26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6b20d33e9844… — Score 95/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b20d33e9844…. Malware family: Trojan.Generic. Threat score 95/100. 22/28 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217"],"about":{"@type":"SoftwareApplication","name":"i87645y3t23.exe","applicationCategory":["peexe","executable"],"identifier":"6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217","additionalType":"Malicious sample"},"threatScore":95,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T471,"" loaded module "CRYPTSP.DLL" at base 74FF0000 "" loaded module "CREDSSP.DLL" at base 74C90000 "" loaded module "C:\WINDOWS\SYSTEM32\SCHANNEL.DLL" at base 74E00000 "" loaded module "ADVAPI32.DLL" at base 76D50000 "" loaded module "SECUR32.DLL" at base 75310000 "" loaded module "NCRYPT.DLL" at base 75120000 "" loaded module "C:\WINDOWS\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74CD0000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "" loaded module "GPAPI.DLL" at base 74BB0000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77590000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77590000 "" loaded module "USER32.DLL" at base 76C20000 "" loaded module "CRYPTNET.DLL" at base 725D0000 "" loaded module "SHLWAPI.DLL" at base 76CF0000 "" loaded module "PROFAPI.DLL" at base 75570000 "" loaded module "SETUPAPI.DLL" at base 7698000028:Ta76,"" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Root" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\trust" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Policies\Microsoft\SystemCertificates" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\CA" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 5, Subtree: 1)29:Tb65,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2a:T8f9,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")2b:T554,"" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")2c:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":95,"unified_at_epoch_ms":1790441590850,"unified_at":"2026-09-26T16:53:10.850Z","metadata":{"hashes":{"sha256":"6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217","sha1":"69907d5716a140df4977dc088af549e539d64221","md5":"8b288305733214f8e0d95386d886af2d","sha512":"01c642eec546bd861d93d468d06cd5aeb2962323fade3cd1a56cce15dacc20f18c6e6206854f9d5170c3d4158b2381e2b5ac82d52b913d310ca19dbd47f77865","ssdeep":"1536:tfexHOUGMqKojNnY6McseYRMatPmFcQOrRocKCUohkMdWAEZz2w/mMvAcXE:4x33TojNzjseYRPmHOrKck8kMsrxm/","ssdeep_chunks":["1536:tfexHOU","1536:fexHOUG","1536:exHOUGM","1536:xHOUGMq","1536:HOUGMqK","1536:OUGMqKo","1536:UGMqKoj","1536:GMqKojN","1536:MqKojNn","1536:qKojNnY","1536:KojNnY6","1536:ojNnY6M","1536:jNnY6Mc","1536:NnY6Mcs","1536:nY6Mcse","1536:Y6McseY","1536:6McseYR","1536:McseYRM","1536:cseYRMa","1536:seYRMat","1536:eYRMatP","1536:YRMatPm","1536:RMatPmF","1536:MatPmFc","1536:atPmFcQ","1536:tPmFcQO","1536:PmFcQOr","1536:mFcQOrR","1536:FcQOrRo","1536:cQOrRoc","1536:QOrRocK","1536:OrRocKC","1536:rRocKCU","1536:RocKCUo","1536:ocKCUoh","1536:cKCUohk","1536:KCUohkM","1536:CUohkMd","1536:UohkMdW","1536:ohkMdWA","1536:hkMdWAE","1536:kMdWAEZ","1536:MdWAEZz","1536:dWAEZz2","1536:WAEZz2w","1536:AEZz2w/","1536:EZz2w/m","1536:Zz2w/mM","1536:z2w/mMv","1536:2w/mMvA","1536:w/mMvAc","1536:/mMvAcX","1536:mMvAcXE","3072:tfexHOU","3072:fexHOUG","3072:exHOUGM","3072:xHOUGMq","3072:HOUGMqK","3072:OUGMqKo","3072:UGMqKoj","3072:GMqKojN","3072:MqKojNn","3072:qKojNnY","3072:KojNnY6","3072:ojNnY6M","3072:jNnY6Mc","3072:NnY6Mcs","3072:nY6Mcse","3072:Y6McseY","3072:6McseYR","3072:McseYRM","3072:cseYRMa","3072:seYRMat","3072:eYRMatP","3072:YRMatPm","3072:RMatPmF","3072:MatPmFc","3072:atPmFcQ","3072:tPmFcQO","3072:PmFcQOr","3072:mFcQOrR","3072:FcQOrRo","3072:cQOrRoc","3072:QOrRocK","3072:OrRocKC","3072:rRocKCU","3072:RocKCUo","3072:ocKCUoh","3072:cKCUohk","3072:KCUohkM","3072:CUohkMd","3072:UohkMdW","3072:ohkMdWA","3072:hkMdWAE","3072:kMdWAEZ","3072:MdWAEZz","3072:dWAEZz2","3072:WAEZz2w","3072:AEZz2w/","3072:EZz2w/m","3072:Zz2w/mM","3072:z2w/mMv","3072:2w/mMvA","3072:w/mMvAc","3072:/mMvAcX","3072:mMvAcXE","1536:4x33Toj","1536:x33TojN","1536:33TojNz","1536:3TojNzj","1536:TojNzjs","1536:ojNzjse","1536:jNzjseY","1536:NzjseYR","1536:zjseYRP","1536:jseYRPm","1536:seYRPmH","1536:eYRPmHO","1536:YRPmHOr","1536:RPmHOrK","1536:PmHOrKc","1536:mHOrKck","1536:HOrKck8","1536:OrKck8k","1536:rKck8kM","1536:Kck8kMs","1536:ck8kMsr","1536:k8kMsrx","1536:8kMsrxm","1536:kMsrxm/"],"imphash":"c99a659b72de533c8502c7d73096b74e"},"file_info":{"file_name":"i87645y3t23.