23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TSPY_FA.F4A51C67 Sample 77ebbad7ff79… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 77ebbad7ff79…. Malware family: TSPY_FA.F4A51C67. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b","keywords":["Malicious","TSPY_FA.F4A51C67","malware analysis","sandbox report","threat intelligence","77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b"],"about":{"@type":"SoftwareApplication","name":"ORDER LIST.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TSPY_FA.F4A51C67","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T64d,"" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" created file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" created file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index145.dat" "" created file "%WINDIR%\system32\l_intl.nls" "" created file "%WINDIR%\assembly\pubpol15.dat" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" "" created file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp"25:T6c0,"" wrote bytes "00000000" to virtual address "0x007C66B4" "" wrote bytes "00000000" to virtual address "0x007C6708" "" wrote bytes "00000000" to virtual address "0x007C66F4" "" wrote bytes "00000000" to virtual address "0x007C667C" "" wrote bytes "00000000" to virtual address "0x007C66D4" "" wrote bytes "00000000" to virtual address "0x007C6704" "" wrote bytes "00000000" to virtual address "0x007C66F8" "" wrote bytes "00000000" to virtual address "0x007C66D8" "" wrote bytes "00000000" to virtual address "0x007C66B8" "" wrote bytes "9435bdab" to virtual address "0x6A051FDC" (part of module "MSCORWKS.DLL") "" wrote bytes "0000000000000000" to virtual address "0x007B0178" "" wrote bytes "0000000000000000" to virtual address "0x007B01F0" "" wrote bytes "0000000000000000" to virtual address "0x007B01C8" "" wrote bytes "00000000000000000000000000000000030000005e000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x007BFC00" "" wrote bytes "00000000" to virtual address "0x007C66E4" "" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x007C666E" "" wrote bytes "db4de07200000000" to virtual address "0x00AA2000" (part of module "ORDER_LIST.EXE") "" wrote bytes "00000000" to virtual address "0x007C66E8" "" wrote bytes "0000000000000000" to virtual address "0x007B01A0" "" wrote bytes "4e74436f6e74696e756500" to virtual address "0x007C6662"26:T113c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAyASURBVFhHPZdZbNzXdcb5VPSlr30KmgJFi7Zw4fQhQIrUXYI2rY14TRzbcWI7TRwldmVbjhI7gmXFkiIqkmiJpLiIEkmRosR9H3LI4ZCzc1+HOynuOykOZzj7+us3NNCHgzvL/3/Pd8/5znfOzcis8nLzoY/8R37ym4Jkd4Qod4aoGwtjWk7StwWzT2DDAwdaD7chpNWrtdkeoKI7yENTmOq2KI86UjywQ8kA3B2FvBHI1ucbTrjeEyerI0pufYS7NWFK6v3cMxyTkVPpI68ySE5TlJyeGEUDcQrGEtybh8pNeO5CIb940ElrTQ+n77bT4NrG9H4uS1lt3DhTw88/quP+f2by7l+8za/+/h3O9/r47Lun+Va2keumx3z7jcvkTELWIPzRkeSWfBQYopQ3hKloDZDxoMpPoZx/aUlwvRcK3FC4CsU7ULEn243zcD9Gy7FOth/HcAgm/T+1Ae2uBDXWONVjOq0Al+id65sJcrdT5G6lyFyKcH01SZGezZ+Fm8MyR+LkoGUtUaqbQ2RUNQa5Z4qTLee5Ctudx3BfG1VvpGhYT9C0F6XRG6HOrxfCSRQ9Wv1gPoC2ZWhagQdKxz2lqEi/l3jjlD+JC3ySSu1Rswbl6f+VyrwZyFEkbjni3O2MUdMSJqPCEOF+X/IkZ/cXvtqsSaE3bKao84SpCnp4Lj+Tf/j0FPXxPeqTXhqI0xKDFjlsDMiBPpfHQpRF9ykLb1Ia2qI4vM8DX4DK9Sjf/Pll/u3zfIoVuQJFK7s3xR17nJq2uAAYE5SPpKhSiGrlvE0Es2o1HMepTXroiO+T4+rG4llhILaOgyUsrGPGSxcRTARpY4dOlrHFlnCEV7EGd2kL7VMZ31bEApwuacOkAz1SSkvlp2Rc1p+g1pQgo7o7SYNI0qJwNst5zeQmxnUPdYFdupMHzIZDbMvxYWqc/ZgLD8NyNcEoC/SyQT8rTDPFHiMc4WLd14l5ohrjzAjOkJ/q5C4GbwybDmUUfwzpCIsvVaMJup1JMvqFxi7nrcpVu/I4rIeckZROdsB0JEhJUxEh+kimeomFVVfBXpIRq4A4FYtRthkkppgQspI87iUa6SWSsnCQGGT62MupqiKatM/YEbhE5FZFwSjeGOeSmJ0xMgbF+jER5MXLZbQIgEsPtAciGBO7zPp8PEkMEYgM4d1cITo+R2JggtT4AImNblL+DlJe2ZyN2t+eI+5049cznv0F/DEbi/4FrP5jGhOH9AlAt/Zv3pctKgqTcYwWVUH/YJxvfv8s3/viPm1CeCq/gfrjkMi1z+jhLjsRG6vry+xb5/F1zmK/Y2SuoY+I3U2s307Y7uL1v3qGog9zOHRtkvnyR+yNrrN7OMda0M3okR9r2Mv4QQLz6hNOPzTTPe+nYyr+VQSGBiQMDWO8dr2WywOz3B1Z5z+u3aQuuKd0rLFxbGd+bI291lkmh44ZXogzvhhjetTHpnWdNesWublGzl58SE5JN8M9S1z95UXWN3c4COyxHYixEgizfBBl3RNj9yiBL5DkOJjE4xMJHdYQNneSDnGgWfm3KFTGQJSa0DbvZ31G1p33GGwfZMO4hmU6ReccdMymME4l6HHHsM8mcYlDA2sp5pW+tZ0EnlUfh55jrtzM4su7DzCNTDO97mdyM8jcVpDZdR/uZS/zK14y7N1+HENROiRA9ar/eglMq5SvOrTJkG+Jw6CFnSE3m+Y1hS2BQWKStuapJC0zCbpEJsvjJIMCsLgLS1sxDlaOOHxyxIFIuOYLMn8YYnw7zMRhgpHtOM6lOI7RCD0OPxlWqxenI0L3lFRrIcy3LxXQrnKskwCZAisUVH5CRcGXXPrheV7+n+u0ynmTnq0eT9EiIplmZNNRLHNReqZD/PidS6z3LbOxOcPE7jKvX73C54/aePY3WXzvXB7NszqEnLdbgjSbfWQYuw6wmUSUwQhvKo+3xna44pjkX39zTiDWGPQOs7NrY9c8zqjr8OTEndM6weM4HXJsUBpaJiIYJmO8c6GKxvJBin9/hdOfvSpdmaPs4JCKtSQl6xIfiVCFGl2NJUxtm4/ydqXA4niCw/IEpy2AaTROo/JZl9Z5T5x29V1zeJ5VEXFvrJM9yxxDYz7scxEBiGJbkAKkTz4bwarVOeRj3r7I4/kBnHsT1DzZpno9RIWaUfljteoJKW6f+ooxwCODl9KOIzIMzgO6uvexmnU6gWhxq7tJsysPUpTNb1Ln28J6PMbKZgdf/PRHWEstDE74cS5EBSLG4EoM52KUgdkAUyO7LEzNMrI1S8fuGpVzm+orCYGQ8okvP/nsETUdB7R2HVHXfchDuyJQ13eIwbpPV9c+li4PT//zac6WOIQ6xTc+vMQ33j+jTrhK79EQ25sWlrvszDjWGFuIMLoSZWQtzrDa7uisj/HJHd7++LeU9w3Rvurhh+fz+NpL79Ekkhomw2rfPprbtmjvOaTJdURNvwDUSnub+57QadvHph7r6DmmTsT8ZWEPF53LlC7sUTq/QPPxqoRpmO31PraG51l2HzGt001tJZlYjTLx2MvY6gHOzSN6Vo/5oriFO44F7kgX8prc9IwGsDr9mF0ejH1emkd8NI6LhA0T+jJ6RFuvB4siYe8RJxziw4Q4oNw1SjoNnhRdfj+d/g3cRzPsbM2wN7PNwkpYdZ0QkCjj60FVxC6W1SCOJfFiTcqncuuZVaomg7iGRHQ5tgx7MYwEaBiTTWoka5zw0Tp1xKc3G/jLp16hVwjH+o+xuoIY0rWeFigJTO1mnItml4Dss+BZUjo2WFoOMb+TYlogzmWV8Xf/9bZESeK0Hqd7OSXnMbonI9hGgnT1HnLmUg3GsSCd7gA9iyEJmkayxik/je5joffTNx/AMXxMh1Jw44ZZqHUSCVSbBOp37W6aFfLaHS+Vs5NM7ewytRJkWgAm1Ovd20mGNhI4VyQ0GsMuF7VhnozSol7T2Bvm1zfNNAzqsKNeintWMEgz2mbUjFomA7QJyce3GyjUEFnWvsj96gnKyoaxSal6J5SGKfj3T+7wdpGJt7IbePpXZ6lzL+FUBOwqL6WZzIpe7pqWqB89pqh9nmLjAg87V0S0GA96o/zTG9f4xY0unv2ggGd+msmN2iFMilBGq8KRRtIxrzCtRHCprBqGQ9TYwzRawzR1R2kakPIJRLWi0aSUtCnknVsBbMtRdbYkxmmlSv83y+rcKWpHk9QOSXD6EtQPaUbsi1LaH+HegEyCd28wyoPhGBUjEQmRRKVHgtKt3NVPHFI+HiO3L84dW5yynhCF1VvcLlvlX17PomZafUKzg1Wa372pKUfvWOZitEuSa6Rw+Z27VI0keKBxq8Se4K6Gz3zTIZ/ctvLX33mPysEgj4ZCekYjuYA8kGWkiWJfFFulgJUTSbLTzgdjlA5EqZL97NNaXnjzJn+8PcLrH9zDrGnGJgCtqu3W6QgtY3HqR+InTotdmob7o5Q4Yho6Y+RZ4jxzqoTvvpvF+VIXb52vwDAucqsC0tY6lh5IlhL0y/mpG+38OLOD0uEoL/2ujFfPFdA5E8XkFouVEpfQDoiUnVLKxvQdQKNc5UiMRwMJKjVTnM138lamWbUf40e/b+G5U4XkWnUHkJWIBwMrSbqmVKruEM75CP2Ple45AbDOakbXZJKnC0aFTtyocJqXE3QoLV//zs/42rfepE89f2BC2u8KYx7SpUKcKNIlo0K3qErludwVpVYnL7TEyNfJ821f2Z/97Wv86d+8Ro4tQZ26Z7+i5piP4ViUdkjAxlaVglxL8mRGTyMv1mZpQhmk27WT2nhcuVUptY5qXhiJcuGmHZM9Sp3SVKfqaFEUmkW4YjlNhz1PAHIU9lu6B2aLQ3nW6Ml6U7+l1zc+b0TTGi5VTYM4M7CUIiP9UKE2KDgBkaBQeSyQ3VHpXKiZJ9u4SnajNGBYF1H1C7PkND3AWDUZtWqS6nIn/t9xtgBkdcW4YY5y3Rzjg9KlEztTvnLy/bJB91D5eTSc5OGgmt2AxvJ79ggFPVFu6cVrsj/oypRtimhTP8UOH9X9HjonjzBNejW6HSsVfmZnwlzOquCpZ8/w9H+f4U++/iJ//o/v8tTzl7jaGSdTe1wxyTpkXRF9jp58z+yKcjXtR2DyVSFpMBm/vmXlJ1dtvHTRzrMXHLyo9X+vdfLRVQMf32jh8wIDV0o7uVZu4nZFN+U1VloaXbS2DvNhrov3vuzl1SsufvCHXn5w2cX3ZS9ddPLCJQcvXHTwvPZ7/gtZepW9fMnOK/rvlct2vefg/wDLC12Y/SLEngAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