34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 40:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILPerseus.Generic Sample 6f201afc7973… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6f201afc7973…. Malware family: MSILPerseus.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 16 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","keywords":["Malicious","MSILPerseus.Generic","malware analysis","sandbox report","threat intelligence","6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1"],"about":{"@type":"SoftwareApplication","name":"hostr.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILPerseus.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T690,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeTypeHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Create__Instance__" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "time"; Source: "sample.bin"), Found reference to API "PDuPCEwogASkLgVkGL" (Indicator: "dup"; Source: "sample.bin"), Found reference to API "CreateInstance" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ThreadStaticAttribute" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ThreadStaticAttribute" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "STAThreadAttribute" (Indicator: "read"; Source: "sample.bin"), Found reference to API "STAThreadAttribute" (Indicator: "stat"; Source: "sample.bin")37:T491,"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"38:T6ee,"hostr.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "hostr.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "hostr.exe" trying to access non-existent file "C:\FLTLIB.DLL" "hostr.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "hostr.exe" trying to access non-existent file "C:\HOSTR.EXE.CONFIG" "hostr.exe" trying to access non-existent file "C:\HOSTR.EXE.LOCAL" "hostr.exe" trying to access non-existent file "C:\hostr.exe.Local\" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "hostr.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH"39:T966,"hostr.exe" wrote bytes "e96be8fdfc" to virtual address "0x7732BD30" ("GetKeyState@USER32.DLL") "hostr.exe" wrote bytes "28d8c44e" to virtual address "0x77D3B350" (part of module "NTDLL.DLL") "hostr.exe" wrote bytes "e98b85abff" to virtual address "0x74849D00" ("ShellExecuteW@SHELL32.DLL") "hostr.exe" wrote bytes "80755f7750785f77600b5e77f0745f77b0755f7710295e77e0745f7710755f77500b5e7700755f77" to virtual address "0x76C2E144" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "50165f77c0855e77" to virtual address "0x76C2E184" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "409b5f77c09b5f77" to virtual address "0x76C2E1C8" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "00eb5e77f0ea5e77e00f5f77e0ea5e77900f5f7730eb5e77b0eb5e77f0db5e77700e5f7770eb5e77d0015f77" to virtual address "0x76C2E208" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "0070ad59" to virtual address "0x77D39218" ("Wow64Transition@NTDLL.DLL") "hostr.exe" wrote bytes "40d29677300d9777e0f69677c0cd9677" to virtual address "0x760816C4" (part of module "WINDOWS.STORAGE.DLL") "hostr.exe" wrote bytes "d04c6177d0155e77a0765e7740185e77" to virtual address "0x76C2E190" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "e97b81abff" to virtual address "0x74849BD0" ("ShellExecuteA@SHELL32.DLL") "hostr.exe" wrote bytes "f0766277e077627740766277f07562773078627710155f77b05e6277807862779077627790766277605e627740776277" to virtual address "0x76C2E1D4" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "0070ad59" to virtual address "0x773A4EEC" (part of module "USER32.DLL") "hostr.exe" wrote bytes "402a05d9d55b0000" to virtual address "0xE4CB24D0" (part of module "NTDLL.DLL") "hostr.exe" wrote bytes "0070ad59" to virtual address "0x76C28AA0" (part of module "KERNELBASE.DLL") "hostr.exe" wrote bytes "e93bacfdfc" to virtual address "0x7732F850" ("GetAsyncKeyState@USER32.DLL") "hostr.exe" wrote bytes "e9dbab4c03" to virtual address "0x70E37C00" (part of module "APPHELP.DLL") "hostr.exe" wrote bytes "e92bbdfcfc" to virtual address "0x7733E990" ("GetForegroundWindow@USER32.DLL") "hostr.exe" wrote bytes "1032c47780ecc877208ac57700000000" to virtual address "0x76653000" (part of module "WIN32U.DLL") "hostr.exe" wrote bytes "20905f7750945f7740925f7720915f7700955f77009b5f77b0935f77809a5f77" to virtual address "0x76C2E1A4" (part of module "KERNELBASE.DLL")3a:Td89,".exe" queries volume information of "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00023757-00003216-0000010C-6419345260 ".exe" queries volume information of "C:\Windows\System32\rpcss.dll" at 00023757-00003216-0000010C-6419345265 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00023757-00003216-0000010C-8263098288 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00023757-00003216-0000010C-8264008173 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00023757-00003216-0000010C-19991425678 