23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_EMOTET.XXTT Sample 79d96a62622e… — Score 93/100 — Hybrid Analysis","description":"Malicious verdict for sample 79d96a62622e…. Malware family: TROJ_EMOTET.XXTT. Threat score 93/100. 24/28 AV engines flagged this file. 7 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","keywords":["Malicious","TROJ_EMOTET.XXTT","malware analysis","sandbox report","threat intelligence","79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c"],"about":{"@type":"SoftwareApplication","name":"http___essentialnulidtro.com_af_7gyb3ds.decode","applicationCategory":["peexe","executable"],"identifier":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","additionalType":"Malicious sample"},"threatScore":93,"malwareFamily":"TROJ_EMOTET.XXTT","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8At3txe3e7u7iIi7u3uIi7u7u7s7s5e3u7iIu7u32Iu7u7u7u7mZu7u4iIu7uHuLu7u7szt5k7u7u4iLjYt3u7u7u7M3xniIh3eIiIiIh4i7u7uzN8x7u7u6uIiLu7t3u4u7u7lcx7u7u3iLu7u3aLuLuzM5l8x7u7u7u7i7dri7iItzeZt8x7uNu7iIt2d4uIiId2eXd8x4i7u4iIZ+6L24iId3tntmd7u7u4hrfui4u7dzmbu7fMZ4d3e2u3d7iLu7M5eIuIdnd3mXZ4iHe9u7u5mYiNi4d3d3dmaIhniLu7uZO42Hd5XHd3d7iIe4d3uzGbt1lYVVx3d3e7dnuHZrszmZmVe3d3i3d3d354iLu5mZlVd3u4iHZ3d3d3eIi7uZVVe7u7N3d8x4d3dziIuzk3Y7u7u7d3d8yFx3d3iLiTMzu3e7u7d3d3uHzHN3h3MzMzN1u7iIiHd4iHx3d4iDMzMzMzMzN3czN3fHzHiIszMzMzMzMzMzMzMzN3d3iLszu7u7MzMzMzMzMzMzMzM7u7u7u7W3d3u7M3MzMzMzO7u7u7t3Z3e7u7eLu3Mzd3Mzu7u3d1e7u7d7u3xzN3eDM7u7u7t3u7h3u7t8w7s3e7u7u7u4iHd3e7u7d3u7u7u7d3d7uP/4iIu7u7u7u7dzO7u7u7uIiP//iIh3M2N3MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8At3txe3e7u7iIi7u3uIi7u7u7s7s5e3u7iIu7u32Iu7u7u7u7mZu7u4iIu7uHuLu7u7szt5k7u7u4iLjYt3u7u7u7M3xniIh3eIiIiIh4i7u7uzN8x7u7u6uIiLu7t3u4u7u7lcx7u7u3iLu7u3aLuLuzM5l8x7u7u7u7i7dri7iItzeZt8x7uNu7iIt2d4uIiId2eXd8x4i7u4iIZ+6L24iId3tntmd7u7u4hrfui4u7dzmbu7fMZ4d3e2u3d7iLu7M5eIuIdnd3mXZ4iHe9u7u5mYiNi4d3d3dmaIhniLu7uZO42Hd5XHd3d7iIe4d3uzGbt1lYVVx3d3e7dnuHZrszmZmVe3d3i3d3d354iLu5mZlVd3u4iHZ3d3d3eIi7uZVVe7u7N3d8x4d3dziIuzk3Y7u7u7d3d8yFx3d3iLiTMzu3e7u7d3d3uHzHN3h3MzMzN1u7iIiHd4iHx3d4iDMzMzMzMzN3czN3fHzHiIszMzMzMzMzMzMzMzN3d3iLszu7u7MzMzMzMzMzMzMzM7u7u7u7W3d3u7M3MzMzMzO7u7u7t3Z3e7u7eLu3Mzd3Mzu7u3d1e7u7d7u3xzN3eDM7u7u7t3u7h3u7t8w7s3e7u7u7u4iHd3e7u7d3u7u7u7d3d7uP/4iIu7u7u7u7dzO7u7u7uIiP//iIh3M2N3MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8At3txe3e7u7iIi7u3uIi7u7u7s7s5e3u7iIu7u32Iu7u7u7u7mZu7u4iIu7uHuLu7u7szt5k7u7u4iLjYt3u7u7u7M3xniIh3eIiIiIh4i7u7uzN8x7u7u6uIiLu7t3u4u7u7lcx7u7u3iLu7u3aLuLuzM5l8x7u7u7u7i7dri7iItzeZt8x7uNu7iIt2d4uIiId2eXd8x4i7u4iIZ+6L24iId3tntmd7u7u4hrfui4u7dzmbu7fMZ4d3e2u3d7iLu7M5eIuIdnd3mXZ4iHe9u7u5mYiNi4d3d3dmaIhniLu7uZO42Hd5XHd3d7iIe4d3uzGbt1lYVVx3d3e7dnuHZrszmZmVe3d3i3d3d354iLu5mZlVd3u4iHZ3d3d3eIi7uZVVe7u7N3d8x4d3dziIuzk3Y7u7u7d3d8yFx3d3iLiTMzu3e7u7d3d3uHzHN3h3MzMzN1u7iIiHd4iHx3d4iDMzMzMzMzN3czN3fHzHiIszMzMzMzMzMzMzMzN3d3iLszu7u7MzMzMzMzMzMzMzM7u7u7u7W3d3u7M3MzMzMzO7u7u7t3Z3e7u7eLu3Mzd3Mzu7u3d1e7u7d7u3xzN3eDM7u7u7t3u7h3u7t8w7s3e7u7u7u4iHd3e7u7d3u7u7u7d3d7uP/4iIu7u7u7u7dzO7u7u7uIiP//iIh3M2N3MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8At3txe3e7u7iIi7u3uIi7u7u7s7s5e3u7iIu7u32Iu7u7u7u7mZu7u4iIu7uHuLu7u7szt5k7u7u4iLjYt3u7u7u7M3xniIh3eIiIiIh4i7u7uzN8x7u7u6uIiLu7t3u4u7u7lcx7u7u3iLu7u3aLuLuzM5l8x7u7u7u7i7dri7iItzeZt8x7uNu7iIt2d4uIiId2eXd8x4i7u4iIZ+6L24iId3tntmd7u7u4hrfui4u7dzmbu7fMZ4d3e2u3d7iLu7M5eIuIdnd3mXZ4iHe9u7u5mYiNi4d3d3dmaIhniLu7uZO42Hd5XHd3d7iIe4d3uzGbt1lYVVx3d3e7dnuHZrszmZmVe3d3i3d3d354iLu5mZlVd3u4iHZ3d3d3eIi7uZVVe7u7N3d8x4d3dziIuzk3Y7u7u7d3d8yFx3d3iLiTMzu3e7u7d3d3uHzHN3h3MzMzN1u7iIiHd4iHx3d4iDMzMzMzMzN3czN3fHzHiIszMzMzMzMzMzMzMzN3d3iLszu7u7MzMzMzMzMzMzMzM7u7u7u7W3d3u7M3MzMzMzO7u7u7t3Z3e7u7eLu3Mzd3Mzu7u3d1e7u7d7u3xzN3eDM7u7u7t3u7h3u7t8w7s3e7u7u7u4iHd3e7u7d3u7u7u7d3d7uP/4iIu7u7u7u7dzO7u7u7uIiP//iIh3M2N3MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":93,"unified_at_epoch_ms":1790273800235,"unified_at":"2026-09-24T18:16:40.235Z","metadata":{"hashes":{"sha256":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","sha1":"38286040daca2eab88c8c25731cb9957d5f12cdd","md5":"9c6cecc960bfd950b64699b2fee1a723","sha512":"79bc1d6fa1edfc56e99a0cd0d2fc355a3cd9d495d13dbf827c45545e51328c9bb14bd81052f3ac54d804d9ccd9917b316044e8f10971befb2140a32084f11585","ssdeep":"6144:ghhVu3WJ61D7NA5fdXXLyHnVBvGs+BXPL7bcoxO76LYj20avQpPc:AQ34iNA5lLC8TcMOGEjeQV","ssdeep_chunks":["6144:ghhVu3W","6144:hhVu3WJ","6144:hVu3WJ6","6144:Vu3WJ61","6144:u3WJ61D","6144:3WJ61D7","6144:WJ61D7N","6144:J61D7NA","6144:61D7NA5","6144:1D7NA5f","6144:D7NA5fd","6144:7NA5fdX","6144:NA5fdXX","6144:A5fdXXL","6144:5fdXXLy","6144:fdXXLyH","6144:dXXLyHn","6144:XXLyHnV","6144:XLyHnVB","6144:LyHnVBv","6144:yHnVBvG","6144:HnVBvGs","6144:nVBvGs+","6144:VBvGs+B","6144:BvGs+BX","6144:vGs+BXP","6144:Gs+BXPL","6144:s+BXPL7","6144:+BXPL7b","6144:BXPL7bc","6144:XPL7bco","6144:PL7bcox","6144:L7bcoxO","6144:7bcoxO7","6144:bcoxO76","6144:coxO76L","6144:oxO76LY","6144:xO76LYj","6144:O76LYj2","6144:76LYj20","6144:6LYj20a","6144:LYj20av","6144:Yj20avQ","6144:j20avQp","6144:20avQpP","6144:0avQpPc","12288:ghhVu3W","12288:hhVu3WJ","12288:hVu3WJ6","12288:Vu3WJ61","12288:u3WJ61D","12288:3WJ61D7","12288:WJ61D7N","12288:J61D7NA","12288:61D7NA5","12288:1D7NA5f","12288:D7NA5fd","12288:7NA5fdX","12288:NA5fdXX","12288:A5fdXXL","12288:5fdXXLy","12288:fdXXLyH","12288:dXXLyHn","12288:XXLyHnV","12288:XLyHnVB","12288:LyHnVBv","12288:yHnVBvG","12288:HnVBvGs","12288:nVBvGs+","12288:VBvGs+B","12288:BvGs+BX","12288:vGs+BXP","12288:Gs+BXPL","12288:s+BXPL7","12288:+BXPL7b","12288:BXPL7bc","12288:XPL7bco","12288:PL7bcox","12288:L7bcoxO","12288:7bcoxO7","12288:bcoxO76","12288:coxO76L","12288:oxO76LY","12288:xO76LYj","12288:O76LYj2","12288:76LYj20","12288:6LYj20a","12288:LYj20av","12288:Yj20avQ","12288:j20avQp","12288:20avQpP","12288:0avQpPc","6144:AQ34iNA","6144:Q34iNA5","6144:34iNA5l","6144:4iNA5lL","6144:iNA5lLC","6144:NA5lLC8","6144:A5lLC8T","6144:5lLC8Tc","6144:lLC8TcM","6144:LC8TcMO","6144:C8TcMOG","6144:8TcMOGE","6144:TcMOGEj","6144:cMOGEje","6144:MOGEjeQ","6144:OGEjeQV"],"imphash":"eb1b69eaf2ddcf4d88e3b49607091666"},"file_info":{"file_name":"http___essentialnulidtro.com_af_7gyb3ds.decode","file_type":["peexe","executable"],"file_type_id":"exe","file_size":341504,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286705000,"last_seen":1677371632000,"last_multi_scan":1677371632000}},"detections":{"summary":{"verdict":"malicious","score":93,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":6,"malicious_count":7,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.toP2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Scarsi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.MalwareCrypter.jccbu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Autoruns.GenericKD.44972405","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Lokibot-6331386-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Poison.FTCB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Emotet.S.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrickBot.O trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/Obfuscator.ya","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050f8071 