26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6f73b98463f0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6f73b98463f0…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c"],"about":{"@type":"SoftwareApplication","name":"icon.jpg","applicationCategory":["peexe","executable"],"identifier":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T621,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "tor.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_core-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor-gencert.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libssp-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_extra-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libgcc_s_sjlj-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "unverified-microdesc-consensus.tmp" has type "ASCII text with CRLF line terminators" "state.tmp" has type "ASCII text with very long lines with CRLF line terminators" "cached-certs.tmp" has type "ASCII text with CRLF line terminators" "geoip6" has type "ASCII text" "cached-microdescs.new" has type "ASCII text with very long lines" "cached-microdesc-consensus.tmp" has type "ASCII text with CRLF line terminators" "System.zip" has type "Zip archive data at least v1.0 to extract" "naj" has type "data" "geoip" has type "ASCII text"28:T424,"" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\System32\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\N5M07OK\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\ntdll.dll" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "svchost.exe" touched file "C:\Windows\System32\rsaenh.dll"29:T841,Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "zP?%]z.GB" Pattern match: "http://www.zlib.net/" Heuristic match: "GET /json HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzi" Heuristic match: "archive.torproject.org" Pattern match: "http://ocsp.int-x3.letsencrypt.org0/" Pattern match: "http://cert.int-x3.letsencrypt.org/0" Pattern match: "http://cps.letsencrypt.org0" Pattern match: "https://letsencrypt.org/repository/0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/DSTROOTCAX3CRL.crl0" Heuristic match: "]wntm.CZ" Pattern match: "www.f3v52f6zsilym5xi5i.com" Pattern match: "www.hp4m7yhvn2b4nbkbccl.com0" Pattern match: "www.5l5mtzn77oj3.net0" Pattern match: "www.7uhlvvjrxwndtz4w5t.com" Pattern match: "www.txir376a5i6l.com0" Pattern match: "www.ony55jmzz.net0" Pattern match: "www.ysd4e3y4.com" Pattern match: "www.x272r6es2go.com" Pattern match: "www.jae3fy3t2.com0" Pattern match: "www.kmzvlb777mwrsq3l.net0" Pattern match: "www.5pnvd6szzybxd357zt4.com0" Pattern match: "www.zxb26qau57cjaf.net0" Pattern match: "www.vzn55mtatfkd7.com" Pattern match: "www.xu2nc5m7d5mmiifqdso.com" Pattern match: "www.33ueqmhj26oxvc77.com0" Pattern match: "www.4q53ahmp7xao4epgar4.net0" Pattern match: "www.bnkkdm65shrqld.com0" Pattern match: "www.huzwegaqpqnj.net0" Pattern match: "www.lvpxz3jlgosksof5hpn.com" Heuristic match: "%d.%d.%d.%d.in-addr.arpa" Heuristic match: "ip6.arpa" Heuristic match: "google.com" Heuristic match: "ip-api.com" Pattern match: "https://www.torproject.org/download/download#warning" Pattern match: "http://www.openssl.org/" Pattern match: "http://%s" Heuristic match: ".onion" Pattern match: "https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz"2a:T402,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "tor.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_core-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor-gencert.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libssp-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_extra-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libgcc_s_sjlj-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"2b:T677,"" wrote bytes "2b453d77f99c3c7778eb3b7779893b7793973c77d3333d77a41d3d77d0d93c7711a63c775c393d7741cf3c77e19c3c770e453d77b62f3d7741233c7700bf3c7700000000473f157700000000ec22b67599e5b37500000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "0857d0750478d9750000000051c1ab769498ab76ee9cab7675dcad76273ead76efb2b1760000000046ce3c77013d3d7738ed3d77cfcd3c7731233c77de2f3d77c4ca3c7780bb3c77aa6e3d779fbb3c7792bb3c7746ba3c770abf3c7700000000" to virtual address "0x6A821000" (part of module "SHFOLDER.DLL") "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "" wrote bytes "7739247779a82877be722877d62d28771de2237705a22877c868277757d12e77bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74DD1000" (part