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00023757-00003216-0000010C-19992338901 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00023757-00003216-0000010C-20746867338 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089" at 00023757-00003216-0000010C-20747618258 ".exe" queries volume information of "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00024748-00003732-0000010C-26857411839 ".exe" queries volume information of "C:\Windows\System32\rpcss.dll" at 00024748-00003732-0000010C-26858210446 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00024748-00003732-0000010C-28397920139 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00024748-00003732-0000010C-28398687175 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00024748-00003732-0000010C-29062863202 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00024748-00003732-0000010C-29063721020 ".exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00024748-00003732-0000010C-29767262139 ".exe" queries volume information of "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp" at 00024748-00003732-0000010C-29768148521 "hostr.exe" queries volume information of "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00025324-00004004-0000010C-39256496364 "hostr.exe" queries volume information of "C:\Windows\System32\rpcss.dll" at 00025324-00004004-0000010C-39257329250 "hostr.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00025324-00004004-0000010C-40791967224 "hostr.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00025324-00004004-0000010C-407928452413b:T560,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23b.dat"3c:T51a,".exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3216.3840565" with delete access ".exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3216.3840565" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3216.3840656" with delete access ".exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3732.1570654328" with delete access ".exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3732.1570654328" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3732.1570654398" with delete access "hostr.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.4004.3137464326" with delete access "hostr.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.4004.3137464326" with delete access "hostr.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.4004.3137464386" with delete access3d:T888,".exe" wrote 32 bytes to a remote process "C:\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe" (Handle: 412) ".exe" wrote 52 bytes to a remote process "C:\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe" (Handle: 412) ".exe" wrote 4 bytes to a remote process "C:\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe" (Handle: 412) ".exe" wrote 512 bytes to a remote process "C:\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe" (Handle: 412) ".exe" wrote 27136 bytes to a remote process "C:\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe" (Handle: 412) ".exe" wrote 1024 bytes to a remote process "C:\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe" (Handle: 412) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 856) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 856) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 856) "hostr.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 416) "hostr.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 416) "hostr.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 416) "hostr.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 416) "hostr.exe" wrote 27136 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 416) "hostr.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\hostr.exe" (Handle: 416) "hostr.exe" wrote 32 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 420) "hostr.exe" wrote 52 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 420) "hostr.exe" wrote 4 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 420)3e:T6b2,Found malicious artifacts related to "204.95.99.26": ... URL: http://trokojan.sytes.net:288/is-ready (AV positives: 3/70 scanned on 11/07/2018 09:00:55) URL: http://momomo.no-ip.info:83/1234567890.functions (AV positives: 3/67 scanned on 11/07/2018 02:21:22) URL: http://deerbalik.no-ip.org/ (AV positives: 3/67 scanned on 11/05/2018 20:26:52) URL: http://chakson.no-ip.biz/ (AV positives: 1/67 scanned on 11/05/2018 07:36:47) URL: http://lasvigas2010.myftp.biz/ (AV positives: 5/68 scanned on 11/05/2018 07:26:57) File SHA256: 6bfb122ce39b95082f374c89650c9573fd6af2426a8a73c7f3bef5fee6eecd99 (AV positives: 47/69 scanned on 11/07/2018 11:02:56) File SHA256: 8aaa0ba20d18f57593b2f4f3392adfb6edf5ad659bd1297698869da4dd84be4f (AV positives: 55/69 scanned on 11/06/2018 15:57:49) File SHA256: 32bf7f6f69960e8c9fde80f58b4d69293ef3a533363c20e51188143f0d542fb8 (AV positives: 44/68 scanned on 11/06/2018 10:10:54) File SHA256: 