24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T480,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 77eb7b7e4593… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 77eb7b7e4593…. Malware family: Trojan.Agent. Threat score 100/100. 21/26 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39"],"about":{"@type":"SoftwareApplication","name":"lhf3f334f.exe","applicationCategory":["peexe","executable"],"identifier":"77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T491,"" loaded module "NORMALIZ.DLL" at base 76190000 "" loaded module "CRYPT32.DLL" at base 75BE0000 "" loaded module "USERENV.DLL" at base 75140000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77B10000 "" loaded module "WINTRUST.DLL" at base 75D00000 "" loaded module "WININET.DLL" at base 76090000 "" loaded module "RASAPI32.DLL" at base 73400000 "" loaded module "RTUTILS.DLL" at base 73FA0000 "" loaded module "RASMAN.DLL" at base 733E0000 "" loaded module "PROFAPI.DLL" at base 75AE0000 "" loaded module "SHLWAPI.DLL" at base 75E10000 "" loaded module "SENSAPI.DLL" at base 6BB10000 "" loaded module "RPCRT4.DLL" at base 77120000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77B10000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77B10000 "" loaded module "CRYPTBASE.DLL" at base 75A30000 "" loaded module "C:\WINDOWS\SYSTEM32\NLAAPI.DLL" at base 7415000026:T5b8,"Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Cab165C.tmp" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Tar165D.tmp" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Cab172A.tmp" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Tar172B.tmp" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Cab2DC1.tmp" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Tar2DC2.tmp" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\95_154_203_249[1].txt" for deletion "Z:\77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\95_154_203_249[1].txt" for deletion27:Tb65,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")28:T8f9,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")29:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790346107043,"unified_at":"2026-09-25T14:21:47.043Z","metadata":{"hashes":{"sha256":"77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39","sha1":"8c8dc934933a490a834fec897c6c2c8cb219ab5e","md5":"289af95f99f58c751a7d1d0a26d7cdb3","sha512":"a88265667efa3ed36b1852a9ad71b3044facdca462fb42fc1b8af9894e40cc9ca13b57e268c11566180fbfadf28f7f4338bda1c4fe661e577795a76d208c6229","ssdeep":"1536:GgiYRuY+RwJ4zZIJcFfg+SalC/wAsM6XWv4on8fAYPt:viYEdRyyTg71sM6X4WHF","ssdeep_chunks":["1536:GgiYRuY","1536:giYRuY+","1536:iYRuY+R","1536:YRuY+Rw","1536:RuY+RwJ","1536:uY+RwJ4","1536:Y+RwJ4z","1536:+RwJ4zZ","1536:RwJ4zZI","1536:wJ4zZIJ","1536:J4zZIJc","1536:4zZIJcF","1536:zZIJcFf","1536:ZIJcFfg","1536:IJcFfg+","1536:JcFfg+S","1536:cFfg+Sa","1536:Ffg+Sal","1536:fg+SalC","1536:g+SalC/","1536:+SalC/w","1536:SalC/wA","1536:alC/wAs","1536:lC/wAsM","1536:C/wAsM6","1536:/wAsM6X","1536:wAsM6XW","1536:AsM6XWv","1536:sM6XWv4","1536:M6XWv4o","1536:6XWv4on","1536:XWv4on8","1536:Wv4on8f","1536:v4on8fA","1536:4on8fAY","1536:on8fAYP","1536:n8fAYPt","3072:GgiYRuY","3072:giYRuY+","3072:iYRuY+R","3072:YRuY+Rw","3072:RuY+RwJ","3072:uY+RwJ4","3072:Y+RwJ4z","3072:+RwJ4zZ","3072:RwJ4zZI","3072:wJ4zZIJ","3072:J4zZIJc","3072:4zZIJcF","3072:zZIJcFf","3072:ZIJcFfg","3072:IJcFfg+","3072:JcFfg+S","3072:cFfg+Sa","3072:Ffg+Sal","3072:fg+SalC","3072:g+SalC/","3072:+SalC/w","3072:SalC/wA","3072:alC/wAs","3072:lC/wAsM","3072:C/wAsM6","3072:/wAsM6X","3072:wAsM6XW","3072:AsM6XWv","3072:sM6XWv4","3072:M6XWv4o","3072:6XWv4on","3072:XWv4on8","3072:Wv4on8f","3072:v4on8fA","3072:4on8fAY","3072:on8fAYP","3072:n8fAYPt","1536:viYEdRy","1536:iYEdRyy","1536:YEdRyyT","1536:EdRyyTg","1536:dRyyTg7","1536:RyyTg71","1536:yyTg71s","1536:yTg71sM","1536:Tg71sM6","1536:g71sM6X","1536:71sM6X4","1536:1sM6X4W","1536:sM6X4WH","1536:M6X4WHF"],"imphash":"0044ef5439650f0ab76aac26842f44dc"},"file_info":{"file_name":"lhf3f334f.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":146432,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297148000,"last_seen":1713428243000,"last_multi_scan":1713428243000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":16,"malicious_count":9,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.317355","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BOCV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.5EF69B88","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BOCV (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.Y trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d6a811 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.mD89","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.dysfss","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-JH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Dridex.TYBP-3422","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zyx.AQC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.BrowseFox.Win32.274139","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"95.154.203.249:4438\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab165C.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar165D.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab172A.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar172B.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab2DC1.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar2DC2.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\4f32be1625273fe2aaa0c8d9d46d6331\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$25","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlComputeCrc32@ntdll.dll\"\n \"InternetConnectW@wininet.dll\"\n \"IdnToAscii@Normaliz.dll\"\n \"HttpOpenRequestW@wininet.dll\"\n \"CertOpenStore@CRYPT32.dll\"\n \"GetUserProfileDirectoryW@USERENV.