24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Androm.Generic Sample 7646c2afbc8b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7646c2afbc8b…. Malware family: MSIL.Androm.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be","keywords":["Malicious","MSIL.Androm.Generic","malware analysis","sandbox report","threat intelligence","7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Androm.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T839,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T81a,".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T736,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\pubpol247.dat" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\fb36278a0a934ae244f843b62229421c\System.Windows.Forms.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\3c20a6b0ca532bcc6271bf4b7ad0b4d9\System.Drawing.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ce9750286ad44cbfb2acf176df9df0a2\System.Configuration.ni.dll.aux" ".exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\7aa0dcace3b5d10b626540709537d280\System.Core.ni.dll.aux"28:T944,".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32" (Filter: 14; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS" (Filter: 14; Subtree: 0) ".exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 4; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) ".exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) ".exe" monitors "\REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1)29:T951,".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2a:T995,".exe" wrote bytes "f8110000" to virtual address "0x75681408" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b84013c86bffe0" to virtual address "0x75681248" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48126875" to virtual address "0x75698348" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8116875" to virtual address "0x75698368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x76E11680" (part of module "WS2_32.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x756812CC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8116875" to virtual address "0x7569834C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "fae68f77e1a694772e719477ee29947785e28f776da0947726e48f77d16d9477003d9277804b927700000000ad37e1768b2de176b641e17600000000" to virtual address "0x74C81000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "e5f54cf1" to virtual address "0x6D7DF314" (part of module "CLR.DLL") ".exe" wrote bytes "48126875" to virtual address "0x756983C0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8116875" to virtual address "0x756983E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b83012c86bffe0" to virtual address "0x76E11368" (part of module "WS2_32.DLL") ".exe" wrote bytes "f8116875" to virtual address "0x756983C4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48126875" to virtual address "0x75698364" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c04e927720549377e0659377b53894770000000000d0e97600000000c5eae9760000000088eae97600000000e968987582289477ee29947700000000d2699875000000007dbbe9760000000009be987500000000ba18e97600000000" to virtual address "0x77AE1000" (part of module "NSI.DLL") ".exe" wrote bytes "b8c015c86bffe0" to virtual address "0x756811F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "6012c86b" to virtual address "0x70B84028" (part of module "WEBIO.DLL") ".exe" wrote bytes "48120000" to virtual address "0x7568139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x756812DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48126875" to