of module "WSHIP6.DLL") "" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "" wrote bytes "92e6237779a82877be722877d62d28771de2237705a22877bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74881000" (part of module "WSHTCPIP.DLL") "PING.EXE" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL")2c:T2a23,Found malicious artifacts related to "185.194.141.58" (ASN: , Owner: ): ... File SHA256: 28efadb794d51fee1eaba3458f4c776ab474bcf0f018c4d8c71603adbe253b47 (AV positives: 49/68 scanned on 11/30/2017 23:50:08) File SHA256: c5750962b28c01179f6d6be8f8e258a54a50045b24dd1c4166e7648e2e8f3ec1 (AV positives: 47/68 scanned on 11/30/2017 23:48:22) File SHA256: 5f7ec303b7cfd91ed2c376354c6fcea102021d57a3995a3f101cdf8d1b814e78 (AV positives: 49/68 scanned on 11/30/2017 23:45:51) File SHA256: 239ee82a86d6c87de09ce61f5ade4c78770339e69b22457190c2f8cee3cc2e27 (AV positives: 40/68 scanned on 11/30/2017 23:45:29) File SHA256: ee751129ea9b6b45ff098d4e25b0600de5503b0d6befe5d02c7a2a27c33cf00e (AV positives: 54/68 scanned on 11/30/2017 23:43:34) File SHA256: 20b6445efd1c18f340ff5496b606c8483294f6ba776bb5601b4a5db640b6fde3 (Scanned on 11/30/2017 18:35:53) File SHA256: 4b0f25da928fc874703ce2762dce055d70a3fbfec73aaeba2fad2af4610ed8f7 (Scanned on 11/30/2017 18:34:54) File SHA256: c75e8ab9c02e1836083acf2ab3cc79bec8508538dbebb7e56adc8470ff9a8036 (Scanned on 11/30/2017 18:28:13) File SHA256: 1ca2a231086f69fcd08cb24a454bd03108327f88d6295a4e159335c882b35ea3 (Scanned on 11/30/2017 18:27:27) File SHA256: 60278e5f8a2eb5c303c4a2f851ecfd9fd7bd52f544f48add1573a893d78ad210 (Scanned on 11/30/2017 17:48:44) Found malicious artifacts related to "163.172.176.167" (ASN: , Owner: ): ... URL: https://163.172.176.167/ (AV positives: 1/68 scanned on 09/10/2016 04:28:21) File SHA256: 8e6d63bb950fd50fae60185ec151bb16b8d2557a29c637c82e4b83b2cd0ad251 (AV positives: 13/68 scanned on 11/30/2017 12:32:45) File SHA256: fb4460c9ad98937b270aadb641b97395f6832e9044661d48d97369c9180165e0 (AV positives: 50/68 scanned on 11/30/2017 10:44:24) File SHA256: ae2a0cb9f7cb54212ee2970c7018269d09ff7394225c2eb9d7a88742b195d578 (AV positives: 47/68 scanned on 11/30/2017 10:40:02) File SHA256: 2c776a645a67bb07e5ce15ac8c6cee5c21d1de07e079dde5c8b6089559ea5670 (Scanned on 11/30/2017 11:08:47) File SHA256: ba82ea7d8030cd1ab9dc77def9cdf31e06cbae30264e149d2d089971070e9edf (Scanned on 11/30/2017 10:24:33) File SHA256: 5573849769b04618054792d37660a759d273a20960a3faf2186aad9d8df39658 (Scanned on 11/30/2017 09:11:53) File SHA256: b9ec82269efdc7dd70fb0073e87004eb588f6be6339426ee1cab72183c4a8a7f (Scanned on 11/30/2017 08:14:03) File SHA256: 97ddcd104327f19f1e1743d7c60a63142a0ca5f451b154516e8dd69d5cd9b378 (Scanned on 11/30/2017 05:37:50) File SHA256: 52a27f19644bf1922e890f4d57b7b6c8062940d7fb99bae713e4058011192d74 (AV positives: 36/68 scanned on 11/29/2017 23:58:34) File SHA256: 4ef77bf1293e66278b1b6b4f6ecb8d61612c38f8f094f4b3741a004d972f3e10 (AV positives: 39/68 scanned on 11/26/2017 03:43:51) Found malicious artifacts related to "199.254.238.52" (ASN: , Owner: ): ... URL: http://199.254.238.52/ (AV positives: 1/65 scanned on 11/17/2017 09:53:07) URL: http://199.254.238.52/tor/status-vote/current/consensus (AV positives: 1/65 scanned on 08/16/2017 20:31:15) URL: http://199.254.238.52:443/ (AV positives: 1/64 scanned on 05/19/2017 15:28:18) File SHA256: ba86720bc556c1a876c5f6fd073ee2caa9701a33412336b30a90368311d8026f (Scanned on 11/30/2017 15:39:32) File SHA256: 9d10701cfcd97eddac51ad837ef08e979ab95ab7b0e21d6b0ffc94f3490bd4da (Scanned on 11/30/2017 15:39:31) File SHA256: 2ff325ab37258464be8bd455e32f5100864cd6de88dd3ca1144dbb544fdb0a3e (Scanned on 11/28/2017 02:14:13) File SHA256: cc7eb857f08bf5578ac559a677106f6fed5f11113227f42e5e2a5b520f74caac (Scanned on 11/28/2017 02:09:56) File SHA256: d8f52a9df0609d3e8d46448ec31a0d8277de4ea427135a1d4ffab8672d70b622 (Scanned on 11/26/2017 23:13:50) File SHA256: c8278d41717fb084db2c4028cc19fa2da369469013987fb74599d95c67cee2ab (AV positives: 19/68 scanned on 11/19/2017 21:41:28) File SHA256: 0a71860bbc7c65a07359ec0851068cdfb9561167f9694efe6d3dddb7a263acbe (AV positives: 60/66 scanned on 11/13/2017 13:17:16) File SHA256: a7d3561bca0dd723bc41b22225f08b46c65f959341ef323e493a693cb6b36a22 (AV positives: 1/68 scanned on 11/11/2017 10:05:20) File SHA256: a628064dd7387344e5f94322522947a1f0a4eef1b96ecc4f9501b8a791d295c4 (AV positives: 60/66 scanned on 10/25/2017 06:21:41) File SHA256: 3bd147dc7ed94e5238e6ebd86f1f56660fbb8647cb771088bc84cca5d9562e1b (AV positives: 18/64 scanned on 09/23/2017 22:12:47) Found malicious artifacts related to "5.39.92.199" (ASN: , Owner: ): ... URL: https://5.39.92.199/ (AV positives: 1/68 scanned on 07/19/2016 21:43:18) File SHA256: ca85f4b037bb259e062cbec5c2e9b5de0d2bd7cc694b72ff1b4426400732b742 (AV positives: 49/68 scanned on 11/30/2017 08:55:28) File SHA256: 8416b5cd434d10bfeaaab2b63e25a63d1006d5bc2714627d1e1d0c46414e73e7 (AV positives: 49/68 scanned on 11/30/2017 02:01:10) File SHA256: 78c926e946684a7ab6ea9296e9868c54370f142392294b499e8184a2f90b7e53 (Scanned on 11/30/2017 08:36:03) File SHA256: 9dacfef4f8fc1a2ec8341ef54894738f5186679640f8b23e27a26fcbd1a4d805 (Scanned on 11/30/2017 01:37:55) File SHA256: b83002afa084f377d3d5599ae9de301e2d0047dc6abceda844878476e616558d (AV positives: 11/68 scanned on 11/29/2017 17:07:34) File SHA256: cb91f581b6d842735800faa6a57f0f1d81c1a50eab94925d6d3c32857ebb35f8 (AV positives: 10/67 scanned on 11/26/2017 16:10:57) File SHA256: 4c0741d1f52b3dcf597923f213d33314e9e0b393746ac5d62a2e89c5a6502e36 (AV positives: 15/65 scanned on 11/26/2017 13:18:16) File SHA256: f212935d24b5c15487c5fbb9004cfec6089d6668864c37423489d7597e5cdbf5 (Scanned on 08/01/2017 00:20:01) File SHA256: 781aed5184d749e2090ebb8d530ea091c1be7c70825c696262e4629c6f5cff6d (Scanned on 08/01/2017 00:15:45) File SHA256: c30fcf22c9bc111a14d41aeeb7ac70605ec7b9f6411df47ca697609839633255 (Scanned on 06/22/2017 22:32:19) Found malicious artifacts related to "159.203.15.100" (ASN: , Owner: ): ... File SHA256: 6d3e2964caae3e8c01f858a260a0e3a55e6954181cbd394a2292ce0d2f9d989a (AV positives: 48/68 scanned on 11/28/2017 21:00:11) File SHA256: 73d13f241dce8bc9efa939948cb0b68114aeeb8e8c44fdfae9638924cb7c8e5a (AV positives: 47/68 scanned on 11/28/2017 19:40:29) File SHA256: a682e547c82d85017a46f671b496f336d96794946081e9ddf1b48661ffe1926a (AV positives: 48/68 scanned on 11/28/2017 18:05:09) File SHA256: d72f8d49dce137c740e0902d2434d015fc40df905649c24f47b8e24e82cd6bd7 (AV positives: 47/68 scanned on 11/28/2017 17:54:54) File SHA256: d81ac572027d3fbb1ed842befad7fab8a9ea9665125f2f8f586bda12c457f8a6 (AV positives: 45/68 scanned on 11/28/2017 16:06:19) File SHA256: 0f9c58ac246a9e620e98dbd4829f53c0ec3781e97026f9827436ad398b11b53a (Scanned on 11/28/2017 16:40:30) File SHA256: ba8cffa88aa3950f24746219f58f7605c5a50762d006b8f283a9324882154cf6 (Scanned on 11/28/2017 14:21:57) File SHA256: bede31ca07a630e1470095356bd0995aa1f2d744878e2e69602efdc8eb755793 (Scanned on 11/28/2017 13:48:37) File SHA256: 7cf894103d7cb3f06d134388ea1031a63bef88bade750ee270de0a74ba0e0200 (Scanned on 11/28/2017 13:42:08) File SHA256: 0555a4bc052b769e2c6cc5ab6227daba23a34101abc12b6bc6165452f1e5dc9a (Scanned on 11/28/2017 13:41:44) Found malicious artifacts related to "87.118.112.63" (ASN: , Owner: ): ... File SHA256: cf2fad02b707c39c155e92194ced8740154cd03fb32242ba7d67fa6ab8f0686d (AV positives: 37/68 scanned on 11/30/2017 23:50:14) File SHA256: 694991c01b5caec0994b7ef1644bbe6eb254c31ee83f80a219c274bc22798b9a (AV positives: 12/68 scanned on 11/30/2017 10:37:36) File SHA256: ebe2e7053f5d8acf473afa12a6abcf9b8c32200bab9c9299bc99dce7d7d9552b (AV positives: 20/68 scanned on 11/30/2017 00:15:48) File SHA256: 1b7fab860dd9a587d851509b2c92cce06ae74aa7c823524b1ed0128c1bb007f7 (AV positives: 39/68 scanned on 11/27/2017 11:21:01) File SHA256: 1d9c953c86a3afa703110d34c78cecc8617f52e2562d310cf26083f8880cf649 (AV positives: 44/68 scanned on 11/26/2017 18:38:05) File SHA256: c5eaad6ce8466f20c7ce577a08a92ac5f5712e9c8e976ebb130c7d766eae5165 (Scanned on 08/31/2017 04:01:43) File SHA256: b82ac614e38a5def548954388bbef0a51779a7a1ec8cf2f6f91cd0d432c03aae (Scanned on 08/31/2017 03:57:47) File SHA256: ccbbf26f012571e2ed44d3d1211806ccd33ce190538da09fbbf9321b960c187d (Scanned on 07/26/2017 18:55:30) File SHA256: e6e5ec0eb573827b97e2767c50e887b5a13ae5fa18e31a894e44178d3b236f01 (Scanned on 07/26/2017 18:54:43) File SHA256: 21b1b63c44fc1d127355a31f11ba624ea27faea35db0c4113f69140e03eb4294 (Scanned on 07/26/2017 18:51:31) Found malicious artifacts related to "165.227.135.224" (ASN: , Owner: ): ... File SHA256: 27415e01644149af40a268feacdb90698e995eace8f15219e1dad664f7a73ca9 (AV positives: 11/68 scanned on 11/30/2017 20:52:12) File SHA256: 8e6d63bb950fd50fae60185ec151bb16b8d2557a29c637c82e4b83b2cd0ad251 (AV positives: 13/68 scanned on 11/30/2017 12:32:48) File SHA256: 694991c01b5caec0994b7ef1644bbe6eb254c31ee83f80a219c274bc22798b9a (AV positives: 12/68 scanned on 11/30/2017 