790441962762,"unified_at":"2026-09-26T16:59:22.762Z","metadata":{"hashes":{"sha256":"77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b","sha1":"8a2832908a9036c127426b76cceb4b880c343e96","md5":"3529f9bf2b955873576bb4f28171c38f","sha512":"8cb96980af14499d898c8ff1bfd5e11c92d0520b2b57529c29487a404ce9eb17555b6fd6a1557bb9ca267cc5dc6269961192ffd36a3dbfcc9d58c7d6dfbd7ff9","ssdeep":"12288:a8Zwuv5g6hWmuE5TlUzL41CLJ6j3W+SsI7yvcTzYpuNiabhT3L+:afmf5BOsU/yUTkpUbB","ssdeep_chunks":["12288:a8Zwuv5","12288:8Zwuv5g","12288:Zwuv5g6","12288:wuv5g6h","12288:uv5g6hW","12288:v5g6hWm","12288:5g6hWmu","12288:g6hWmuE","12288:6hWmuE5","12288:hWmuE5T","12288:WmuE5Tl","12288:muE5TlU","12288:uE5TlUz","12288:E5TlUzL","12288:5TlUzL4","12288:TlUzL41","12288:lUzL41C","12288:UzL41CL","12288:zL41CLJ","12288:L41CLJ6","12288:41CLJ6j","12288:1CLJ6j3","12288:CLJ6j3W","12288:LJ6j3W+","12288:J6j3W+S","12288:6j3W+Ss","12288:j3W+SsI","12288:3W+SsI7","12288:W+SsI7y","12288:+SsI7yv","12288:SsI7yvc","12288:sI7yvcT","12288:I7yvcTz","12288:7yvcTzY","12288:yvcTzYp","12288:vcTzYpu","12288:cTzYpuN","12288:TzYpuNi","12288:zYpuNia","12288:YpuNiab","12288:puNiabh","12288:uNiabhT","12288:NiabhT3","12288:iabhT3L","12288:abhT3L+","24576:a8Zwuv5","24576:8Zwuv5g","24576:Zwuv5g6","24576:wuv5g6h","24576:uv5g6hW","24576:v5g6hWm","24576:5g6hWmu","24576:g6hWmuE","24576:6hWmuE5","24576:hWmuE5T","24576:WmuE5Tl","24576:muE5TlU","24576:uE5TlUz","24576:E5TlUzL","24576:5TlUzL4","24576:TlUzL41","24576:lUzL41C","24576:UzL41CL","24576:zL41CLJ","24576:L41CLJ6","24576:41CLJ6j","24576:1CLJ6j3","24576:CLJ6j3W","24576:LJ6j3W+","24576:J6j3W+S","24576:6j3W+Ss","24576:j3W+SsI","24576:3W+SsI7","24576:W+SsI7y","24576:+SsI7yv","24576:SsI7yvc","24576:sI7yvcT","24576:I7yvcTz","24576:7yvcTzY","24576:yvcTzYp","24576:vcTzYpu","24576:cTzYpuN","24576:TzYpuNi","24576:zYpuNia","24576:YpuNiab","24576:puNiabh","24576:uNiabhT","24576:NiabhT3","24576:iabhT3L","24576:abhT3L+","12288:afmf5BO","12288:fmf5BOs","12288:mf5BOsU","12288:f5BOsU/","12288:5BOsU/y","12288:BOsU/yU","12288:OsU/yUT","12288:sU/yUTk","12288:U/yUTkp","12288:/yUTkpU","12288:yUTkpUb","12288:UTkpUbB"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ORDER LIST.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":860160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295012000,"last_seen":1677371354000,"last_multi_scan":1677371354000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":21,"malicious_count":8,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Infostealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Fareit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1216553","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.ProcessHacker.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.FVU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3981 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Fareit-FDZ!3529F9BF2B95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.ebstcw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-GOJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_FA.F4A51C67","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_FA.F4A51C67","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Atros3.AEQE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Fareit.Win32.14673","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TSPY_FA.F4A51C67","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\3853796.