virtual address "0x756983DC" (part of module "SSPICLI.DLL")2b:T1899,Found malicious artifacts related to "52.43.40.243": ... File SHA256: 52f3f88108a0cf0f2a283d149f9ab07c13d245ea113024edcd2e5444433111ee (AV positives: 20/71 scanned on 02/19/2019 12:19:47) File SHA256: df793d612dc0eeaaba58cfb0fbc328928ae6d647c27f28513f247829c8d52f85 (Date: 02/17/2019 02:12:01) File SHA256: 9f2f80dc5b4edb36f5cffe7fb7ad62a01fb4e79c428ff052576bd35f333631de (AV positives: 23/72 scanned on 02/15/2019 03:40:05) File SHA256: b2499c9dbb42c1207a4b1759871db231fc50bb6b0f1a0e92dbbbeab51e93cf9d (AV positives: 23/71 scanned on 02/15/2019 02:49:28) File SHA256: 923d319577491a2bff4baa76ef467ce0ff07e91f4b193a2a44d68ea7f17df11c (AV positives: 21/71 scanned on 02/15/2019 01:56:03) File SHA256: 521fd6507190aa65a3b05617e89307acd776769c90e81500b55e9c2f7fe5a81c (AV positives: 39/71 scanned on 02/15/2019 00:33:59) File SHA256: 322777e91235afdde87966165b8cc7a071eaf083f533cedcc039221f78efd4b4 (Date: 12/16/2018 20:43:28) File SHA256: 86472ebe16f8c73c26a91740d8b7f5572cf5937a8b282dd7094d80c834589bad (Date: 12/16/2018 20:40:18) File SHA256: 61315844887df806ab5060f4a4a170bdde0dcd782f52a72e1f7c9e989241d9e3 (Date: 10/31/2018 17:03:21) File SHA256: 7f72fb4024fb48df4497bdf695d3621c49e669322fc6a47cd4e24901bf73effb (Date: 10/06/2018 05:42:55) Found malicious artifacts related to "13.249.87.86": ... URL: http://dl.tunepcsoftutils.live/ppc/securerc/tunepcsoftutils_live/ppcsetup.exe (AV positives: 2/69 scanned on 03/10/2019 22:52:39) URL: http://files.creative.com/manualdn/Applications/AVP/12632/0x3B927ED5/SBZ_PC_WEBDT_LD_1_05.exe (AV positives: 1/69 scanned on 03/10/2019 20:14:03) URL: https://www.williamhill.com/ (AV positives: 1/66 scanned on 03/09/2019 05:21:56) URL: https://dl.jpsystemutils.xyz/ (AV positives: 5/69 scanned on 03/07/2019 06:12:36) URL: http://dl.frostwire.com/stub/PFM010/5.4.0/ (AV positives: 1/69 scanned on 02/28/2019 07:24:08) File SHA256: 3e917ebd73581363b09e9ebe32c664b6716f8be966f6f6b991605a1ec4798f78 (AV positives: 23/71 scanned on 03/10/2019 11:25:29) File SHA256: e3ec179efffd6cd69cdaa809fff60985771ba4306c834ff51e2f225bdfb09c38 (AV positives: 1/71 scanned on 03/03/2019 17:30:49) File SHA256: 162a01cce169fe9a7e917d7b9d9e682e012d0731e41b9d555e346d8fa0468c89 (AV positives: 1/71 scanned on 12/07/2018 01:03:57) File SHA256: 6efccdf48d22dd1f8230f017ebd17b39494356934fb088df1cef7fa5b85f77d9 (AV positives: 26/68 scanned on 12/05/2018 18:58:16) File SHA256: c3ff6d1f2357eb3750ea775d8cb9cd399b11a7e9a91783ef86675f44079edee6 (AV positives: 1/63 scanned on 12/01/2018 16:13:55) Found malicious artifacts related to "172.217.9.67": ... File SHA256: ddcf8e07ba47a352c8603ed6adf87f8fb720394950c21f100c323c80ee234558 (AV positives: 57/69 scanned on 02/04/2019 06:52:26) File SHA256: ae1a1ed1d9256bd2c7887299dfd0d47bec249267758673a5311b4eca1d21fd0d (AV positives: 53/70 scanned on 02/03/2019 23:48:30) File SHA256: d570587cb8e7040ce54f0d6082408e8903c81b152b5150d9de53e13c90023abf (AV positives: 57/70 scanned on 02/02/2019 23:41:32) File SHA256: 816b1a1353a1223fe9a3f359f1d303f695ac18d70890e02deb35b00e529ba50c (AV positives: 53/70 scanned on 02/02/2019 23:48:19) File SHA256: 19e37070ec92512d897c851d47e4b7f3102c3b0985e3735eee633ed7a9a2a975 (AV positives: 56/70 scanned on 02/02/2019 01:14:51) File SHA256: 26b1eebafacd79f308191169371166db01f99bd5355ffa5af9c363e9f9dc54ab (Date: 03/02/2018 02:00:54) File SHA256: 0bd4f6b92ab2f4da250d873ed8c38aed0a52a5694c988ee86e47f9cc1a8d0bd1 (Date: 01/19/2018 21:51:31) File SHA256: 03a3f7d9a57bffa2508165d84779ece59796d3c99c486f48dffa1a8c0e78fced (Date: 01/19/2018 21:50:15) File SHA256: c73fe003a0ef33352bc92502401e2c33feff965e539f837adada72906a235823 (Date: 12/24/2017 04:41:00) File SHA256: e699feb7022ea08758e25de6e5169e1f8eb32e9b66de0583d64cf7d04d27e36b (Date: 12/24/2017 03:46:08) Found malicious artifacts related to "52.34.90.23": ... File SHA256: f4ccef87aab74f6cf9d49614e4857d006ff3fe7ca13e2b5ce67c6c3cb7938f9c (AV positives: 21/70 scanned on 02/15/2019 05:47:57) File SHA256: 875aa3233cdac1e0ac29616015065c62eeea5b49607f36e3755ea4a5826a11b7 (AV positives: 20/70 scanned on 02/15/2019 01:58:56) File SHA256: 470d48752fb645b7f0d0bf804020e228bb715fbe0acf3a71ce8f5568cef463d5 (AV positives: 21/71 scanned on 02/15/2019 00:37:18) File SHA256: 88d401d26a93c74f53e7b19bb8717a6b0ad3a0cd6bc1a09ec8c1a30777b125f7 (AV positives: 20/71 scanned on 02/15/2019 01:47:23) File SHA256: f28ef7b2c62754047cbd805ba9d893dcab7a856c7e0e1a5b099d37998ff2b2b4 (AV positives: 21/71 scanned on 02/15/2019 05:33:28) File SHA256: a58bd7d7b582be4ab86bf51721aa2dc62a9733af6da1c719b08d669ce34f059e (Date: 11/23/2018 09:37:14) File SHA256: 1b5facd9ef6fd440ac365f3bf59373c523c809958012747cfe3f34955ef6afb4 (Date: 11/23/2018 09:34:29) File SHA256: 61315844887df806ab5060f4a4a170bdde0dcd782f52a72e1f7c9e989241d9e3 (Date: 10/31/2018 17:03:21) File SHA256: 21146077864031317be3f895b5bc263253748b1672d3ffa4f3c3f622cfb9a3fc (Date: 09/28/2018 16:29:54) File SHA256: b80dc469a685bbe27a93f19b8e4deb71933575e1cc6256a6d8c35969dbeda703 (Date: 09/28/2018 04:56:26) Found malicious artifacts related to "13.249.87.9": ... URL: https://api.al1cloud.com/9/sim/4J213OU4F0P3PZW1 (AV positives: 2/69 scanned on 03/14/2019 02:09:41) URL: http://cf-aldn.altools.co.kr/setup/ALDrive20_co.exe (AV positives: 1/69 scanned on 03/11/2019 23:24:03) URL: http://aldn.altools.co.kr/altools/alupdate/20090714/AZMain.dll (AV positives: 4/69 scanned on 03/10/2019 08:41:19) URL: http://aldn.altools.co.kr/setup/ALZip97_go_update.exe (AV positives: 4/69 scanned on 03/10/2019 00:24:03) URL: http://www.oono-clinic-ladies.com/ (AV positives: 4/69 scanned on 03/09/2019 17:30:07) File SHA256: bd47931ece3aa1295fc9f4c0c72ddab2b42215e9773bba4398cffa5685bbf030 (AV positives: 21/68 scanned on 02/23/2019 05:54:37) File SHA256: 962e71852d823c3d28eb3fd3c2dddba1ed660e8eb35caa610e395bd4bf11bb39 (AV positives: 10/69 scanned on 02/21/2019 15:56:46) File SHA256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 (AV positives: 1/52 scanned on 02/15/2019 14:28:15) File SHA256: 607b7d6fc6aeda981632abf6591dfa395554afab9da095475d24ab14d307caeb (AV positives: 10/65 scanned on 02/12/2019 09:28:26) File SHA256: 6735e91191c46660b8567eece84ee322486dc3318120875590eb2b0f9893afb6 (AV positives: 3/69 scanned on 02/10/2019 13:47:50)2c:T1899,Found malicious artifacts related to "52.43.40.243": ... File SHA256: 52f3f88108a0cf0f2a283d149f9ab07c13d245ea113024edcd2e5444433111ee (AV positives: 20/71 scanned on 02/19/2019 12:19:47) File SHA256: df793d612dc0eeaaba58cfb0fbc328928ae6d647c27f28513f247829c8d52f85 (Date: 02/17/2019 02:12:01) File SHA256: 9f2f80dc5b4edb36f5cffe7fb7ad62a01fb4e79c428ff052576bd35f333631de (AV positives: 23/72 scanned on 02/15/2019 03:40:05) File SHA256: b2499c9dbb42c1207a4b1759871db231fc50bb6b0f1a0e92dbbbeab51e93cf9d (AV positives: 23/71 scanned on 02/15/2019 02:49:28) File SHA256: 923d319577491a2bff4baa76ef467ce0ff07e91f4b193a2a44d68ea7f17df11c (AV positives: 21/71 scanned on 02/15/2019 01:56:03) File SHA256: 521fd6507190aa65a3b05617e89307acd776769c90e81500b55e9c2f7fe5a81c (AV positives: 39/71 scanned on 02/15/2019 00:33:59) File SHA256: 322777e91235afdde87966165b8cc7a071eaf083f533cedcc039221f78efd4b4 (Date: 12/16/2018 20:43:28) File SHA256: 86472ebe16f8c73c26a91740d8b7f5572cf5937a8b282dd7094d80c834589bad (Date: 12/16/2018 20:40:18) File SHA256: 61315844887df806ab5060f4a4a170bdde0dcd782f52a72e1f7c9e989241d9e3 (Date: 10/31/2018 17:03:21) File SHA256: 7f72fb4024fb48df4497bdf695d3621c49e669322fc6a47cd4e24901bf73effb (Date: 10/06/2018 05:42:55) Found malicious artifacts related to "13.249.87.86": ... URL: http://dl.tunepcsoftutils.live/ppc/securerc/tunepcsoftutils_live/ppcsetup.exe (AV positives: 2/69 scanned on 03/10/2019 22:52:39) URL: http://files.creative.com/manualdn/Applications/AVP/12632/0x3B927ED5/SBZ_PC_WEBDT_LD_1_05.exe (AV positives: 1/69 scanned on 03/10/2019 20:14:03) URL: https://www.williamhill.com/ (AV positives: 1/66 scanned on 03/09/2019 05:21:56) URL: https://dl.jpsystemutils.xyz/ (AV positives: 5/69 scanned on 03/07/2019 06:12:36) URL: http://dl.frostwire.com/stub/PFM010/5.4.0/ (AV positives: 1/69 scanned on 02/28/2019 07:24:08) File SHA256: 3e917ebd73581363b09e9ebe32c664b6716f8be966f6f6b991605a1ec4798f78 (AV positives: 23/71 scanned on 03/10/2019 11:25:29) File SHA256: e3ec179efffd6cd69cdaa809fff60985771ba4306c834ff51e2f225bdfb09c38 (AV positives: 1/71 scanned on 03/03/2019 17:30:49) File SHA256: 162a01cce169fe9a7e917d7b9d9e682e012d0731e41b9d555e346d8fa0468c89 (AV positives: 1/71 scanned on 12/07/2018 01:03:57) File SHA256: 6efccdf48d22dd1f8230f017ebd17b39494356934fb088df1cef7fa5b85f77d9 (AV positives: 26/68 scanned on 12/05/2018 18:58:16) File SHA256: c3ff6d1f2357eb3750ea775d8cb9cd399b11a7e9a91783ef86675f44079edee6 (AV positives: 1/63 scanned on 12/01/2018 16:13:55) Found malicious artifacts related to "172.217.9.67": ... File SHA256: ddcf8e07ba47a352c8603ed6adf87f8fb720394950c21f100c323c80ee234558 (AV positives: 57/69 scanned on 02/04/2019 06:52:26) File SHA256: ae1a1ed1d9256bd2c7887299dfd0d47bec249267758673a5311b4eca1d21fd0d (AV positives: 53/70 scanned on 02/03/2019 23:48:30) File SHA256: d570587cb8e7040ce54f0d6082408e8903c81b152b5150d9de53e13c90023abf (AV positives: 57/70 scanned on 02/02/2019 23:41:32) File SHA256: 816b1a1353a1223fe9a3f359f1d303f695ac18d70890e02deb35b00e529ba50c (AV positives: 53/70 scanned on 02/02/2019 23:48:19) File SHA256: 19e37070ec92512d897c851d47e4b7f3102c3b0985e3735eee633ed7a9a2a975 (AV positives: 56/70 scanned on 02/02/2019 01:14:51) File SHA256: 26b1eebafacd79f308191169371166db01f99bd5355ffa5af9c363e9f9dc54ab (Date: 03/02/2018 02:00:54) File SHA256: 0bd4f6b92ab2f4da250d873ed8c38aed0a52a5694c988ee86e47f9cc1a8d0bd1 (Date: 01/19/2018 21:51:31) File SHA256: 03a3f7d9a57bffa2508165d84779ece59796d3c99c486f48dffa1a8c0e78fced (Date: 01/19/2018 21:50:15) File SHA256: c73fe003a0ef33352bc92502401e2c33feff965e539f837adada72906a235823 (Date: 12/24/2017 04:41:00) File SHA256: e699feb7022ea08758e25de6e5169e1f8eb32e9b66de0583d64cf7d04d27e36b (Date: 12/24/2017 03:46:08) Found malicious artifacts related to "52.34.90.23": ... File SHA256: f4ccef87aab74f6cf9d49614e4857d006ff3fe7ca13e2b5ce67c6c3cb7938f9c (AV positives: 21/70 scanned on 02/15/2019 05:47:57) File SHA256: 875aa3233cdac1e0ac29616015065c62eeea5b49607f36e3755ea4a5826a11b7 (AV positives: 20/70 scanned on 02/15/2019 01:58:56) File SHA256: 470d48752fb645b7f0d0bf804020e228bb715fbe0acf3a71ce8f5568cef463d5 (AV positives: 21/71 scanned on 02/15/2019 00:37:18) File SHA256: 88d401d26a93c74f53e7b19bb8717a6b0ad3a0cd6bc1a09ec8c1a30777b125f7 (AV positives: 20/71 scanned on 02/15/2019 01:47:23) File SHA256: f28ef7b2c62754047cbd805ba9d893dcab7a856c7e0e1a5b099d37998ff2b2b4 (AV positives: 21/71 scanned on 02/15/2019 05:33:28) File