jYisWcKyusZxMEhbONi78//DEBB989BF6g1kk3iYhJuVKYJ05l5eRYTs6QzfF1W3kysowGo3i98SbXVCSIsnQ0BAlJSXcvfeAnJpGqnoH0Did2MTsnxVGwrshaE5uEhCxEojj864zPxdkwu7GYrGjaBRCzpNTUfGa9m+s/H979UNBs+QVVCoVefnCpGTnkq+oo8ZkRi3uDpbZGYYWFxj2ehgcnqe724labRUHjE5ULKeopEz8rcbn8/3tl9XPP//88jYjDSxpsfLycnLy8snKFyErIKeokJziIh7mlogoJV9Wilwux2AwXB6zkqb+zH5/813469+QFpHufNLVXPIPg4ODgmbLpaikkJ4ldyOZG8nn/emEe4OEfwSfLmOEAmgujQAAAABJRU5ErkJggg==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ARERERERERERERERERERERERERERERERERGREREREREREREREREREREiERERERERERERERERERER4hERERERERERERERERERHiIREREREREREREREREREaIiERERERERERERERERERniIhARERERERERERERmd3eIiIdmRERERERERERniIiIiIiIiHZERERERERHiIiIiI/4iIiIdERERERGeIiIiIiIj4iIiIdkREREaIiI//hEZmZI+IiIdERERIiIj///hERGj4iIiIdEREeIj/////dER//4j4iIdERIiP/////2REf////4iIREeIj/////9kRH/////4iHRIiP//////dER//////4iESIj//////3REf/////+IhEiP//////90RH//////+IRIj///////dER///////iESI///////2REj//////4hEiP/////4RERH//////+IRIj/////90ZkSP//////+ESI//////////////////dEiI////////////////+ERIiP//////hnf///////cESIj//////0R0j/////+AREiIj/////hERH/////4RERIiIj/////YAT/////hkRESIiI//////iP////90ZEREiIiPiI////////90hGRERIiIj4iPj/////90hIRkRET//4P///8D///+A////Af///gD//+AAP/+AAA//AAAH/AAAAfgAAAD4AAAA8AAAAGAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAA8AAAAPgAAAP4AAAH/gAAH/+AAD//wAD/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791896541019,"unified_at":"2026-10-13T13:02:21.019Z","metadata":{"hashes":{"sha256":"67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5","sha1":"f12c51ca47b1d3a188bbb55b347bcd9de26d7f66","md5":"1bf1e8d1392c94f8b1c7fa225f3a3d2b","sha512":"1aeb4b53378170fba3673f7bfbadc93a393ea0c9ce0e6130141a92eab61eb4867b13543d87c5ac593b0d3595519c7c0a758507b076d0a6d90da396b2a1b1586a","ssdeep":"6144:bg1KQjoI4Yj8i9czNJQa2xBhdbLEgZbQCAXRfOfyTpi4:lI4Yj8I0JQNJBLH1M/i4","ssdeep_chunks":["6144:bg1KQjo","6144:g1KQjoI","6144:1KQjoI4","6144:KQjoI4Y","6144:QjoI4Yj","6144:joI4Yj8","6144:oI4Yj8i","6144:I4Yj8i9","6144:4Yj8i9c","6144:Yj8i9cz","6144:j8i9czN","6144:8i9czNJ","6144:i9czNJQ","6144:9czNJQa","6144:czNJQa2","6144:zNJQa2x","6144:NJQa2xB","6144:JQa2xBh","6144:Qa2xBhd","6144:a2xBhdb","6144:2xBhdbL","6144:xBhdbLE","6144:BhdbLEg","6144:hdbLEgZ","6144:dbLEgZb","6144:bLEgZbQ","6144:LEgZbQC","6144:EgZbQCA","6144:gZbQCAX","6144:ZbQCAXR","6144:bQCAXRf","6144:QCAXRfO","6144:CAXRfOf","6144:AXRfOfy","6144:XRfOfyT","6144:RfOfyTp","6144:fOfyTpi","6144:OfyTpi4","12288:bg1KQjo","12288:g1KQjoI","12288:1KQjoI4","12288:KQjoI4Y","12288:QjoI4Yj","12288:joI4Yj8","12288:oI4Yj8i","12288:I4Yj8i9","12288:4Yj8i9c","12288:Yj8i9cz","12288:j8i9czN","12288:8i9czNJ","12288:i9czNJQ","12288:9czNJQa","12288:czNJQa2","12288:zNJQa2x","12288:NJQa2xB","12288:JQa2xBh","12288:Qa2xBhd","12288:a2xBhdb","12288:2xBhdbL","12288:xBhdbLE","12288:BhdbLEg","12288:hdbLEgZ","12288:dbLEgZb","12288:bLEgZbQ","12288:LEgZbQC","12288:EgZbQCA","12288:gZbQCAX","12288:ZbQCAXR","12288:bQCAXRf","12288:QCAXRfO","12288:CAXRfOf","12288:AXRfOfy","12288:XRfOfyT","12288:RfOfyTp","12288:fOfyTpi","12288:OfyTpi4","6144:lI4Yj8I","6144:I4Yj8I0","6144:4Yj8I0J","6144:Yj8I0JQ","6144:j8I0JQN","6144:8I0JQNJ","6144:I0JQNJB","6144:0JQNJBL","6144:JQNJBLH","6144:QNJBLH1","6144:NJBLH1M","6144:JBLH1M/","6144:BLH1M/i","6144:LH1M/i4"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"VirusCorreos_ypulfbik.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":368642,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294321000,"last_seen":1677024513000,"last_multi_scan":1677024513000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":20,"malicious_count":11,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MDA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3231199","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3231199 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.TorrentLocker.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.Win32.Androm.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.dwb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.ecowwg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.368642.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_CRILOCK.Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_CRILOCK.Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.ZPJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00044890-00002252-13351-199-00406FCA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00042582-00001192-65263-70-004042B1\n GetDiskFreeSpaceA@KERNEL32.DLL at 00042582-00001192-7113-74-004042B1","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ipecho.net\"\n \"azghalak.closedoors.