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\1kZK8LovZc\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 69550000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c \"\"%TEMP%\\3853796.bat\" \"C:\\ORDER_LIST.exe\" \"\" on 2016-4-18.06:46:57.252","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\3853796.bat\" \"C:\\ORDER_LIST.exe\" \"\" (UID: 00017029-00002220)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"3853796.bat\" has type \"ASCII text with CRLF CR line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.93529981942","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"wpD8gQeMuZ\" (Indicator: \"qemu\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Windows\\win.ini\"\n \"\" read file \"%APPDATA%\\Mozilla\\Firefox\\profiles.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Searches\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$24","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.38.0.100\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"Vo31vncME2rP2tTNx\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"\" opened file \"C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\SmartFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\SmartFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\TurboFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\TurboFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\VanDyke\\Config\\Sessions\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\VanDyke\\Config\\Sessions\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\FTPRush\\\" (DesiredAccess: 1048577, OpenOptions: 16417)","origin":"API Call","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.3680.3764718\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.3680.3764718\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3680.3765468\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/56 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/56 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\ORDER_LIST.exe\"\n \"\" allocated memory in \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\")","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"ADVAPI32.DLL\" at base 76190000\n \"\" loaded module \"PSAPI.DLL\" at base 77160000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 75490000\n \"\" loaded module \"OLEAUT32.DLL\" at base 760E0000\n \"\" loaded module \"KERNEL32.DLL\" at base 76000000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"LookupPrivilegeValue@ADVAPI32.dll\"\n \"LookupPrivilegeValueW@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"OpenProcessTokenW@ADVAPI32.dll\"\n \"AdjustTokenPrivileges@ADVAPI32.dll\"\n \"AdjustTokenPrivilegesW@ADVAPI32.dll\"\n \"EnumProcessModules@PSAPI.DLL\"\n \"EnumProcessModulesW@PSAPI.DLL\"\n \"GetModuleInformation@PSAPI.DLL\"\n \"GetModuleInformationW@PSAPI.DLL\"\n \"GetModuleBaseName@PSAPI.DLL\"\n \"GetModuleBaseNameW@PSAPI.DLL\"\n \"GetModuleFileNameEx@PSAPI.DLL\"\n \"GetModuleFileNameExW@PSAPI.DLL\"\n \"NtGetContextThread@ntdll.dll\"\n \"NtUnmapViewOfSection@ntdll.dll\"\n \"NtResumeThread@ntdll.dll\"\n \"NtSetContextThread@ntdll.dll\"\n \"NtProtectVirtualMemory@ntdll.dll\"\n \"NtWriteVirtualMemory@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00165390-00002444-19530-89-004100E9","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://booksam.tk/pony/gate.php\"\n