23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7be8966df205… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7be8966df205…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 15 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b"],"about":{"@type":"SoftwareApplication","name":"ms_office_update.exe","applicationCategory":["peexe","executable"],"identifier":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Tcbe,"" wrote bytes "55" to virtual address "0x0040D000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "e8" to virtual address "0x0040E000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "d1" to virtual address "0x0040F000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "4d" to virtual address "0x0040C4A0" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "5d" to virtual address "0x00419000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "a0" to virtual address "0x00418000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "a7" to virtual address "0x0041B000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "a8" to virtual address "0x0041A000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "bf" to virtual address "0x00415000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "55" to virtual address "0x00414000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "f3" to virtual address "0x00417000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "ef" to virtual address "0x00416000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "c6" to virtual address "0x00411000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "a8" to virtual address "0x00410000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "b3" to virtual address "0x00413000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "37" to virtual address "0x00412000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "" wrote bytes "b4a4af7500000000ccbc3675025d387500143775c58f3675461e3775b4bc367572ba367561383775cb473675893537753c73357500000000421f5275cf675175d96f507500000000" to virtual address "0x00401000" (part of module "7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861FD82748E69B.EXE") "msiexec.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "msiexec.exe" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL")25:T551,"" wrote 32 bytes to a remote process "C:\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe" (Handle: 28) "" wrote 52 bytes to a remote process "C:\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe" (Handle: 28) "" wrote 4 bytes to a remote process "C:\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe" (Handle: 28) "" wrote 1024 bytes to a remote process "C:\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe" (Handle: 28) "" wrote 9728 bytes to a remote process "C:\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe" (Handle: 28) "" wrote 51200 bytes to a remote process "C:\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe" (Handle: 28) "" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496) "" wrote 290 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 75496)26:T1d92,Found malicious artifacts related to "45.63.25.55" (ASN: , Owner: ): ... URL: http://45.63.25.55/ (AV positives: 2/65 scanned on 09/01/2017 21:16:18) File SHA256: 417e31541737cf27a66af375c351f3428318171358307d5b318520673ec4e6f1 (Scanned on 08/17/2017 01:28:36) File SHA256: 645997ffd2825664f0683ef8ab64ad1e095a1e2a4db5b2585a6520d635d9e214 (Scanned on 07/23/2017 20:16:56) File SHA256: fc0ff352bc6aa98a18c10103890699aa9f6de175f88c440b9a7ee6e1d2b67b46 (Scanned on 02/26/2017 21:16:17) File SHA256: 77ceddd872c1bdfe0538617297c44f9c7b0ee966a1681c5edff051c9e8c5855a (Scanned on 01/17/2017 12:20:25) File SHA256: 2d273b4d841528f20b64af043c21d03f2c59cbf3dc21dcda10c0b6aca3d16641 (Scanned on 01/15/2017 10:48:54) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:57) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "5.9.49.12" (ASN: , Owner: ): ... File SHA256: 146ca3b5d1be28ee3a5b299c21eb6e7c093cef4262c48a23ec2782cbf8c59509 (Scanned on 10/20/2017 05:11:17) File SHA256: b77d736c66a02de55595b93b10e7e48173eb0637dae816cfcf9a43eadc058c38 (Scanned on 08/31/2017 16:47:59) File SHA256: ed89a3148131d0efb99ed791d48cfb9ee9f032ec72656d26384a5c45f8bdff77 (Scanned on 08/31/2017 16:47:44) File SHA256: deb8d22889c6890e28421089002e2b122bfaec3c5f260c98f63e45f3a6e9d7af (Scanned on 08/31/2017 16:31:54) File