10:37:38) File SHA256: 67ceb7be8c8c1231cbf525a5a5ecba69f826d7975ece9e232706e49e51d6b0b5 (AV positives: 33/68 scanned on 11/29/2017 20:07:15) File SHA256: bc5c4cc2023cebfd639878bd6e69a51a6ad66fe788fea33799e256ce0bae955a (AV positives: 34/68 scanned on 11/28/2017 02:37:28) File SHA256: 100a347a8e8b4a33d6fef7111292149596e85951967316eb2af0f2d59d87e1a9 (Scanned on 08/31/2017 02:34:30) File SHA256: d2087890e9c3af27d84305dfc8a4d7e041ca43d0ac9b2f85749190a62ef2fd7b (Scanned on 08/03/2017 00:02:11) File SHA256: fa956fa6fdbd13c893c7c29ec913fb46f150a5f376e19c239a4551555025d792 (Scanned on 07/21/2017 17:33:07) File SHA256: 0b533015a1695b0a7e3743781203d5b8d019840d94fa7c54fd1dd195e4454168 (Scanned on 07/21/2017 17:24:13) Found malicious artifacts related to "93.115.95.38" (ASN: , Owner: ): ... URL: https://93.115.95.38/ (AV positives: 1/68 scanned on 07/19/2016 19:48:09) File SHA256: 5c7729e8dad0dfa7a4e077f2e1722196f144bfaa7faad0f4c3987edeaf436e58 (AV positives: 11/68 scanned on 11/30/2017 13:59:14) File SHA256: e868404f18ebf2e57bdb8f00f68d778d5cb2f5bd6a710ae4bd2d8231dd07af1a (AV positives: 31/68 scanned on 11/26/2017 03:07:04) File SHA256: c64be24b14fbbf4d58c99ff49cefacf2ed5a40ce6cecf55716b0ae4b7f4bcff8 (AV positives: 43/66 scanned on 11/25/2017 16:58:06) File SHA256: 7976bd535b18819222619005c2835767395482362ee417d094b9afbf5e141314 (AV positives: 46/65 scanned on 11/24/2017 20:02:57) File SHA256: 97c9a220443ca6479aab5a3cdcdfc855d6e810e63425639a631c3647956d0c8a (AV positives: 20/66 scanned on 11/22/2017 11:36:03) File SHA256: 2ad6f7c83c45b8a763773bfb66a42c46324220783e793d3132fe9b94f9db248d (Scanned on 08/26/2017 04:31:31) File SHA256: a0bfd1c09fb3b559868b7305d403a913f6cb978e330f5a0e952e5ef11abbcb30 (Scanned on 08/12/2017 17:47:57) File SHA256: 8eccc4cedb6765fb5aa29e010424b838c37807f8e86becefd60931fc97e34bec (Scanned on 07/23/2017 00:45:33) File SHA256: 757b00e13371becb5c0278ca5a9a2c31056b80d68c0ff1bdabcb801a5e5fbf8d (Scanned on 07/23/2017 00:38:50) File SHA256: 89956cbffd5962ea560988b1751231c25af8718f8e04b734cd8de86828dfb138 (Scanned on 07/19/2017 17:07:15)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266448501,"unified_at":"2026-09-24T16:14:08.501Z","metadata":{"hashes":{"sha256":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c","sha1":"9a78ddcf47ca5a83bf0da792d0516a5bab601f2c","md5":"ba91677b6fbef8e5bc519f5a39f60503","sha512":"2383ead3d5e3d9be044d47eba38cfc629cc3de503de67e28827fcc8cb65753e4d80eac49a930f9431a2ed4db9dd7c7f3a284818425a8013463c0a5b74f33c9ef","ssdeep":"98304:GGjN6czfGK3KrAPQcj5EzYWucpNR6j/s2sy:zrzJKiZj5EzYWu0NR6j/sI","ssdeep_chunks":["98304:GGjN6cz","98304:GjN6czf","98304:jN6czfG","98304:N6czfGK","98304:6czfGK3","98304:czfGK3K","98304:zfGK3Kr","98304:fGK3KrA","98304:GK3KrAP","98304:K3KrAPQ","98304:3KrAPQc","98304:KrAPQcj","98304:rAPQcj5","98304:APQcj5E","98304:PQcj5Ez","98304:Qcj5EzY","98304:cj5EzYW","98304:j5EzYWu","98304:5EzYWuc","98304:EzYWucp","98304:zYWucpN","98304:YWucpNR","98304:WucpNR6","98304:ucpNR6j","98304:cpNR6j/","98304:pNR6j/s","98304:NR6j/s2","98304:R6j/s2s","98304:6j/s2sy","196608:GGjN6cz","196608:GjN6czf","196608:jN6czfG","196608:N6czfGK","196608:6czfGK3","196608:czfGK3K","196608:zfGK3Kr","196608:fGK3KrA","196608:GK3KrAP","196608:K3KrAPQ","196608:3KrAPQc","196608:KrAPQcj","196608:rAPQcj5","196608:APQcj5E","196608:PQcj5Ez","196608:Qcj5EzY","196608:cj5EzYW","196608:j5EzYWu","196608:5EzYWuc","196608:EzYWucp","196608:zYWucpN","196608:YWucpNR","196608:WucpNR6","196608:ucpNR6j","196608:cpNR6j/","196608:pNR6j/s","196608:NR6j/s2","196608:R6j/s2s","196608:6j/s2sy","98304:zrzJKiZ","98304:rzJKiZj","98304:zJKiZj5","98304:JKiZj5E","98304:KiZj5Ez","98304:iZj5EzY","98304:Zj5EzYW","98304:5EzYWu0","98304:EzYWu0N","98304:zYWu0NR","98304:YWu0NR6","98304:Wu0NR6j","98304:u0NR6j/","98304:0NR6j/s","98304:NR6j/sI"],"imphash":"4f67aeda01a0484282e8c59006b0b352"},"file_info":{"file_name":"icon.jpg","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3276073,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1512086523000,"last_seen":1677134269000,"last_multi_scan":1677134269000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":16,"suspicious_count":21,"malicious_count":11,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/NSIS.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224860","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.RansomKD.12647464","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.IF.