9d577fa7201a7a5ad74119f42c75a21d9d5cfaf1858c976552f225d31fed5629 (AV positives: 30/67 scanned on 11/06/2018 14:24:22) File SHA256: 7349156c1dc5c0875f341ff87020b0416af4ab8a1515a2a718c9eb7d5297e10b (AV positives: 33/69 scanned on 11/06/2018 00:18:09) File SHA256: fd08669144dac1e581ec33d49e3f8fc2e270c71fa0b4fbc88453755322728926 (Date: 11/06/2018 05:10:39) File SHA256: a77d4b55ec827d8de524926b2a4c2abcdbba3b6f3eec174282539d49ad30e417 (Date: 11/06/2018 02:02:36) File SHA256: c7beff0d458354874464b482d83356b845db3d6ebdad1ee8c1df2f8d9391d9a8 (Date: 11/04/2018 18:25:31) File SHA256: 63c4eac5d064d32c5a0391d0afdb892a4dfa4ea12ee6da2ee5c3c5310cdc8f87 (Date: 11/04/2018 17:20:36) File SHA256: 055beba11321207aeb9d55c8c3c257b64dd7f3006aacae7a609237dc0bd6bddf (Date: 11/03/2018 16:04:23)3f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794179628012,"unified_at":"2026-11-08T23:13:48.012Z","metadata":{"hashes":{"sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","sha1":"5c4676b37fcd49990d21960a2df57af72ceef29a","md5":"5a559b6d223c79f3736dc52794636cfd","sha512":"7a12510fe2104a1860bccdd12d96449eb8b02e30f9757bf3fbb4aef3373c710afbaef380ad7f4b1f9fa8129d8bdc096b8f16cb6b1aada0495dba80db33fb9ce2","ssdeep":"1536:aDYEasJqkUssXOcfaAJzYU4r/1CbSYlIePDVFkhgIJZH:aasJjUfFOderYRH","ssdeep_chunks":["1536:aDYEasJ","1536:DYEasJq","1536:YEasJqk","1536:EasJqkU","1536:asJqkUs","1536:sJqkUss","1536:JqkUssX","1536:qkUssXO","1536:kUssXOc","1536:UssXOcf","1536:ssXOcfa","1536:sXOcfaA","1536:XOcfaAJ","1536:OcfaAJz","1536:cfaAJzY","1536:faAJzYU","1536:aAJzYU4","1536:AJzYU4r","1536:JzYU4r/","1536:zYU4r/1","1536:YU4r/1C","1536:U4r/1Cb","1536:4r/1CbS","1536:r/1CbSY","1536:/1CbSYl","1536:1CbSYlI","1536:CbSYlIe","1536:bSYlIeP","1536:SYlIePD","1536:YlIePDV","1536:lIePDVF","1536:IePDVFk","1536:ePDVFkh","1536:PDVFkhg","1536:DVFkhgI","1536:VFkhgIJ","1536:FkhgIJZ","1536:khgIJZH","3072:aDYEasJ","3072:DYEasJq","3072:YEasJqk","3072:EasJqkU","3072:asJqkUs","3072:sJqkUss","3072:JqkUssX","3072:qkUssXO","3072:kUssXOc","3072:UssXOcf","3072:ssXOcfa","3072:sXOcfaA","3072:XOcfaAJ","3072:OcfaAJz","3072:cfaAJzY","3072:faAJzYU","3072:aAJzYU4","3072:AJzYU4r","3072:JzYU4r/","3072:zYU4r/1","3072:YU4r/1C","3072:U4r/1Cb","3072:4r/1CbS","3072:r/1CbSY","3072:/1CbSYl","3072:1CbSYlI","3072:CbSYlIe","3072:bSYlIeP","3072:SYlIePD","3072:YlIePDV","3072:lIePDVF","3072:IePDVFk","3072:ePDVFkh","3072:PDVFkhg","3072:DVFkhgI","3072:VFkhgIJ","3072:FkhgIJZ","3072:khgIJZH","1536:aasJjUf","1536:asJjUfF","1536:sJjUfFO","1536:JjUfFOd","1536:jUfFOde","1536:UfFOder","1536:fFOderY","1536:FOderYR","1536:OderYRH"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"a5642369aea827116ec8f8f88bd57da2d6a9e37f"},"file_info":{"file_name":"hostr.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":107520,"entropy":6.4,"compile_timestamp":"2013-10-06T14:24:17","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288153000,"last_seen":1788705479000,"last_multi_scan":1788705479000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":13796,"raw_size":13824},{"name":".sdata","virtual_address":"0x6000","virtual_size":74002,"raw_size":74240},{"name":".rsrc","virtual_address":"0x1a000","virtual_size":17744,"raw_size":17920},{"name":".reloc","virtual_address":"0x20000","virtual_size":12,"raw_size":512}],"section_names":[".text",".sdata",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","commodity","deadeyehawk","deadeyejackal","njrat","rat","sea","syrianelectronicarmy","targeted","darkcomet","suspicious","sinkhole"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":18},"sandbox_signatures":{"informative_count":25,"suspicious_count":27,"malicious_count":16,"total":68},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Pakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.25588","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1291141","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.25588 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Bladabindi.O trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Injector.BZF.vyec","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Injector.cc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.lLPm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"section_entropy_high","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DotNet-R","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.DN-Bladabindi.107520.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXFH-FD!5A559B6D223C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.KLOF-1208","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.BARR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.MSIL.Agent.VAD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Bladabindi.Win32.15445","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILPerseus.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"njRAT","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Calls an API's typically used for searching a directory for a files"},{"type":"suspicious","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"8.0.0.0\", \"0.