SHA256: a58bd7d7b582be4ab86bf51721aa2dc62a9733af6da1c719b08d669ce34f059e (Date: 11/23/2018 09:37:14) File SHA256: 1b5facd9ef6fd440ac365f3bf59373c523c809958012747cfe3f34955ef6afb4 (Date: 11/23/2018 09:34:29) File SHA256: 61315844887df806ab5060f4a4a170bdde0dcd782f52a72e1f7c9e989241d9e3 (Date: 10/31/2018 17:03:21) File SHA256: 21146077864031317be3f895b5bc263253748b1672d3ffa4f3c3f622cfb9a3fc (Date: 09/28/2018 16:29:54) File SHA256: b80dc469a685bbe27a93f19b8e4deb71933575e1cc6256a6d8c35969dbeda703 (Date: 09/28/2018 04:56:26) Found malicious artifacts related to "13.249.87.9": ... URL: https://api.al1cloud.com/9/sim/4J213OU4F0P3PZW1 (AV positives: 2/69 scanned on 03/14/2019 02:09:41) URL: http://cf-aldn.altools.co.kr/setup/ALDrive20_co.exe (AV positives: 1/69 scanned on 03/11/2019 23:24:03) URL: http://aldn.altools.co.kr/altools/alupdate/20090714/AZMain.dll (AV positives: 4/69 scanned on 03/10/2019 08:41:19) URL: http://aldn.altools.co.kr/setup/ALZip97_go_update.exe (AV positives: 4/69 scanned on 03/10/2019 00:24:03) URL: http://www.oono-clinic-ladies.com/ (AV positives: 4/69 scanned on 03/09/2019 17:30:07) File SHA256: bd47931ece3aa1295fc9f4c0c72ddab2b42215e9773bba4398cffa5685bbf030 (AV positives: 21/68 scanned on 02/23/2019 05:54:37) File SHA256: 962e71852d823c3d28eb3fd3c2dddba1ed660e8eb35caa610e395bd4bf11bb39 (AV positives: 10/69 scanned on 02/21/2019 15:56:46) File SHA256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 (AV positives: 1/52 scanned on 02/15/2019 14:28:15) File SHA256: 607b7d6fc6aeda981632abf6591dfa395554afab9da095475d24ab14d307caeb (AV positives: 10/65 scanned on 02/12/2019 09:28:26) File SHA256: 6735e91191c46660b8567eece84ee322486dc3318120875590eb2b0f9893afb6 (AV positives: 3/69 scanned on 02/10/2019 13:47:50)2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790342565070,"unified_at":"2026-09-25T13:22:45.070Z","metadata":{"hashes":{"sha256":"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be","sha1":"671b364f75f56cfe02f5e300e9430a23cfdfcd4e","md5":"7c9c61c4ddf342f39e1c38560599a9ff","sha512":"80ee08cb296fdd08083a258b91781e243d990dbdd9f577e4355c4cda6ad7eb8d2c8657f577c3afd35bc11f24af292d19582f067b412ca3638435435846b4d7ec","ssdeep":"768:Zc9RkU0YZOukD0MvvEHSTM8xifbSLQ++EVdnhm2pR2xiHfa:C9CUtZOddaSM8UfbSLQka1","ssdeep_chunks":["768:Zc9RkU0","768:c9RkU0Y","768:9RkU0YZ","768:RkU0YZO","768:kU0YZOu","768:U0YZOuk","768:0YZOukD","768:YZOukD0","768:ZOukD0M","768:OukD0Mv","768:ukD0Mvv","768:kD0MvvE","768:D0MvvEH","768:0MvvEHS","768:MvvEHST","768:vvEHSTM","768:vEHSTM8","768:EHSTM8x","768:HSTM8xi","768:STM8xif","768:TM8xifb","768:M8xifbS","768:8xifbSL","768:xifbSLQ","768:ifbSLQ+","768:fbSLQ++","768:bSLQ++E","768:SLQ++EV","768:LQ++EVd","768:Q++EVdn","768:++EVdnh","768:+EVdnhm","768:EVdnhm2","768:Vdnhm2p","768:dnhm2pR","768:nhm2pR2","768:hm2pR2x","768:m2pR2xi","768:2pR2xiH","768:pR2xiHf","768:R2xiHfa","1536:Zc9RkU0","1536:c9RkU0Y","1536:9RkU0YZ","1536:RkU0YZO","1536:kU0YZOu","1536:U0YZOuk","1536:0YZOukD","1536:YZOukD0","1536:ZOukD0M","1536:OukD0Mv","1536:ukD0Mvv","1536:kD0MvvE","1536:D0MvvEH","1536:0MvvEHS","1536:MvvEHST","1536:vvEHSTM","1536:vEHSTM8","1536:EHSTM8x","1536:HSTM8xi","1536:STM8xif","1536:TM8xifb","1536:M8xifbS","1536:8xifbSL","1536:xifbSLQ","1536:ifbSLQ+","1536:fbSLQ++","1536:bSLQ++E","1536:SLQ++EV","1536:LQ++EVd","1536:Q++EVdn","1536:++EVdnh","1536:+EVdnhm","1536:EVdnhm2","1536:Vdnhm2p","1536:dnhm2pR","1536:nhm2pR2","1536:hm2pR2x","1536:m2pR2xi","1536:2pR2xiH","1536:pR2xiHf","1536:R2xiHfa","768:C9CUtZO","768:9CUtZOd","768:CUtZOdd","768:UtZOdda","768:tZOddaS","768:ZOddaSM","768:OddaSM8","768:ddaSM8U","768:daSM8Uf","768:aSM8Ufb","768:SM8UfbS","768:M8UfbSL","768:8UfbSLQ","768:UfbSLQk","768:fbSLQka","768:bSLQka1"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":48640,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1552564559000,"last_seen":1677371140000,"last_multi_scan":1677371140000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ratankba","stardustchollima","targeted","gamarue"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":17,"suspicious_count":14,"malicious_count":5,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.APosT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.zfjmd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.MSIL.Androm.9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.SW.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.MSIL.Androm.9 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDownloader.NukeSped.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 00545cf71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSIL.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.APosT.fmyaub","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.B2C449BB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.B2C449BB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PSWStealer.BIZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.APosT.Win32.402","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL.Androm.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be.exe\" at 00016786-00002084-0000010C-6072879842","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"detectportal.firefox.com\"\n \"ocsp.pki.goog\"\n \"a1089.dscd.akamai.net\"\n \"cs9.wac.phicdn.net\"\n \"d1zkz3k4cclnv6.cloudfront.net\"\n \"dcky6u1m8u6el.cloudfront.net\"\n \"dreamlabs.net\"\n \"safebrowsing.googleapis.com\"\n \"shavar.prod.mozaws.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.198.245.36:443\"\n \"23.63.253.155:80\"\n \"52.43.40.243:443\"\n \"13.249.87.86:443\"\n \"172.217.9.42:443\"\n \"172.217.9.67:80\"\n \"52.34.90.23:443\"\n \"13.249.87.9:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\default_im.jpg\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /success.txt HTTP/1.1\nHost: detectportal.firefox.com\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6CA20000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 647C0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"default_im.jpg\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=5] baseline precision 8 225x225 frames 3\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"detectportal.firefox.com\"\n Heuristic match: \"a1089.dscd.akamai.net\"\n Heuristic match: \"cs9.wac.phicdn.net\"\n Heuristic match: \"d1zkz3k4cclnv6.cloudfront.net\"\n Heuristic match: \"dcky6u1m8u6el.cloudfront.net\"\n Heuristic match: \"dreamlabs.net\"\n Heuristic match: \"safebrowsing.googleapis.com\"\n Heuristic match: \"shavar.prod.mozaws.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00016786-00002084-00000105-10435108894","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://detectportal.firefox.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\".exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /GTSGIAG3 HTTP/1.1\nHost: ocsp.pki.goog\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Length: 83\nContent-Type: application/ocsp-request\nConnection: keep-alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$28","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 66.198.245.36 on port 443 is sent without HTTP header\n TCP traffic to 23.63.253.155 on port 80 is sent without HTTP header\n TCP traffic to 52.43.40.243 