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.RansomKD.12647464 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Sigma.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051ef4e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.exiywn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_SIGMA.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_SIGMA.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.DC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 7226-134-62E92C70\n SetUnhandledExceptionFilter@KERNEL32.dll at 9519-898-62126270\n SetUnhandledExceptionFilter@KERNEL32.dll at 14707-1669-659C0050\n SetUnhandledExceptionFilter@KERNEL32.dll at 42407-1007-6E450300\n SetUnhandledExceptionFilter@KERNEL32.dll at 48654-7-004014E0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 43338-7-631F4380","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVCHOST.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVCHOST.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"\n \"archive.torproject.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.194.141.58:80\"\n \"94.130.28.200:443\"\n \"163.172.176.167:443\"\n \"199.254.238.52:443\"\n \"5.39.92.199:443\"\n \"159.203.15.100:80\"\n \"87.118.112.63:9001\"\n \"165.227.135.224:9001\"\n \"93.115.95.38:443\"\n \"1.1.1.1\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsn4AA0.tmp\"\n \"\" created file \"%TEMP%\\nsn4AA1.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\nsn4AA1.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\naj\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"libevent-2-0-5.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"libevent_core-2-0-5.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip\nHost: ip-api.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\"\" on 2017-12-1.00:43:34.317","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015938-00003424)\n Spawned process \"svchost.exe\" (UID: 00020445-00002776)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\"\" (UID: 00022665-00003008)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00022680-00003120)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.08290294622","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"ECDSA\" (Indicator: \"ecdsa\"; File: \"ssleay32.dll.1346909813\")\n \"RC4\" (Indicator: \"rc4\"; File: \"ssleay32.dll.1346909813\")\n \"DES\" (Indicator: \"des\"; File: \"ssleay32.dll.1346909813\")\n \"AES128\" (Indicator: \"aes128\"; File: \"ssleay32.dll.1346909813\")\n \"AES256\" (Indicator: \"aes256\"; File: \"ssleay32.dll.1346909813\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"m LSAkc0pvTGWqeMUm+vxtmYkwt7JvgTfHo62w9+0O/F8\" (Indicator: \"qemu\")\n \"id ed25519 jQT6rLV4vbOXahQwHI2E1Ft1G3dVvP5iOe+O2D3IicQ\" (Indicator: \"vbox\")\n \"MIGJAoGBAMeJpSyO1qlPpDXtW27+ieynz3Z+qEmudMH9du0aYBrjqcbYPPt/xsFd\" (Indicator: \"qemu\")\n \"id ed25519 oBcWh18xyuWrMnRfRQEMUl6fxGEBpOQPVBqsQRTgWN0\" (Indicator: \"qemu\")\n \"beclZUc55XOlrROuGAZ7VboxEVZLIJqrITcU421KQ2JZcNlqESlxAgMBAAE=\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"1385005056,1385021439,HU\" (Indicator: \"005056\")\n \"1730050560,1730051071,ID\" (Indicator: \"005056\")\n \"1753005056,1753006079,US\" (Indicator: \"005056\")\n \"3000567808,3000569855,RS\" (Indicator: \"000569\")\n \"3000569856,3000571903,BE\" (Indicator: \"000569\")\n \"3289005056,3289005311,TZ\" (Indicator: \"005056\")\n \"3561005056,3561013247,ES\" (Indicator: \"005056\")\n \"3590005056,3590005071,DE\" (Indicator: \"005056\")\n \"3630050560,3630050815,CA\" (Indicator: \"005056\")","origin":"File/Memory","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/63 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2a","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CHROME\"; Value: \"Rundll32.exe SHELL32.DLL,ShellExec_RunDLL %APPDATA%\\Microsoft\\B731DB1DC88D5C9CEEC8A9EEE075DB43\\taskwgr.