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"WinVerifyTrust@wintrust.dll\"\n \"WTHelperProvDataFromStateData@wintrust.dll\"\n \"WTHelperGetProvSignerFromChain@wintrust.dll\"\n \"CertSelectCertificateChains@CRYPT32.dll\"\n \"CertFreeCertificateChainList@CRYPT32.dll\"\n \"InternetQueryOptionW@wininet.dll\"\n \"InternetSetOptionW@wininet.dll\"\n \"HttpSendRequestW@wininet.dll\"\n \"RasEnumEntriesW@RASAPI32.dll\"\n \"RasConnectionNotificationW@RASAPI32.dll\"\n \"TraceRegisterExA@rtutils.dll\"\n \"TracePrintfExA@rtutils.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00130921-00003812-779F228D-136245\n LookupAccountNameLocalW@SECHOST.DLL at 00130921-00003812-779F228D-147868","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab165C.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar165D.tmp\" has type \"data\"\n \"Cab172A.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar172B.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab2DC1.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar2DC2.tmp\" has type \"data\"\n \"95_154_203_249[1].txt\" has type \"data\"\n \"182_93_220_146[1].txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00130921-00003812-779F228D-135926","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\en-US\\WINHTTP.dll.mui\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\95_154_203_249[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\95_154_203_249[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\182_93_220_146[1].txt\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00130921-00003812-779F228D-135805","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$26","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab165C.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar165D.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab172A.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar172B.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab2DC1.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar2DC2.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\95_154_203_249[1].txt\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\95_154_203_249[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 163263 does not match actual CRC 191005","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetFileSize\n GetProcAddress\n LoadLibraryExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Wed Sep 25 09:38:58 1991","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLEFILETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLECONSOLETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"FILETRACINGMASK\", Value: \"0000FFFF\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"CONSOLETRACINGMASK\", Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/53 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 95.154.203.249 on port 4438","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$28","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00130921-00003812-779F228D-138506","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":".text0","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"92e6447779a84977be724977d62d49771de2447705a24977bee34477616f4977684147770050477700000000ad3723768b2d2376b641237600000000\" to virtual address \"0x74951000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"4053477758584877186a4877653c49770000000000bf04760000000056cc0476000000007cca047600000000376861756a2c4977d62d497700000000206961750000000029a6047600000000a48d617500000000f70e047600000000\" to virtual address \"0x76501000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7739457779a84977be724977d62d49771de2447705a24977c868487757d14f77bee34477616f4977684147770050477700000000ad3723768b2d2376b641237600000000\" to virtual address \"0x74FC1000\" (part of module \"WSHIP6.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00016558-00001560)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects itself into other processes","description":"Injected into \"Explorer.EXE\" at 2015-11-12.02:02:35.545 (UID: 00016558-00001560)\n Injected into \"taskhost.exe\" at 2015-11-12.02:04:05.482 (UID: 00022313-00001396)\n Injected into \"taskhost.exe\" at 2015-11-12.02:04:35.763 (UID: 00024231-00003060)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":111,"dropped_files_count":0,"extracted_files_count":24,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"564477520e316d4447e6578b","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:DangerousObject.Multi","contacted_countries":["GBR"],"submit_name":"lhf3f334f.exe","analysis_start_time":"2015-11-12T05:26:28+00:00","indicators_count":{"informative":7,"suspicious":21,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"564467310e316dbb6460dcac","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":75,"malware_family":"QVM19.1.Malware","contacted_countries":["GBR","THA"],"submit_name":"lhf3f334f.exe","analysis_start_time":"2015-11-12T04:17:38+00:00","indicators_count":{"informative":7,"suspicious":20,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"564462620e316d1e652a7fe3","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":65,"malware_family":"QVM19.1.Malware","contacted_countries":["GBR"],"submit_name":"lhf3f334f.exe","analysis_start_time":"2015-11-12T03:59:09+00:00","indicators_count":{"informative":2,"suspicious":5,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.154.203.249","port":4438,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"address":"182.93.220.146","port":4438,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]}],"dns_resolutions":null,"http_requests":[{"host":"","host_ip":"192.168.56.10:49161","