on port 443 is sent without HTTP header\n TCP traffic to 13.249.87.86 on port 443 is sent without HTTP header\n TCP traffic to 172.217.9.42 on port 443 is sent without HTTP header\n TCP traffic to 172.217.9.67 on port 80 is sent without HTTP header\n TCP traffic to 52.34.90.23 on port 443 is sent without HTTP header\n TCP traffic to 13.249.87.9 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/37 Antivirus vendors marked sample as malicious (27% detection rate)\n 46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 9 domains and 9 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":9,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["ratankba","stardustchollima","targeted","gamarue"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5c8a414a0388381b3f329926","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.MSIL.Androm","contacted_countries":["USA"],"submit_name":"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be","analysis_start_time":"2019-03-14T11:47:00+00:00","indicators_count":{"informative":17,"suspicious":15,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.198.245.36","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"23.63.253.155","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"52.43.40.243","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"13.249.87.86","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"172.217.9.42","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"172.217.9.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"52.34.90.23","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"address":"13.249.87.9","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"dns_resolutions":[{"domain":"a1089.dscd.akamai.net","address":"23.73.181.51","ttl":19,"country":"United States","registrar_organization":"Akamai Technologies, inc.","registrar_name_servers":"NS1-1.AKAMAITECH.NET","registrar_creation_date":"1999-03-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"cs9.wac.phicdn.net","address":"72.21.91.29","ttl":1246,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Verizon Trademark Services LLC","registrar_creation_date":"2014-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"d1zkz3k4cclnv6.cloudfront.net","address":"13.32.174.76","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_creation_date":"2008-04-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"dcky6u1m8u6el.cloudfront.net","address":"13.32.174.254","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_creation_date":"2008-04-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"detectportal.firefox.com","address":"23.63.253.155","ttl":8,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Mozilla Corporation","registrar_creation_date":"1998-10-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"dreamlabs.net","address":"66.198.245.36","ttl":14399,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS6619824535.A2DNS.COM","registrar_creation_date":"2014-07-20T18:42:34+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"ocsp.pki.goog","address":"172.217.9.67","ttl":6,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"safebrowsing.googleapis.com","address":"172.217.1.138","ttl":206,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"domain":"shavar.prod.mozaws.net","address":"34.211.202.13","ttl":51,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Mozilla","registrar_name_servers":"NS-1084.AWSDNS-07.ORG","registrar_creation_date":"2013-06-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"http_requests":[{"host":"detectportal.firefox.com","host_ip":"23.63.253.155:80","url":"/success.txt","method":"GET","header":"GET /success.txt HTTP/1.1\nHost: detectportal.firefox.com\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.9.67:80","url":"/GTSGIAG3","method":"POST","header":"POST /GTSGIAG3 HTTP/1.1\nHost: ocsp.pki.goog\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Length: 83\nContent-Type: application/ocsp-request\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}],"processes":[{"pid":2084,"ppid":0,"name":"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be.exe","command_line":"","sha256":"7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be","normalized_path":"C:\\7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be.exe","uid":"00016786-00002084","icon":"$2d"}],"all_imported_dlls":["profapi.dll","gdi32.dll","rtutils.dll","winnsi.dll","dhcpcsvc.dll","ws2_32.dll","uxtheme.dll","mscoree.dll","mscoreei.dll","usp10.dll","version.dll","mscorlib.ni.dll","ncrypt.dll","rpcrt4.dll","api-ms-win-core-xstate-l2-1-0.dll","credssp.dll","imm32.dll","System.Xml.ni.dll","WindowsCodecs.dll","IPHLPAPI.DLL","cfgmgr32.dll","wship6.dll","ole32.dll","msvcrt.dll","GdiPlus.dll","msctf.dll","mscorrc.dll","rasadhlp.dll","bcrypt.dll","userenv.dll","WSHTCPIP.DLL","nsi.dll","secur32.dll","bcryptprimitives.dll","shell32.dll","dwmapi.dll","cryptbase.dll","nlssorting.dll","FWPUCLNT.DLL","ntdll.dll","KernelBase.dll","clrjit.dll","riched20.dll","rasapi32.dll","rasman.dll","clbcatq.dll","webio.dll","kernel32.dll","user32.dll","clr.dll","System.Core.ni.dll","System.Configuration.ni.dll","tzres.dll","mswsock.dll","sspicli.dll","lpk.dll","System.Windows.Forms.dll","comctl32.dll","winhttp.dll","dnsapi.dll","gpapi.dll","msvcr100.dll","oleaut32.dll","System.ni.dll","sechost.dll","shlwapi.dll","msasn1.dll","cryptsp.dll","rsaenh.dll","RpcRtRemote.dll","advapi32.dll","schannel.dll","crypt32.dll","msvcr120_clr0400.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","dhcpcsvc6.dll","psapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"default_im.jpg","sha256":"e4c2705210eb106a350a14397132b2e78618f582c01a01878dd8bd09795c21f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"C:\\7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be.exe.config","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"C:\\7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be.exe","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb36278a0a934ae244f843b62229421c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\3c20a6b0ca532bcc6271bf4b7ad0b4d9\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\ce9750286ad44cbfb2acf176df9df0a2\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7aa0dcace3b5d10b626540709537d280\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\bf505bb2c2b60e7a40740888cd2c3172\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%TEMP%\\default_im.jpg","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5c8a414a0388381b3f329926"}]}]}},"report_ids":{"sandbox_job_ids":["5c8a414a0388381b3f329926"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSIL.Androm.Generic Sample 7646c2afbc8b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7646c2afbc8b…. Malware family: MSIL.Androm.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL.Androm.Generic Sample 7646c2afbc8b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7646c2afbc8b…. Malware family: MSIL.Androm.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL.Androm.Generic Sample 7646c2afbc8b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7646c2afbc8b…. Malware family: MSIL.Androm.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]