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":148992,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296935000,"last_seen":1677369654000,"last_multi_scan":1677369654000}},"detections":{"summary":{"verdict":"malicious","score":95,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":22,"malicious_count":6,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.tneI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.342198","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2928241","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.QQTO-5387","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2928241 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d85141 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.nthf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.dzhgtv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-APNB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_DRIDEX.CP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_DRIDEX.CP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.BAP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.372","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"199.7.136.84:8143\"\n \"221.132.35.56:8843\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab1E08.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar1E09.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab1E68.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar1E69.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IESQMMUTEX_0_208\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"InternetCloseHandle@wininet.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"\n \"CPImportKey@rsaenh.dll\"\n \"CPEncrypt@rsaenh.dll\"\n \"CPDecrypt@rsaenh.dll\"\n \"CPCreateHash@rsaenh.dll\"\n \"CPHashData@rsaenh.dll\"\n \"CPHashSessionKey@rsaenh.dll\"\n \"CPDestroyHash@rsaenh.dll\"\n \"CPSignHash@rsaenh.dll\"\n \"CPVerifySignature@rsaenh.dll\"\n \"CPGenRandom@rsaenh.dll\"\n \"CPGetUserKey@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab1E08.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar1E09.tmp\" has type \"data\"\n \"Cab1E68.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar1E69.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"x[)aw\n rdR\n 1W?s0{#\n )R~?A\n V\n [ with unusual entropies 7.57617784411\n 7.58670187977\n 7.75249091584\n 7.73484078333\n 7.63206438965\n 7.31822136767","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$28","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\i87645y3t23.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab1E08.tmp\" for deletion\n \"Z:\\i87645y3t23.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar1E09.tmp\" for deletion\n \"Z:\\i87645y3t23.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab1E68.tmp\" for deletion\n \"Z:\\i87645y3t23.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar1E69.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab1E08.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar1E09.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab1E68.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar1E69.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 154220 does not match actual CRC 173369","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetTempPathW\n LoadLibraryExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Sun Jul 8 06:13:23 2018","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/53 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 199.7.136.84 on port 8143\n TCP traffic to 221.132.35.56 on port 8843","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$2a","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00156828-00002276-7748228D-205785","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":".text0","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00211531-00002424-77B601AA-225593","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@SECHOST.DLL