24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Backdoor.MSIL.Agent Sample 7791dee10a67… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7791dee10a67…. Malware family: Backdoor.MSIL.Agent. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d","keywords":["Malicious","Backdoor.MSIL.Agent","malware analysis","sandbox report","threat intelligence","7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d"],"about":{"@type":"SoftwareApplication","name":"7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Backdoor.MSIL.Agent","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T411,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004176.00000000.116590.1DB70000.00000004.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004176.00000000.116590.1DB70000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004176.00000000.116590.1DB70000.00000004.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004176.00000000.116590.1DB70000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004176.00000000.116590.1DB70000.00000004.mdmp, 00000000-00004176.00000001.118512.1DAF0000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004176.00000001.118512.1DAF0000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004176.00000001.118512.1DAF0000.00000004.mdmp")26:T926,Found reference to "DESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin") Found reference to "DESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004176.00000001.118512.005A2000.00000002.mdmp")27:T562,Found PE header "MZ" - Source: "00000000-00004176.00000000.116590.1DAD0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000000.116590.1DB30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000000.116590.1DB50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000000.116590.1DB70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000001.118512.02DF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000001.118512.04B00000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000001.118512.1DAC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000001.118512.1DAF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000001.118512.1DB20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000002.120432.03170000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000002.120432.1DAE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000003.125944.02E00000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000003.125944.1DB40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000003.125944.1DB60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000003.125944.1EBA0000.00000004.mdmp")28:T422,"" in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "e\Software\Classh" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0x" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "SystemDrive=C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WIND\Registry\Machine\Software\Classes\WO" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "achine\Software\Classes\WOW6" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "1-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp36:T42b,Process " in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "PSModulePath=C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\;C:\Program Fi\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000^" in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "istry\Machine\Software\Classes\WOW6" in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6H" in Source: 00000000-00004176.00000002.120432.1DBB0000.00000004.mdmp "e\Software\Classh" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "y\Machine\Software\C" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000002.120432.1F5F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004176.00000003.125944.02BB0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004176.00000003.125944.02BB0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0x" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "SystemDrive=C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "PSModulePath=C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\;C:\Program Fi\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000^" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "istry\Machine\Software\Classes\WOW6" in Source: 00000000-00004176.00000003.125944.1DBB0000.00000004.mdmp "e\Software\Classh" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WIND\Registry\Machine\Software\Classes\WO" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "SystemDrive=C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "achine\Software\Classes\WOW6" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp "1-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-" in Source: 00000000-00004176.00000003.125944.1F5F0000.00000004.mdmp39:T1663,")\n YARA signature \"NanoCore\" classified file \"sample.bin\" as \"rat,nanocore\" (Author: Kevin Breen )\n YARA signature \"Nanocore_RAT_Gen_2\" classified file \"sample.bin\" as \"rat,nanocore\" (Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, Author: Florian Roth)\n YARA signature \"MALWARE_Win_NanoCore\" matched process \"00000000-00004176\" as \"Detects NanoCore\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_NanoCore\" matched file \"sample.bin\" as \"Detects NanoCore\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – NanoCore","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5009","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["rat","nanocore","evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69d7a54109f5ff52400ea239","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Backdoor.MSIL.Agent","contacted_countries":["USA"],"submit_name":"7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin","analysis_start_time":"2026-04-09T13:10:26+00:00","indicators_count":{"informative":166,"suspicious":27,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"50.39.155.159","port":54984,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}],"dns_resolutions":[{"domain":"served.wicorn29.net","address":"50.39.155.159","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}],"processes":[{"pid":4176,"ppid":0,"name":"7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin.exe","command_line":"","sha256":"7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d","normalized_path":"C:\\7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d.bin.exe","uid":"00000000-00004176","icon":"$49"},{"pid":5076,"ppid":4176,"name":"schtasks.exe","command_line":"/create /f /tn \"SCSI Service\" /xml \"%TEMP%\\tmpC446.tmp\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00004176","uid":"00000000-00005076"}],"all_imported_dlls":["sechost.dll","cryptsp.dll","profapi.dll","bcrypt.dll","ntdll.dll","msvcr80.dll","cfgmgr32.dll","mscorjit.dll","System.Management.ni.dll","wbemcomn.dll","ucrtbase.dll","mscorwks.dll","mscorlib.ni.dll","nsi.dll","ws2_32.dll","combase.dll","version.dll","rsaenh.dll","gdi32full.dll","msvcrt.dll","dwmapi.dll","Culture.dll","mscoree.dll","kernel32.dll","rpcrt4.dll","fltLib.dll","gdi32.dll","System.Windows.Forms.ni.dll","diasymreader.dll","sspicli.dll","KernelBase.dll","advapi32.dll","shell32.dll","System.ni.dll","GdiPlus.dll","cryptbase.dll","mswsock.dll","System.Configuration.ni.dll","uxtheme.dll","System.Xml.ni.dll","dnsapi.dll","ntmarta.dll","shlwapi.dll","windows.storage.dll","shfolder.dll","wmiutils.dll","wbemsvc.dll","taskschd.dll","user32.dll","ole32.dll","imm32.dll","powrprof.dll","IPHLPAPI.DLL","fastprox.dll","kernel.appcore.dll","wbemprox.dll","win32u.dll","bcryptprimitives.dll","oleaut32.dll","psapi.dll","VxSSL64.dll","SHCore.dll","System.Drawing.ni.dll","msctf.dll","clbcatq.dll","apphelp.dll","msvcp_win.dll","mscoreei.dll","Microsoft.VisualBasic.ni.dll","WMINet_Utils.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"settings.bin","sha256":"73b0b92179c61c26589b47e9732ce418b07edee3860ee5a2a5fb06f3b8aa9b26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"tmpC446.tmp","sha256":"720c1947d236c446ed7e2fe218477cad368f65faf4e78705fdc9c4ee9f3b4bbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"catalog.dat","sha256":"5347661365e7ad2c1acc27ab0d150ffa097d9246bb3626fca06989e976e8dd29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"run.dat","sha256":"f919080e28e8ee8fe8bd735272cefd051d8740b63d5113a97f225497f971ac0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"settings.bak","sha256":"39a25f1ab5099005a74cf04f3c61c3253cd9bda73b85228b58b45aaa4e838641","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"task.dat","sha256":"a07029c5124c9961167e3f6c520120574e3a7b5821be87ae447477d740f51b8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\run.dat","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%TEMP%\\tmpC446.tmp","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\task.dat","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\catalog.dat","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\settings.bin","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\settings.bak","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4176:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"\\BaseNamedObjects\\{8922f814-76d6-47c3-891b-c463cf4ef25b}","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"\\BaseNamedObjects\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"SM0:4176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"Local\\SM0:4176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]},{"name":"SM0:4176:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69d7a54109f5ff52400ea239"}]}]}},"report_ids":{"sandbox_job_ids":["69d7a54109f5ff52400ea239"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Backdoor.MSIL.Agent Sample 7791dee10a67… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7791dee10a67…. Malware family: Backdoor.MSIL.Agent. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d"}],["$","meta","4",{"property":"og:title","content":"Malicious Backdoor.MSIL.Agent Sample 7791dee10a67… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7791dee10a67…. Malware family: Backdoor.MSIL.Agent. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Backdoor.MSIL.Agent Sample 7791dee10a67… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7791dee10a67…. Malware family: Backdoor.MSIL.Agent. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]