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"85.143.218.41:443\"\n \"146.255.36.1:80\"\n \"176.149.45.83:443\"\n \"86.59.21.38:443\"\n \"192.95.25.202:9001\"\n \"148.251.100.168:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsfA9D0.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\BirdmanSkeleton.x\"\n \"\" created file \"%TEMP%\\Henbane.kfE\"\n \"\" created file \"%TEMP%\\BgWorker.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\asyrujejisidabekupexahy\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\ilypaculypyvoquhidopilyfehifesy\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /plain HTTP/1.1\nAccept: */*\nHost: ipecho.net\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" (UID: 00046380-00000736)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00047269-00000372)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"BirdmanSkeleton.x\" has type \"data\"\n \"TarB14B.tmp\" has type \"data\"\n \"00000000\" has type \"data\"\n \"01000000\" has type \"data\"\n \"02000000\" has type \"data\"\n \"BgWorker.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"plain[1].htm\" has type \"ASCII text with no line terminators\"\n \"Tar9BC3.tmp\" has type \"data\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"yperetwh.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"Henbane.kfE\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"CabB14A.tmp\" has type \"Microsoft Cabinet archive data 49640 bytes 1 file\"\n \"Cab9C6F.tmp\" has type \"Microsoft Cabinet archive data 49640 bytes 1 file\"\n \"Cab9BC2.tmp\" has type \"Microsoft Cabinet archive data 49640 bytes 1 file\"\n \"Tar9C70.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Heuristic match: \"ipecho.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00044890-00002252-00000105-111830445","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00044890-00002252-13351-16-004062C6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00042582-00001192-65263-7-00405BDF\n GetVersion@KERNEL32.DLL at 00042582-00001192-7113-7-00405BDF\n GetVersionExW@KERNEL32.DLL at 00044890-00002252-13351-110-00403C30","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00044890-00002252-13351-111-00404880\n GetProcessHeap@KERNEL32.DLL at 00044890-00002252-13351-197-00406787","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 207\" (SID: 2522412, Rev: 2550, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 164\" (SID: 2522326, Rev: 2550, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 606\" (SID: 2523210, Rev: 2550, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 286\" (SID: 2522570, Rev: 2550, Severity: 2) categorized as \"Misc Attack\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"\" created file \"C:\\Windows\\system32\\OLEACCRC.DLL\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\system32\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"BgWorker.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"yperetwh.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"188.138.33.220\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00042582-00001192-65263-80-00404FE4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe\" marked \"%TEMP%\\nsdA8FD.tmp\" for deletion\n \"C:\\67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe\" marked \"%TEMP%\\nsfA9D0.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsdA8FD.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsfA9D0.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00044890-00002252-13351-123-00403900","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n GetFileAttributesA\n CreateDirectoryA\n GetFileSize\n GetModuleFileNameA\n CopyFileA\n GetTempPathA\n Sleep\n LoadLibraryA\n CreateThread\n CreateProcessA\n CreateFileA\n GetTempFileNameA\n GetProcAddress\n GetModuleHandleA\n GetCommandLineA\n LoadLibraryExA\n FindFirstFileA\n FindNextFileA\n DeleteFileA\n WriteFile\n FindWindowExA\n ShellExecuteA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n VirtualAlloc\n VirtualProtect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"2b453376f99c327678eb31767989317693973276d3333376a41d3376d0d9327611a632765c39337641cf3276e19c32760e453376b62f33764123327600bf327600000000473f637700000000ec227c7799e5797700000000\" to virtual address \"0x10003000\" (part of module \"SYSTEM.DLL\")\n \"\" wrote bytes \"bc883276e19c3276d333337641cf327646ce32760000000094987a7651c17a76ee9c7a76ec328476000000001564657700000000\" to virtual address \"0x003D3000\"\n \"\" wrote bytes \"08579b760478a4760000000051c17a7694987a76ee9c7a7675dc7c76273e7c76efb280760000000046ce3276013d337638ed3376cfcd327631233276de2f3376c4ca327680bb327652ba32769fbb327692bb327646ba32760abf327600000000\" to virtual address \"0x70031000\" (part of module \"SHFOLDER.DLL\")\n \"\" wrote bytes \"c2000000\" to virtual address \"0x1000404C\" (part of module \"SYSTEM.