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.bvau","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.acf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.AD.eqttwq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-HXF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_EMOTET.XXTT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_EMOTET.XXTT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Banker.CDY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.MulDrop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Inject.Win32.238416","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_EMOTET.XXTT","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00013925-00002932-38649-12-0100154B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013925-00002932-38649-33-01003FE1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013925-00002932-38649-411-01002B9B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014705-00002268-42052-12-0100154B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014705-00002268-42052-411-01002B9B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014705-00002268-42052-33-01003FE1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00013925-00002932-38649-170-01003F2F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00014705-00002268-42052-170-01003F2F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"216.218.206.69:57362\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\VLock\"\n \"Global\\VLock\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00014620-00002560)\n Spawned process \"\" (UID: 00014705-00002268)\n Spawned process \"\" (UID: 00015399-00002444)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\tzres.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"http___essentialnulidtro.com_af_7gyb3ds.decode.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.95121079669","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 216.218.206.69\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"http___essentialnulidtro.com_af_7gyb3ds.decode.exe.bin\" claimed CRC 392222 while the actual is CRC 399793","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n LoadLibraryW\n GetModuleHandleA\n WriteFile\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053bc775858bd77186abd77653cbe770000000000bf8e770000000056cc8e77000000007cca8e77000000003768eb756a2cbe77d62dbe77000000002069eb750000000029a68e7700000000a48deb7500000000f70e8e7700000000\" to virtual address \"0x768F1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/60 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"7/60 Antivirus vendors marked spawned process \"\" (PID: 2932) as malicious (classified as \"Emotet.S.gen\" with 11% detection rate)\n 7/60 Antivirus vendors marked spawned process \"\" (PID: 2560) as malicious (classified as \"Emotet.S.gen\" with 11% detection rate)\n 7/60 Antivirus vendors marked spawned process \"\" (PID: 2268) as malicious (classified as \"Emotet.S.gen\" with 11% detection rate)\n 7/60 Antivirus vendors marked spawned process \"\" (PID: 2444) as malicious (classified as \"Emotet.S.gen\" with 11% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 72150000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"216.218.206.69\" (ASN: 6939, Owner: Hurricane Electric, Inc.): ...\nURL: http://216.218.206.69/ (AV positives: 1/68 scanned on 08/21/2016 17:20:52)\n File SHA256: adbc8064324a39eab0ad8e79d7e0621f3f9bd698fc9d0de7121b3a50932f624b (AV positives: 47/60 scanned on 06/07/2017 09:07:40)\n File SHA256: 5c423b6d21f10dbf02a40e642fbfd94f35da0a1aa85ae2b1ee2ecb161c7e0ea9 (AV positives: 55/60 scanned on 06/07/2017 07:54:07)\n File SHA256: ec050f8df76201ad1a19bc1548e6eb074d4de392602b1f6909ea9ead34d9aa1f (AV positives: 49/61 scanned on 06/07/2017 04:31:39)\n File SHA256: 8e32f0b6e768081cb981a3e15e76a76d56e796fd7bf25f3b8ab50854f9d4e81e (AV positives: 47/62 scanned on 06/07/2017 04:27:27)\n File SHA256: 8ff340dad66dfe56ab1288a44604a9e1f3914118dd19e5884d50e98f1fd63683 (AV positives: 47/61 scanned on 06/07/2017 