Heuristic match: \"\\RhinoSoft.com\"\n Pattern match: \"http://www.facebook.com/\"\n Pattern match: \"http://www.ibsensoftware.com/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"http://www.facebook.com/\" (Indicator: \"facebook.com\")\n \"myspace1\" (Indicator: \"myspace\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00165390-00002444-19530-3-004101A4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00165390-00002444-19530-203-004043C2","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WSOCK32.DLL at 00165390-00002444-19530-31-004038AD\n recv@WSOCK32.DLL at 00165390-00002444-19530-27-0040391F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00165390-00002444-19530-93-00402C64","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"ORDER_LIST.exe\" (PID: 00002444)\n \"\" wrote 52 bytes to a foreign process \"ORDER_LIST.exe\" (PID: 00002444)\n \"\" wrote 4 bytes to a foreign process \"ORDER_LIST.exe\" (PID: 00002444)\n \"\" wrote 4096 bytes to a foreign process \"ORDER_LIST.exe\" (PID: 00002444)\n \"\" wrote to a foreign process PID 00002444\n \"\" wrote 33280 bytes to a foreign process \"ORDER_LIST.exe\" (PID: 00002444)\n \"\" wrote 1024 bytes to a foreign process \"ORDER_LIST.exe\" (PID: 00002444)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials","description":"\"RushSite.xml\" (Indicator: \"rushsite.xml\")\n \"Software\\FlashPeak\\BlazeFtp\\Settings\" (Indicator: \"\\blazeftp\\\")","origin":"File/Memory","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtGetContextThread@NTDLL.DLL at 00159375-00002392-774A228D-165790\n NtUnmapViewOfSection@NTDLL.DLL at 00159375-00002392-774A228D-166026\n NtResumeThread@NTDLL.DLL at 00159375-00002392-774A228D-166140\n NtSetContextThread@NTDLL.DLL at 00159375-00002392-774A228D-166254\n NtProtectVirtualMemory@NTDLL.DLL at 00159375-00002392-774A228D-166491\n NtWriteVirtualMemory@NTDLL.DLL at 00159375-00002392-774A228D-166576\n NtReadVirtualMemory@NTDLL.DLL at 00159375-00002392-774A228D-166578\n NtTerminateProcess@NTDLL.DLL at 00159375-00002392-774A228D-166581\n NtSetInformationProcess@NTDLL.DLL at 00159375-00002392-774A228D-166602","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"name":"Credential Stealer","details_count":2,"details":[{"detail":"Touched instant messenger related registry keys"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":126,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5714e451aac2ed56587b23c9","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","submit_name":"ORDER LIST.exe","analysis_start_time":"2016-04-18T08:43:30+00:00","indicators_count":{"informative":7,"suspicious":18,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5714e451aac2ed56587b23c7","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","submit_name":"ORDER LIST.exe","analysis_start_time":"2016-04-18T08:46:12+00:00","indicators_count":{"informative":7,"suspicious":19,"malicious":9},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}],"processes":[{"pid":3680,"ppid":0,"name":"ORDER_LIST.exe","command_line":"","normalized_path":"C:\\ORDER_LIST.exe","uid":"00010090-00003680","icon":"$26"},{"pid":2064,"ppid":3680,"name":"ORDER_LIST.exe","command_line":"","normalized_path":"C:\\ORDER_LIST.exe","parent_uid":"00010090-00003680","uid":"00014852-00002064"},{"pid":2220,"ppid":2064,"name":"cmd.exe","command_line":"cmd /c \"\"%TEMP%\\3853796.bat\" \"C:\\ORDER_LIST.exe\" \"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014852-00002064","uid":"00017029-00002220"}],"all_imported_dlls":["KernelBase.dll","msvcrt.dll","atl.dll","oleacc.dll","cfgmgr32.dll","profapi.dll","Culture.dll","mlang.dll","kernel32.dll","user32.dll","userenv.dll","srvcli.dll","advapi32.dll","sechost.dll","System.Windows.Forms.ni.dll","oleaut32.dll","wsock32.dll","uxtheme.dll","clbcatq.dll","mscoree.dll","mscorjit.dll","samcli.dll","sspicli.dll","gdi32.dll","mscorwks.dll","mscorlib.ni.dll","msasn1.dll","netapi32.dll","shell32.dll","msi.dll","propsys.dll","Wldap32.dll","devobj.dll","rpcrt4.dll","imm32.dll","urlmon.dll","iertutil.dll","ntmarta.dll","setupapi.dll","lpk.dll","cryptbase.dll","System.ni.dll","psapi.dll","bcrypt.dll","pstorec.dll","shdocvw.dll","ieframe.dll","usp10.dll","apphelp.dll","wininet.dll","wkscli.dll","ntdll.dll","msctf.dll","ws2_32.dll","comctl32.dll","crypt32.dll","shlwapi.dll","System.Drawing.ni.dll","netutils.dll","samlib.dll","msvcr80.dll","mscoreei.dll","ole32.dll","nsi.dll","NSI.dll","MSCOREE.DLL","IMM32.DLL","USP10.dll","RPCRT4.dll","USER32.dll","LPK.dll","SHLWAPI.dll","MSASN1.dll","DEVOBJ.dll","VERSION.dll","GDI32.dll","SETUPAPI.dll","MSCTF.dll","CFGMGR32.dll","ADVAPI32.dll","KERNEL32.dll","KERNELBASE.dll","SspiCli.dll","CRYPTBASE.dll","culture.dll","CRYPT32.dll","PSAPI.DLL","OLEAUT32.dll","WS2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"3853796.bat","sha256":"936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"C:\\ORDER_LIST.exe.config","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index145.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"C:\\ORDER_LIST.exe","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%TEMP%\\HWID","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%WINDIR%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%USERPROFILE%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%PROGRAMFILES%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%WINDIR%\\32BitFtp.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%TEMP%\\3853796.bat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%SAMPLEDIR%\\ORDER_LIST.exe.config","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]},{"path":"%SAMPLEDIR%\\ORDER_LIST.exe","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"},{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\1kZK8LovZc","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c9"}]},{"name":"1kZK8LovZc","sources":[{"report_type":"sandbox","report_id":"5714e451aac2ed56587b23c7"}]}]}},"report_ids":{"sandbox_job_ids":["5714e451aac2ed56587b23c9","5714e451aac2ed56587b23c7"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious TSPY_FA.F4A51C67 Sample 77ebbad7ff79… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 77ebbad7ff79…. Malware family: TSPY_FA.F4A51C67. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b"}],["$","meta","4",{"property":"og:title","content":"Malicious TSPY_FA.F4A51C67 Sample 77ebbad7ff79… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 77ebbad7ff79…. Malware family: TSPY_FA.F4A51C67. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TSPY_FA.F4A51C67 Sample 77ebbad7ff79… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 77ebbad7ff79…. Malware family: TSPY_FA.F4A51C67. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]