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/56 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe\"\n \"\" allocated memory in \"%WINDIR%\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00046380-00000736)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 11264 bytes starting with PE header signature to file \"%TEMP%\\nsfA9D0.tmp\\System.dll\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"\" wrote 28672 bytes starting with PE header signature to file \"%TEMP%\\BgWorker.dll\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000d00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 192.95.25.202 on port 9001","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00047269-00000372)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00042582-00001192-65263-1-004030B6","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtClose@NTDLL.DLL at 00044890-00002252-13351-104-004037F0\n NtClose@NTDLL.DLL at 00044890-00002252-13351-93-00402E30\n NtClose@NTDLL.DLL at 00044890-00002252-13351-105-00402A20\n NtClose@NTDLL.DLL at 00044890-00002252-13351-108-00404810\n NtClose@NTDLL.DLL at 00044890-00002252-13351-68-00402A90\n NtClose@NTDLL.DLL at 00044890-00002252-13351-53-00404A00\n NtClose@NTDLL.DLL at 00044890-00002252-13351-100-00402F90","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":43,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":38,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5735d890aac2ed2f187b23c7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM42.0.Malware","contacted_countries":["AUT","CAN","DEU","FRA","NLD","RUS"],"submit_name":"VirusCorreos_ypulfbik.exe","analysis_start_time":"2016-05-13T15:44:05+00:00","indicators_count":{"informative":12,"suspicious":27,"malicious":13},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"85.143.218.41","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"address":"146.255.36.1","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"address":"176.149.45.83","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"address":"86.59.21.38","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"address":"192.95.25.202","port":9001,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"address":"148.251.100.168","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}],"dns_resolutions":[{"domain":"ipecho.net","address":"146.255.36.1","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"domain":"azghalak.closedoors.net","address":"85.143.218.41","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}],"http_requests":[{"host":"ipecho.net","host_ip":"146.255.36.1:80","url":"/plain","method":"GET","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}],"processes":[{"pid":1192,"ppid":0,"name":"67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe","command_line":"","normalized_path":"C:\\67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe","uid":"00042582-00001192","icon":"$27"},{"pid":2252,"ppid":1192,"name":"67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe","command_line":"","normalized_path":"C:\\67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe","parent_uid":"00042582-00001192","uid":"00044890-00002252","icon":"$28"},{"pid":736,"ppid":2252,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00044890-00002252","uid":"00046380-00000736","icon":"$29"},{"pid":372,"ppid":736,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00046380-00000736","uid":"00047269-00000372"}],"all_imported_dlls":["gdi32.dll","lpk.dll","cryptbase.dll","setupapi.dll","devobj.dll","crypt32.dll","wininet.dll","ntdll.dll","msctf.dll","urlmon.dll","rsaenh.dll","KernelBase.dll","rpcrt4.dll","uxtheme.dll","ntmarta.dll","msasn1.dll","ieframe.dll","user32.dll","advapi32.dll","sechost.dll","imm32.dll","oleaut32.dll","kernel32.dll","msvcrt.dll","shlwapi.dll","ole32.dll","clbcatq.dll","cfgmgr32.dll","profapi.dll","psapi.dll","shell32.dll","version.dll","cryptnet.dll","iertutil.dll","cryptsp.dll","usp10.dll","comctl32.dll","shfolder.dll","propsys.dll","Wldap32.dll","System.dll","apphelp.dll","oleacc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"00000000","sha256":"542b8c5efdaf6d1126580e499f0efa598395a20808c150e4feda0c933a6783e