04:23:39)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"5937c378aac2ed3e165fb505","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":93,"malware_family":"Emotet.S.gen","contacted_countries":["USA"],"submit_name":"http___essentialnulidtro.com_af_7gyb3ds.decode","analysis_start_time":"2017-06-07T10:12:11+00:00","indicators_count":{"informative":9,"suspicious":6,"malicious":7},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"216.218.206.69","port":57362,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}],"processes":[{"pid":2932,"ppid":0,"name":"http___essentialnulidtro.com_af_7gyb3ds.decode.exe","command_line":"","sha256":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","normalized_path":"C:\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe","uid":"00013925-00002932","icon":"$24"},{"pid":2560,"ppid":2932,"name":"http___essentialnulidtro.com_af_7gyb3ds.decode.exe","command_line":"","sha256":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","normalized_path":"C:\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe","parent_uid":"00013925-00002932","uid":"00014620-00002560","icon":"$25"},{"pid":2268,"ppid":2560,"name":"http___essentialnulidtro.com_af_7gyb3ds.decode.exe","command_line":"","sha256":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","normalized_path":"%APPDATA%\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe","parent_uid":"00014620-00002560","uid":"00014705-00002268","icon":"$26"},{"pid":2444,"ppid":2268,"name":"http___essentialnulidtro.com_af_7gyb3ds.decode.exe","command_line":"","sha256":"79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c","normalized_path":"%APPDATA%\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe","parent_uid":"00014705-00002268","uid":"00015399-00002444","icon":"$27"}],"all_imported_dlls":["ws2_32.dll","imm32.dll","shlwapi.dll","sechost.dll","rpcrt4.dll","IPHLPAPI.DLL","rpcss.dll","clbcatq.dll","ntdll.dll","user32.dll","usp10.dll","profapi.dll","gdi32.dll","msctf.dll","uxtheme.dll","winhttp.dll","taskschd.dll","dwmapi.dll","apphelp.dll","nsi.dll","ncrypt.dll","msvcrt.dll","advapi32.dll","oleaut32.dll","crypt32.dll","cryptbase.dll","kernel32.dll","shell32.dll","msasn1.dll","winnsi.dll","KernelBase.dll","webio.dll","tzres.dll","lpk.dll","ole32.dll","userenv.dll","bcrypt.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"C:\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"%APPDATA%\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"%APPDATA%\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"%APPDATA%\\http___essentialnulidtro.com_af_7gyb3ds.decode.exe","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\VLock","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]},{"name":"Global\\VLock","sources":[{"report_type":"sandbox","report_id":"5937c378aac2ed3e165fb505"}]}]}},"report_ids":{"sandbox_job_ids":["5937c378aac2ed3e165fb505"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious TROJ_EMOTET.XXTT Sample 79d96a62622e… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 79d96a62622e…. Malware family: TROJ_EMOTET.XXTT. Threat score 93/100. 24/28 AV engines flagged this file. 7 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c"}],["$","meta","4",{"property":"og:title","content":"Malicious TROJ_EMOTET.XXTT Sample 79d96a62622e… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 79d96a62622e…. Malware family: TROJ_EMOTET.XXTT. Threat score 93/100. 24/28 AV engines flagged this file. 7 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/79d96a62622e4efb01fda23cf81b759e0059ad3cd3083acff7fb4174b0b3d40c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TROJ_EMOTET.XXTT Sample 79d96a62622e… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 79d96a62622e…. Malware family: TROJ_EMOTET.XXTT. Threat score 93/100. 24/28 AV engines flagged this file. 7 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]