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"details too long to display","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"r47bZHGhzmSvncUHO/ttQIJCODQ2GMHlUuep9IVNqroC9l9g37uFAgMBAAE=\" (Indicator for product: Generic VNC)\n \"id ed25519 vM549wCXQ/fFoWpykGulgvTmvnchF/PbcDBAVJs4nx0\" (Indicator for product: Generic VNC)\n \"tGMwcyfEXATzF8/783VM/X0wdJTt5P5to0Vh+zPw0WWQ2kKbvnc9AgMBAAE=\" (Indicator for product: Generic VNC)\n \"b4oam/TnehYTDjIUxmO99GL9g9gT5fvncnpXAAPQ0u6Bfow/+k1GspZOgkaK04m1\" (Indicator for product: Generic VNC)\n \"26tn5TTvncs2k3D4gQpQoOsdVyVzZn/u2H5T095C7sLqRE+B9JXLAgMBAAE=\" (Indicator for product: Generic VNC)\n \"d0gRLrnyeVH6ZoTB09ShC4p8WVdj3bgWs88MM/mCEWqv0Buw0qWuYxhvncpdXibn\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"cmd=\" (Indicator: \"cmd=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00022680-00003120)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ssleay32.dll\" claimed CRC 764532 while the actual is CRC 26737\n \"libevent-2-0-5.dll\" claimed CRC 781000 while the actual is CRC 764532\n \"tor.exe\" claimed CRC 3340358 while the actual is CRC 781000\n \"libevent_core-2-0-5.dll\" claimed CRC 467440 while the actual is CRC 3340358\n \"libeay32.dll\" claimed CRC 3230883 while the actual is CRC 467440\n \"tor-gencert.exe\" claimed CRC 1040324 while the actual is CRC 3230883\n \"libssp-0.dll\" claimed CRC 107654 while the actual is CRC 1040324\n \"libevent_extra-2-0-5.dll\" claimed CRC 451113 while the actual is CRC 107654\n \"libgcc_s_sjlj-1.dll\" claimed CRC 540122 while the actual is CRC 451113\n \"zlib1.dll\" claimed CRC 145013 while the actual is CRC 540122","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n VirtualProtect\n VirtualAlloc\n LoadLibraryA\n UnhandledExceptionFilter\n TerminateProcess\n accept\n connect\n recv\n send\n WSASend\n listen\n closesocket\n socket\n bind\n recvfrom\n sendto\n GetModuleFileNameW\n GetVersionExA\n OpenProcess\n MapViewOfFile\n GetStartupInfoA\n CreateFileMappingA\n WSAStartup","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ssleay32.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_core-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libeay32.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libssp-0.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_extra-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libgcc_s_sjlj-1.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"zlib1.dll\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"svchost.exe\" at non-system pathway \"%APPDATA%\\Microsoft\\B731DB1DC88D5C9CEEC8A9EEE075DB43\\Tor\\svchost.exe\" (UID: 00020445-00002776)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\Microsoft\\B731DB1DC88D5C9CEEC8A9EEE075DB43\\taskwgr.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/68 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/66 Antivirus vendors marked dropped file \"ssleay32.dll\" as malicious (1% detection rate)\n 2/86 Antivirus vendors marked dropped file \"tor.exe\" as malicious (classified as \"Trojan.Heur\" with 2% detection rate)\n 1/86 Antivirus vendors marked dropped file \"libeay32.dll\" as malicious (classified as \"Process timed out\" with 1% detection rate)\n 1/80 Antivirus vendors marked dropped file \"tor-gencert.exe\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/85 Antivirus vendors marked dropped file \"libssp-0.dll\" as malicious (classified as \"Process timed out\" with 1% detection rate)\n 2/85 Antivirus vendors marked dropped file \"libevent_extra-2-0-5.dll\" as malicious (classified as \"Process timed out\" with 2% detection rate)\n 1/85 Antivirus vendors marked dropped file \"libgcc_s_sjlj-1.dll\" as malicious (1% detection rate)\n 1/85 Antivirus vendors marked dropped file \"zlib1.dll\" as malicious (1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"5/68 Antivirus vendors marked spawned process \"\" (PID: 3424) as malicious (classified as \"BehavesLike.ObfusRansom\" with 7% detection rate)\n 2/86 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 2776) as malicious (classified as \"Trojan.Heur\" with 2% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"\" set thread context in remote process \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\" (PID 00000d60)","origin":"API Call","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\" (Handle: 368)\n \"\" wrote 52 bytes to a remote process \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\" (Handle: 368)\n \"\" wrote 4 bytes to a remote process \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\" (Handle: 368)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014866-00002180)\n Spawned process \"\" (UID: 00015938-00003424)\n Spawned process \"svchost.exe\" (UID: 00020445-00002776)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\"\" (UID: 00022665-00003008)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00022680-00003120)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}],"incidents":[{"name":"Remote Access","details_count":4,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"},{"detail":"Contains a