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"01000000","sha256":"272f955c92b632c845a2bb0a8f3f1d47265c674268579d04b4768b2954dca42b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"02000000","sha256":"76e550d7be6c45808877e3297c823992b902208d16a2fc4fa5a31c7384fe9f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"plain[1].htm","sha256":"e38ee7ad0d45a01a4d35a323398574a53313d96a76b8d763cc444bf7624a0576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"153b1bd0e73f485b21e3cc1eedef191f94fe9fb48cfef0eaaecfaa64a7b87e13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"BgWorker.dll","sha256":"4cd8560ed87785afeac12298d7aaffe9c93c2853c36cf220315a47ca891e4c31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"BirdmanSkeleton.x","sha256":"ef26c5ed1f7f3726f0b522c8f7dffb0b167a0bdae1094912fe3a33248dcca075","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Cab9BC2.tmp","sha256":"3900d716c8c7f96277858c205f813331cd34e23b005eb4039c2061bbe7340226","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Cab9C6F.tmp","sha256":"3900d716c8c7f96277858c205f813331cd34e23b005eb4039c2061bbe7340226","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"CabB14A.tmp","sha256":"3900d716c8c7f96277858c205f813331cd34e23b005eb4039c2061bbe7340226","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Henbane.kfE","sha256":"3cd8bbbfafd91e9bf1b31684fed87bd65f4771ad702522e6f3194a648ca2a135","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Tar9BC3.tmp","sha256":"81e9664c71a6d19c53203bee8e1afe09a9304e1b520d92b3d3fd5519da88d541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"Tar9C70.tmp","sha256":"81e9664c71a6d19c53203bee8e1afe09a9304e1b520d92b3d3fd5519da88d541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"TarB14B.tmp","sha256":"81e9664c71a6d19c53203bee8e1afe09a9304e1b520d92b3d3fd5519da88d541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"yperetwh.exe","sha256":"67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}],"files_written":[{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\nsfA9D0.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\BgWorker.dll","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\nsfA9D0.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\Henbane.kfE","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\BirdmanSkeleton.x","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"C:\\67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5.exe","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%ALLUSERSPROFILE%\\ylyvycolyqygeluh","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%ALLUSERSPROFILE%\\ylyvycolyqygeluh\\01000000","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%WINDIR%\\system32","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%WINDIR%\\yperetwh.exe","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%ALLUSERSPROFILE%\\ylyvycolyqygeluh\\02000000","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%ALLUSERSPROFILE%\\ylyvycolyqygeluh\\00000000","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PLAMP23F\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S7OZNUBQ\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TWAKHR9R\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LDS22KH7\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\Cab9BC2.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\Tar9BC3.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\Cab9C6F.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\Tar9C70.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\CabB14A.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%TEMP%\\TarB14B.tmp","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PLAMP23F\\plain[1].htm","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\asyrujejisidabekupexahy","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\ilypaculypyvoquhidopilyfehifesy","sources":[{"report_type":"sandbox","report_id":"5735d890aac2ed2f187b23c7"}]}]}},"report_ids":{"sandbox_job_ids":["5735d890aac2ed2f187b23c7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 67c62a887797… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 67c62a887797…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 67c62a887797… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 67c62a887797…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/67c62a8877975ee9e4f1ce4973a55d2d8a04ed55362b4ed8821ac2029c52a5e5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 67c62a887797… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 67c62a887797…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]