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"hostr.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"hostr.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2824:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2824:64:WilError_01\"\n \"Local\\SM0:2824:64:WilError_01\"\n \"Local\\SM0:2824:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"hostr.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\7aa13700a6fcdcb57e6cb353e54d0ab9\\mscorlib.ni.dll\" at 6D550000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.bin\" has an writable section named \".sdata\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$37","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-u -p 2824 -s 800\" (UID: 00000000-00006632)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-u -p 2824 -s 800\" (UID: 00000000-00006632)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"Observed function Sleep in 6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.bin","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"hostr.exe\" queried SystemProcessInformation at 00000000-00002824-00000036-863398\n \"hostr.exe\" queried SystemProcessInformation at 00000000-00002824-00000036-865360\n \"hostr.exe\" queried SystemProcessInformation at 00000000-00002824-00000036-2387088\n \"hostr.exe\" queried SystemProcessInformation at 00000000-00002824-00000036-2388926","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"hostr.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.4789025461","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically get system version information","description":"\"hostr.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002824)\n \"hostr.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002824)\n \"hostr.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002824)\n \"hostr.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002824)\n \"hostr.exe\" called \"RtlGetVersion\" (UID: 00000000-00002824)\n \"hostr.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002824)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"hostr.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002824)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"hostr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"60/72 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.bin\" has resource with unusual entropy \"SIMON:7.47963797892\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"hostr.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 1504527616)\n \"hostr.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1504527617)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"hostr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"hostr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"hostr.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002824)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"hostr.exe\" called \"FindFirstFileW\" (UID: 00000000-00002824)\n \"hostr.exe\" called \"FindNextFileW\" (UID: 00000000-00002824)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetKeyState@USER32.DLL\" in \"hostr.exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \"hostr.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"hostr.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"hostr.exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \"hostr.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"hostr.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$39","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"hostr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"hostr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"hostr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"60/72 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3a","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\HOSTR.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\HOSTR.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\hostr.exe\"\n \".exe\" created file \"%TEMP%\\hostr.exe:Zone.Identifier\"\n \"hostr.exe\" created file \"%TEMP%\\hostr.exe.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"hostr.exe\" connecting to \"\\ThemeApiPort\"\n \"netsh.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"hostr.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"ec83b2d446200dcd0392570446c898a3.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"hostr.exe.tmp\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$3b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"hostr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\UI\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"hostr.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00023757-00003216-00000105-21236903440\n \".exe\" at 00024748-00003732-00000105-33265285924\n \"hostr.exe\" at 00025324-00004004-00000105-53119414747\n \"netsh.exe\" at 00026726-00001620-00000105-63544797264","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"hostr.exe\" (Thread ID: 2308) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"hostr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \"hostr.