remote desktop related string"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a2097c07ca3e12a7f2af113","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"BehavesLike.ObfusRansom","contacted_countries":["AUS","DEU","FRA","GBR","ROU","USA"],"submit_name":"icon.jpg","analysis_start_time":"2017-12-01T00:40:42+00:00","indicators_count":{"informative":16,"suspicious":26,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.194.141.58","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"94.130.28.200","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"163.172.176.167","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"199.254.238.52","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"5.39.92.199","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"159.203.15.100","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"87.118.112.63","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"165.227.135.224","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"93.115.95.38","port":443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"address":"1.1.1.1","port":0,"protocol":"ICMP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}],"dns_resolutions":[{"domain":"archive.torproject.org","address":"94.130.28.200","country":"Germany","registrar_name":"CSL Computer Service Langenbach GmbH d/b/a joker.com a German GmbH","registrar_organization":"The Tor Project, Inc","registrar_name_servers":"NS1.TORPROJECT.ORG","registrar_creation_date":"2006-10-17T22:02:50+00:00","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"domain":"ip-api.com","address":"185.194.141.58","country":"Germany","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"185.194.141.58:80","url":"/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip\nHost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}],"processes":[{"pid":2180,"ppid":0,"name":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe","command_line":"","sha256":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c","normalized_path":"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe","uid":"00014866-00002180","icon":"$2d"},{"pid":3424,"ppid":2180,"name":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe","command_line":"","sha256":"6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c","normalized_path":"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe","parent_uid":"00014866-00002180","uid":"00015938-00003424","icon":"$2e"},{"pid":2776,"ppid":3424,"name":"svchost.exe","command_line":"","sha256":"bfea9e5a4cb7b012454b24c5d76b4bbfdd92fd3a367c438ddf47ed81f618f8f1","normalized_path":"%APPDATA%\\Microsoft\\B731DB1DC88D5C9CEEC8A9EEE075DB43\\Tor\\svchost.exe","parent_uid":"00015938-00003424","uid":"00020445-00002776","icon":"$2f"},{"pid":3008,"ppid":3424,"name":"cmd.exe","command_line":"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015938-00003424","uid":"00022665-00003008","icon":"$30"},{"pid":3120,"ppid":3008,"name":"PING.EXE","command_line":"ping 1.1.1.1 -n 1 -w 3000","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00022665-00003008","uid":"00022680-00003120","icon":"$31"}],"all_imported_dlls":["gdi32.dll","shell32.dll","profapi.dll","System.dll","winnsi.dll","rpcrt4.dll","comctl32.dll","version.dll","cryptsp.dll","wkscli.dll","psapi.dll","libgcc_s_sjlj-1.dll","oleaut32.dll","dwmapi.dll","rpcss.dll","libevent-2-0-5.dll","netutils.dll","srvcli.dll","libssp-0.dll","winbrand.dll","wshqos.dll","ntdll.dll","usp10.dll","msvcrt.dll","Wldap32.dll","rsaenh.dll","msasn1.dll","ws2_32.dll","wininet.dll","WSHTCPIP.DLL","uxtheme.dll","apphelp.dll","nsi.dll","FWPUCLNT.DLL","iertutil.dll","dhcpcsvc6.dll","lpk.dll","shlwapi.dll","cfgmgr32.dll","cryptbase.dll","oleacc.dll","dnsapi.dll","rasadhlp.dll","tzres.dll","kernel32.dll","KernelBase.dll","devobj.dll","propsys.dll","urlmon.dll","ssleay32.dll","netapi32.dll","mswsock.dll","imm32.dll","sspicli.dll","wship6.dll","libeay32.dll","sechost.dll","ole32.dll","zlib1.dll","advapi32.dll","msctf.dll","userenv.dll","dhcpcsvc.dll","ieframe.dll","setupapi.dll","crypt32.dll","user32.dll","oleaccrc.dll","clbcatq.dll","shfolder.dll","ntmarta.dll","IPHLPAPI.DLL","cscapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"libssp-0.dll","sha256":"f5489fb8b5229424ddbd8f38bb93d9a950d029d9d3f36fc1e531086819061cd7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"tor.exe","sha256":"bfea9e5a4cb7b012454b24c5d76b4bbfdd92fd3a367c438ddf47ed81f618f8f1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