at 00211531-00002424-77B601AA-224847\n OpenServiceA@SECHOST.DLL at 00211531-00002424-77B601AA-224859","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00211531-00002424-77B4FDA0-220312","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$2b","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00211531-00002424-77B601AA-224546","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00211531-00002424-77B601AA-224285","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"566ff2db0e316d627fb9cef0","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"Heur","contacted_countries":["CAN"],"submit_name":"i87645y3t23.exe","analysis_start_time":"2015-12-15T05:01:10+00:00","indicators_count":{"informative":6,"suspicious":18,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"566fee6d0e316db6291fd271","environment_id":4,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"i87645y3t23.exe","analysis_start_time":"2015-12-15T10:41:49+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"566fee6d0e316db6291fd26f","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"Heur","contacted_countries":["CAN","VNM"],"submit_name":"i87645y3t23.exe","analysis_start_time":"2015-12-15T04:42:23+00:00","indicators_count":{"informative":6,"suspicious":18,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"199.7.136.84","port":8143,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"address":"221.132.35.56","port":8843,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}],"processes":[{"pid":2276,"ppid":0,"name":"i87645y3t23.exe","command_line":"","normalized_path":"","uid":"00156828-00002276","icon":"$2c"}],"all_imported_dlls":["OLEAUT32.dll","USP10.dll","profapi.dll","napinsp.dll","bcryptprimitives.dll","wship6.dll","DEVOBJ.dll","KERNELBASE.dll","CRYPTSP.dll","CRYPTBASE.dll","wintrust.dll","rasman.dll","ntdll.dll","RPCRT4.dll","SspiCli.dll","ws2_32.DLL","SETUPAPI.dll","shell32.dll","comctl32.dll","rasadhlp.dll","cryptnet.dll","IMM32.DLL","GPAPI.dll","msvcrt.dll","USER32.dll","USERENV.dll","ncrypt.dll","sechost.dll","ADVAPI32.dll","credssp.dll","Cabinet.dll","WINHTTP.dll","dhcpcsvc6.DLL","LPK.dll","MSCTF.dll","SHLWAPI.dll","wininet.dll","mswsock.dll","DEVRTL.dll","rsaenh.dll","NLAapi.dll","secur32.dll","urlmon.dll","wshqos.dll","VERSION.dll","RASAPI32.dll","dhcpcsvc.DLL","sensapi.dll","pnrpnsp.dll","dnsapi.DLL","CFGMGR32.dll","ole32.dll","rtutils.dll","iphlpapi.DLL","winrnr.dll","GDI32.dll","kernel32.dll","CRYPT32.dll","schannel.DLL","ntmarta.dll","wshtcpip.DLL","PSAPI.DLL","Normaliz.dll","wshtcpip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Cab1E08.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"name":"Cab1E68.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"name":"Tar1E09.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"name":"Tar1E69.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"name":"SCHEDLGU.TXT","sha256":"76d1a6d518d0a0ece9b3fb57cc1613cafd925858099feb5d99e6bdf173a839b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"setupact.log","sha256":"63efe8f685c48b9e9e9eafc9e5804501713e469b7f484553f52f0ad398d3dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\I87645Y3T23_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"566fee6d0e316db6291fd26f"},{"report_type":"sandbox","report_id":"566ff2db0e316d627fb9cef0"}]}]}},"report_ids":{"sandbox_job_ids":["566fee6d0e316db6291fd26f","566ff2db0e316d627fb9cef0"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6b20d33e9844… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6b20d33e9844…. Malware family: Trojan.Generic. Threat score 95/100. 22/28 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6b20d33e9844… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6b20d33e9844…. Malware family: Trojan.Generic. Threat score 95/100. 22/28 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6b20d33e9844… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6b20d33e9844…. Malware family: Trojan.Generic. Threat score 95/100. 22/28 AV engines flagged this file. 6 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]