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"hostr.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"ec83b2d446200dcd0392570446c898a3.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"hostr.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"EC83B2D446200DCD0392570446C898A3\"; Value: \"\"%TEMP%\\hostr.exe\" ..\")\n \"hostr.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"EC83B2D446200DCD0392570446C898A3\"; Value: \"\"%TEMP%\\hostr.exe\" ..\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3c","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ec83b2d446200dcd0392570446c898a3.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"60/77 Antivirus vendors marked dropped file \"hostr.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 77% detection rate)\n 60/77 Antivirus vendors marked dropped file \"ec83b2d446200dcd0392570446c898a3.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 77% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"60/77 Antivirus vendors marked spawned process \".exe\" (PID: 3732) as malicious (classified as \"Gen:Variant.Zusy\" with 77% detection rate)\n 60/77 Antivirus vendors marked spawned process \"hostr.exe\" (PID: 4004) as malicious (classified as \"Gen:Variant.Zusy\" with 77% detection rate)\n 60/77 Antivirus vendors marked spawned process \"hostr.exe\" (PID: 2124) as malicious (classified as \"Gen:Variant.Zusy\" with 77% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\"\n \"hostr.exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$3d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%TEMP%\\hostr.exe\" \"hostr.exe\" ENABLE\" (UID: 00026726-00001620)","origin":"Monitored Target","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00023757-00003216)\n Spawned process \".exe\" (UID: 00024748-00003732)\n Spawned process \"hostr.exe\" (UID: 00025324-00004004)\n Spawned process \"hostr.exe\" (UID: 00026268-00002124)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%TEMP%\\hostr.exe\" \"hostr.exe\" ENABLE\" (UID: 00026726-00001620)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"soa7.zapto.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"204.95.99.26:1177\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"soa7.zapto.org\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"6/68 reputation engines marked \"http://soa7.zapto.org\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET TROJAN Bladabindi/njrat CnC Checkin\" (SID: 2017419, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN DNS Reply Sinkhole Microsoft NO-IP Domain\" (SID: 2018642, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"6/68 reputation engines marked \"http://soa7.zapto.org\" as malicious (8% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$3e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 204.95.99.26 on port 1177","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"intel_graph":{"map":{"Domain:soa7.zapto.org":{"type":"Domain","value":"soa7.zapto.org"},"File:0dd1c418eb9f033951152017880f36a5e501aa91e4d9cbe6c389bbc8e0aace45":{"type":"File","value":"0dd1c418eb9f033951152017880f36a5e501aa91e4d9cbe6c389bbc8e0aace45"},"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1":{"type":"File","value":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat njRAT"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f8e4ad3492797ba03edb9529e28e51063d726efa5816fa2f539a7fe2033d4ae3":{"type":"File","value":"f8e4ad3492797ba03edb9529e28e51063d726efa5816fa2f539a7fe2033d4ae3","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat njRAT"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:204.95.99.26":{"type":"Ip","value":"204.95.99.26"},"Threat:cc0effe3509f4ac11a0a7c7777189f37357cc656622ab32d6aa924f02f8d58bc":{"type":"Threat","value":"njRAT","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1546167601419618901","root":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat njRAT"]}},{"id":"1546167594566054867","root":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","to_key":"Threat:cc0effe3509f4ac11a0a7c7777189f37357cc656622ab32d6aa924f02f8d58bc"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1546167610323430460","root":"File:f8e4ad3492797ba03edb9529e28e51063d726efa5816fa2f539a7fe2033d4ae3","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat njRAT"]}},{"id":"1546167606553375708","root":"File:f8e4ad3492797ba03edb9529e28e51063d726efa5816fa2f539a7fe2033d4ae3","edges":[{"edge_kind":"is_threat","from_key":"File:f8e4ad3492797ba03edb9529e28e51063d726efa5816fa2f539a7fe2033d4ae3","to_key":"Threat:cc0effe3509f4ac11a0a7c7777189f37357cc656622ab32d6aa924f02f8d58bc"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","edges":[{"edge_kind":"contacted_ip","from_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","to_key":"Ip:204.95.99.26"},{"edge_kind":"contacted_domain","from_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","to_key":"Domain:soa7.zapto.org"},{"edge_kind":"resolves_to","from_key":"Domain:soa7.zapto.org","to_key":"Ip:204.95.99.26"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","edges":[{"edge_kind":"extracted","from_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","to_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1"},{"edge_kind":"extracted","from_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","to_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1"},{"edge_kind":"extracted","from_key":"File:6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","to_key":"File:0dd1c418eb9f033951152017880f36a5e501aa91e4d9cbe6c389bbc8e0aace45"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":182,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":81,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["bladabindi","commodity","deadeyehawk","deadeyejackal","njrat","rat","sea","syrianelectronicarmy","targeted","darkcomet","suspicious","sinkhole"],"sample_flags":["Sample Crashed","Multi-Process","Extracted Files","TOR analysis","Network Traffic"],"sandbox_reports":[{"id":"636447bb0d9b5e1fa04f1198","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","submit_name":"hostr.exe","analysis_start_time":"2022-11-03T22:59:08+00:00","indicators_count":{"informative":11,"suspicious":18,"malicious":3},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"5be305dd7ca3e142cf797df4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["USA"],"submit_name":"hostr.exe","analysis_start_time":"2018-11-07T16:37:16+00:00","indicators_count":{"informative":16,"suspicious":21,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"587ce0f7aac2ed196b89ffd6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"hostr.exe","analysis_start_time":"2018-10-16T13:04:46+00:00","indicators_count":{"informative":13,"suspicious":20,"malicious":11},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"204.95.99.26","port":1177,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"dns_resolutions":[{"domain":"soa7.zapto.org","address":"204.95.99.26","ttl":3600,"country":"United States","registrar_name":"TLDS L.L.C. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-08-10T02:24:14+00:00","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}],"processes":[{"pid":3216,"ppid":0,"name":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe","command_line":"","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","normalized_path":"C:\\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe","uid":"00023757-00003216","icon":"$3f"},{"pid":3732,"ppid":3216,"name":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe","command_line":"","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","normalized_path":"C:\\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe","parent_uid":"00023757-00003216","uid":"00024748-00003732"},{"pid":4004,"ppid":3732,"name":"hostr.exe","command_line":"","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","normalized_path":"%TEMP%\\hostr.exe","parent_uid":"00024748-00003732","uid":"00025324-00004004"},{"pid":2124,"ppid":4004,"name":"hostr.exe","command_line":"","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","normalized_path":"%TEMP%\\hostr.exe","parent_uid":"00025324-00004004","uid":"00026268-00002124"},{"pid":1620,"ppid":2124,"name":"netsh.exe","command_line":"netsh firewall add allowedprogram \"%TEMP%\\hostr.exe\" \"hostr.exe\" ENABLE","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00026268-00002124","uid":"00026726-00001620"}],"all_imported_dlls":["cryptbase.dll","fltLib.dll","Culture.dll","wow64win.dll","kernel32.dll","advapi32.dll","user32.dll","oleaut32.dll","mscorwks.dll","shell32.dll","rpcrt4.dll","msvcp_win.dll","version.dll","wow64cpu.dll","mscoree.dll","ws2_32.dll","gdi32full.dll","combase.dll","msvcr80.dll","mscorrc.dll","bcryptprimitives.dll","imm32.dll","cfgmgr32.dll","SHCore.dll","windows.storage.dll","mscorlib.ni.dll","wow64.dll","KernelBase.dll","msvcrt.dll","sechost.dll","win32u.dll","mscoreei.dll","powrprof.dll","ucrtbase.dll","gdi32.dll","kernel.appcore.dll","profapi.dll","ntdll.dll","apphelp.dll","sspicli.dll","ole32.dll","shlwapi.dll","rpcnsh.dll","eappcfg.dll","activeds.dll","authfwcfg.dll","ifmon.dll","ntmarta.dll","shdocvw.dll","iertutil.dll","System.Drawing.dll","winipsec.dll","lpk.dll","wevtapi.dll","secur32.dll","httpapi.dll","webio.dll","rpcss.dll","comctl32.dll","Accessibility.dll","P2P.dll","System.Windows.Forms.dll","netapi32.dll","Wldap32.dll","hnetmon.dll","netutils.dll","tdh.dll","rasapi32.dll","p2pcollab.dll","wwancfg.dll","crypt32.dll","credui.dll","nshwfp.dll","nci.dll","certcli.dll","adsldpc.dll","FWPUCLNT.DLL","nlaapi.dll","odbcint.dll","netshell.dll","polstore.dll","WcnNetsh.dll","wlanutil.dll","rsaenh.dll","RpcRtRemote.dll","mswsock.dll","p2pnetsh.dll","logoncli.dll","wininet.dll","shfolder.dll","wshelper.dll","wlanapi.dll","slc.dll","whhelper.dll","wkscli.dll","wlancfg.dll","urlmon.dll","winnsi.dll","dhcpcsvc6.dll","devrtl.dll","dot3api.dll","IPHLPAPI.DLL","netiohlp.dll","uxtheme.dll","psapi.dll","mpr.dll","rasman.dll","WSHTCPIP.DLL","rasadhlp.dll","rasmontr.dll","mscorlib.dll","wship6.dll","tzres.dll","dot3cfg.dll","ndfapi.dll","eappprxy.dll","NAPMONTR.DLL","Microsoft.VisualBasic.dll","nsi.dll","dhcpcsvc.dll","cryptsp.dll","devobj.dll","msasn1.dll","QUTIL.DLL","atl.dll","onex.dll","nshipsec.dll","wwapi.dll","propsys.dll","System.XML.dll","usp10.dll","mfc42u.dll","nettrace.dll","wdi.dll","System.dll","dnsapi.dll","DHCPQEC.DLL","bcrypt.dll","setupapi.dll","fwcfg.dll","winhttp.dll","clbcatq.dll","dhcpcmonitor.dll","mprapi.dll","ws2help.dll","wlanhlp.dll","msctf.dll","mscorjit.dll","srvcli.dll","QAGENT.DLL","System.configuration.dll","odbc32.dll","nshhttp.dll","FirewallAPI.dll","userenv.dll","System.Configuration.ni.dll","wbemcomn.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","WMINet_Utils.dll","wbemprox.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Drawing.ni.dll","wmiutils.dll","wbemsvc.dll","ntdsapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","avicap32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","Microsoft.VisualBasic.ni.dll","fastprox.dll","PeerDistSh.dll","gpapi.dll","winmm.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","System.ni.dll","msvfw32.dll","System.Xml.ni.dll","normaliz.dll","System.Management.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","System.Windows.Forms.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"ec83b2d446200dcd0392570446c898a3.exe","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"hostr.exe","sha256":"6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"hostr.exe.tmp","sha256":"0dd1c418eb9f033951152017880f36a5e501aa91e4d9cbe6c389bbc8e0aace45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"C:\\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe.config","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"C:\\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"C:\\6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%TEMP%\\hostr.exe.config","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ec83b2d446200dcd0392570446c898a3.exe","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\System32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%TEMP%\\hostr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ec83b2d446200dcd0392570446c898a3.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%TEMP%\\hostr.exe","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\System.configuration.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.XML.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"%TEMP%\\hostr.exe.tmp","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"path":"C:\\hostr.exe.config","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"C:\\hostr.exe","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"C:\\hostr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\netsh.exe","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index256.dat","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msvfw32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\avicap32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2824:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"name":"Local\\SM0:2824:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"name":"Local\\SM0:2824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"636447bb0d9b5e1fa04f1198"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ec83b2d446200dcd0392570446c898a3","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"587ce0f7aac2ed196b89ffd6"},{"report_type":"sandbox","report_id":"5be305dd7ca3e142cf797df4"}]}]}},"report_ids":{"sandbox_job_ids":["636447bb0d9b5e1fa04f1198","5be305dd7ca3e142cf797df4","587ce0f7aac2ed196b89ffd6"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious MSILPerseus.Generic Sample 6f201afc7973… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6f201afc7973…. Malware family: MSILPerseus.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 16 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILPerseus.Generic Sample 6f201afc7973… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6f201afc7973…. Malware family: MSILPerseus.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 16 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6f201afc797370ac6e33fafec41a794a2eb44c1bfd7d9079e3633ebe7bbb41e1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILPerseus.Generic Sample 6f201afc7973… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6f201afc7973…. Malware family: MSILPerseus.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 16 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]] 32:null