"libeay32.dll","sha256":"fe5d316c59ac5b663741d70a922818129275071d1f2b83339059e488e6d9a7b3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"tor-gencert.exe","sha256":"0dde189b6b3a19cef666bc6454964b601699a64d9fda3b3c895f4171455cbc42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"libevent_extra-2-0-5.dll","sha256":"dbc8a9a2cb33940283078e6d7b767499743e1988479482c7d54d435e943de158","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"libevent-2-0-5.dll","sha256":"d1ee97282a2ddfcbd7cc6f45f8278c56bfcc3896b05c4f5ebbc5e5d7d4a897b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"libgcc_s_sjlj-1.dll","sha256":"4438b384066ae07fb9537ba948c020323d03d53e197ac6c3629a135f3a44cd27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"zlib1.dll","sha256":"dbf9926c56f4fd53418e7e078cc6fb0e23f056e2035c09ae9b1ba236306de44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"System.dll","sha256":"fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"ssleay32.dll","sha256":"aa7db86c6995ab0c38d88b910484c1cda6f318bc9b82f3123cd65743ab3efd55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"libevent_core-2-0-5.dll","sha256":"5f057c50bdd22e4d481cf033984d66b9ab7b79e7388a8a928d8a048e08f40386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"cached-microdesc-consensus.tmp","sha256":"2bd5d5862f8b560264c5a1148d771a9416679811d4c0513c983c3029d0cdebc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"cached-certs.tmp","sha256":"e808dba5ebbac6809ee0fc67bac823e9c0912ce63d7cf16f486485060a3bb2e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"cached-microdescs.new","sha256":"d1578f9829813ef9789d93818aaef9ba97e432236e733496383e44318ee02e8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"geoip","sha256":"7089d533bb1ffc3066e11f14e39e88bd5dec48cb17edfdb0d96a943bdb88e076","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"geoip6","sha256":"62aa48f57397902b2ee8e0e9abcc98237c70699a956cf0436cc187a4a8ce4618","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"state.tmp","sha256":"24c2defea4433a842432d752dda5ddaa039ee197739f1249a277f38bae994785","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"unverified-microdesc-consensus.tmp","sha256":"2bd5d5862f8b560264c5a1148d771a9416679811d4c0513c983c3029d0cdebc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"naj","sha256":"fd6eb851e8d4257ab35b13ea3d5dcb4bc37118b4c1f4519b3153bcbbc91140a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"System.zip","sha256":"a8fd270295e7fd433693d638c69160aa7ed6810b1a4253039bad0ba68dbacee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}],"files_written":[{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"C:\\Users\\N5M07OK","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%TEMP%\\nsn4AA1.tmp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%TEMP%\\nsn4AA0.tmp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%TEMP%\\naj","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%TEMP%\\nsn4AA1.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\Microsoft\\B731DB1DC88D5C9CEEC8A9EEE075DB43\\taskwgr.exe","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"C:\\6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\Microsoft\\B731DB1DC88D5C9CEEC8A9EEE075DB43\\taskwgr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\lock","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\router-stability","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\geoip","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\geoip6","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-certs","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\unverified-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-certs.tmp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"path":"%APPDATA%\\tor\\state.tmp","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a2097c07ca3e12a7f2af113"}]}]}},"report_ids":{"sandbox_job_ids":["5a2097c07ca3e12a7f2af113"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6f73b98463f0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6f73b98463f0…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6f73b98463f0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6f73b98463f0…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6f73b98463f02cefe7d6d96d56c8d8d8acd5e3b1e1b43e8f1b25b153f97aa24c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6f73b98463f0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6f73b98463f0…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]