url":"","method":"","response_code":"304","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}],"processes":[{"pid":2292,"ppid":0,"name":"77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39.exe","command_line":"","normalized_path":"","uid":"00012313-00002292","icon":"$29"},{"pid":1560,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00016558-00001560"},{"pid":1396,"ppid":0,"name":"taskhost.exe","command_line":"","normalized_path":"","uid":"00022313-00001396"},{"pid":3060,"ppid":0,"name":"taskhost.exe","command_line":"","normalized_path":"","uid":"00024231-00003060"}],"all_imported_dlls":["schannel.DLL","bcryptprimitives.dll","profapi.dll","kernel32.dll","ole32.dll","WINHTTP.dll","ws2_32.DLL","SspiCli.dll","pnrpnsp.dll","wshtcpip.DLL","GDI32.dll","comctl32.dll","rsaenh.dll","NLAapi.dll","credssp.dll","SETUPAPI.dll","Cabinet.dll","ncrypt.dll","msvcrt.dll","VERSION.dll","ntmarta.dll","CRYPTBASE.dll","ADVAPI32.dll","NSI.dll","PSAPI.DLL","CRYPT32.dll","rasadhlp.dll","wshqos.dll","winrnr.dll","CRYPTSP.dll","wship6.dll","KERNELBASE.dll","GPAPI.dll","DEVRTL.dll","cryptnet.dll","iphlpapi.DLL","rasman.dll","urlmon.dll","wintrust.dll","USERENV.dll","sensapi.dll","ntdll.dll","Normaliz.dll","rtutils.dll","napinsp.dll","USER32.dll","OLEAUT32.dll","SHLWAPI.dll","dnsapi.DLL","MSCTF.dll","USP10.dll","shell32.dll","wininet.dll","mswsock.dll","fwpuclnt.dll","RPCRT4.dll","secur32.dll","dhcpcsvc6.DLL","dhcpcsvc.DLL","DEVOBJ.dll","IMM32.DLL","CFGMGR32.dll","sechost.dll","LPK.dll","RASAPI32.dll","devobj.dll","iertutil.dll","NapiNSP.dll","normaliz.dll","FWPUCLNT.DLL","KernelBase.dll","ws2_32.dll","dnsapi.dll","dhcpcsvc6.dll","nlaapi.dll","sspicli.dll","winnsi.dll","rasapi32.dll","bcrypt.dll","WinSCard.dll","user32.dll","imm32.dll","nsi.dll","cfgmgr32.dll","cryptsp.dll","msctf.dll","advapi32.dll","cryptbase.dll","setupapi.dll","psapi.dll","usp10.dll","oleaut32.dll","crypt32.dll","shlwapi.dll","lpk.dll","rpcrt4.dll","Wldap32.dll","schannel.dll","SensApi.dll","WSHTCPIP.DLL","msasn1.dll","gpapi.dll","cabinet.dll","devrtl.dll","gdi32.dll","IPHLPAPI.DLL","webio.dll","dhcpcsvc.dll","userenv.dll","winhttp.dll","wshtcpip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"94308059B57B3142E455B38A6EB92015","sha256":"8db586bc68b4d2e9e807d8582b3b6bb6cdb5650500d8c7f193d2bc4059696dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"182_93_220_146[1].txt","sha256":"69155a1bf9132115db3465c1a38d57775617498e91efa98dde67f8c8728ed4c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"95_154_203_249[1].txt","sha256":"63ad92314f14c3abcbfd9ba8b539b97a96d3da0dd711434e61c033f298e24462","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Cab165C.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Cab172A.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Cab2DC1.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Tar165D.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Tar172B.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Tar2DC2.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Tar10DA.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"Tar11C7.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"Tar27E1.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"Cab10D9.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"Cab11C6.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"Cab27D0.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"1b1d80862e06e39fc68241013f2e949e0613473d380c3713e647c38f701f0679","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"name":"CabA425.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"CabA4E3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"CabBB1C.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"TarA426.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"TarA4E4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"TarBB1D.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"SCHEDLGU.TXT","sha256":"0ef40f710c3e988a92f6f1ffce7ba4d292cb951c0f3bc7ba071f1ecfeb077307","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\182_93_220_146[1].txt","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"path":"%TEMP%\\Cab10D9.tmp","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%TEMP%\\Cab11C6.tmp","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%TEMP%\\Cab27D0.tmp","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\95_154_203_249[1].txt","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"564462620e316d1e652a7fe3"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\YB8HQDNM\\95_154_203_249[1].txt","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\STFGKOG5\\95_154_203_249[1].txt","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"},{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]},{"name":"Global\\4f32be1625273fe2aaa0c8d9d46d6331","sources":[{"report_type":"sandbox","report_id":"564467310e316dbb6460dcac"}]},{"name":"Global\\ac847a5025cd65a0aeea15b216a754fb","sources":[{"report_type":"sandbox","report_id":"564477520e316d4447e6578b"}]}]}},"report_ids":{"sandbox_job_ids":["564477520e316d4447e6578b","564467310e316dbb6460dcac","564462620e316d1e652a7fe3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 77eb7b7e4593… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 77eb7b7e4593…. Malware family: Trojan.Agent. Threat score 100/100. 21/26 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 77eb7b7e4593… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 77eb7b7e4593…. Malware family: Trojan.Agent. Threat score 100/100. 21/26 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 77eb7b7e4593… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 77eb7b7e4593…. Malware family: Trojan.Agent. Threat score 100/100. 21/26 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]