SHA256: 91aff4c3d692b3981a2574e2625043670102e7dec0d685cdd54548b623d4d9bb (Scanned on 08/31/2017 03:07:17) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "87.98.175.85" (ASN: , Owner: ): ... URL: http://87.98.175.85/ (AV positives: 2/64 scanned on 10/13/2017 22:26:25) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: 146ca3b5d1be28ee3a5b299c21eb6e7c093cef4262c48a23ec2782cbf8c59509 (Scanned on 10/20/2017 05:11:17) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: b81bbf6764ae8ecf9bfddb76e1a379cabe431ea8c387bacbdc0b632f90f2d310 (Scanned on 10/13/2017 17:42:14) File SHA256: 7f70b66d27aa1a9273bd53819faf7242f04feffd1043e437e52546b6386d3d0c (AV positives: 43/64 scanned on 09/02/2017 07:36:13) File SHA256: 88c59f86813b9f16749ca6983519864365353edd340c69d1790e18ecf61e0bee (Scanned on 08/19/2017 22:05:34) File SHA256: 531b164ad07c6b6b9a3e0be937e04e29778b33d04748f1277dc5bf46e94c4f29 (AV positives: 46/65 scanned on 08/15/2017 21:21:43) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:23) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:41) File SHA256: 40a26dea5b206fdbf669747560cae0c4075a40570b187abf9fc0c6841a46bb26 (AV positives: 58/63 scanned on 07/06/2017 00:46:27) Found malicious artifacts related to "108.61.164.218" (ASN: , Owner: ): ... File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "23.94.5.133" (ASN: , Owner: ): ... URL: http://23.94.5.133/ (AV positives: 2/64 scanned on 10/13/2017 22:25:45) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: b81bbf6764ae8ecf9bfddb76e1a379cabe431ea8c387bacbdc0b632f90f2d310 (Scanned on 10/13/2017 17:42:14) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (Scanned on 08/10/2017 18:16:21) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (Scanned on 08/08/2017 18:28:53) Found malicious artifacts related to "51.255.48.78" (ASN: , Owner: ): ... URL: http://51.255.48.78/ (AV positives: 1/65 scanned on 07/19/2017 03:52:53) File SHA256: a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e (Scanned on 08/31/2017 17:12:09) File SHA256: 953fec239651bd73633f558954592768cab43cafe07e9caa240097dac0286ccd (Scanned on 08/31/2017 17:10:31) File SHA256: f3f648ed4f1188685f7afda176d16913b77d5722f21647820d275b47d72a9acf (AV positives: 14/65 scanned on 08/29/2017 14:48:34) File SHA256: 078dfb58efa8d69d6f87698ac41bdaac623c3b7b0dbe1307fdc9fec98d8beb8f (AV positives: 22/65 scanned on 08/12/2017 04:28:41) File SHA256: 4aa4dc793b90a9e4c7b4c5ab5e60af2ad7e8f5ba828bbcf61e90b71021a81ec7 (Scanned on 07/21/2017 17:37:33) File SHA256: cc6bf0264e91ba99f332e0b6ff32e24cd3c728d0d55eeba428542a8e65c97a79 (Scanned on 07/21/2017 17:36:12) File SHA256: 53e1b3afc79a33822471bf3f06a4e22379b99c1a8e4b04798b1c78daaea78799 (Scanned on 07/21/2017 17:32:51) File SHA256: cb2a2457523be36d6e2ecd9069e0ab19b8392766d113fcffd15f7c6dde9a7b1c (AV positives: 38/63 scanned on 07/16/2017 15:42:13) File SHA256: 071868a430256589aa51c7263bf593300dbb7531876a4f17705960ade9223404 (AV positives: 11/60 scanned on 06/28/2017 10:28:47) File SHA256: 362b41a6e6f40d7b91ea0f901a4e45f24212a3a54b828ea70242e10e589aa090 (AV positives: 6/62 scanned on 06/19/2017 15:14:26) Found malicious artifacts related to "144.76.133.38" (ASN: , Owner: ): ... URL: http://144.76.133.38/ (AV positives: 2/64 scanned on 10/13/2017 22:24:15) File SHA256: 645997ffd2825664f0683ef8ab64ad1e095a1e2a4db5b2585a6520d635d9e214 (Scanned on 07/23/2017 20:16:56) File SHA256: 50e315f714b08ce825c5102d7ce8d2f7d23e104bee91e8e86a7d626f37e1d7de (Scanned on 02/22/2017 15:44:32) File SHA256: 565ccdaf5bf38975becfaba1311514121b39c0479f7cd96ae1579fb2fee9c64b (Scanned on 01/29/2017 19:57:57) File SHA256: 6c5dae6a3444d03adebc759d4081df53d189c8ce2c78569860411bc662c4bee9 (Scanned on 01/14/2017 12:10:33) File SHA256: a6d514681add02c6946c4833d7495545baa6ad377b607f843e122068cb1e8e20 (Scanned on 01/04/2017 21:13:06) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30)27:T1d92,Found malicious artifacts related to "45.63.25.55" (ASN: , Owner: ): ... URL: http://45.63.25.55/ (AV positives: 2/65 scanned on 09/01/2017 21:16:18) File SHA256: 417e31541737cf27a66af375c351f3428318171358307d5b318520673ec4e6f1 (Scanned on 08/17/2017 01:28:36) File SHA256: 645997ffd2825664f0683ef8ab64ad1e095a1e2a4db5b2585a6520d635d9e214 (Scanned on 07/23/2017 20:16:56) File SHA256: fc0ff352bc6aa98a18c10103890699aa9f6de175f88c440b9a7ee6e1d2b67b46 (Scanned on 02/26/2017 21:16:17) File SHA256: 77ceddd872c1bdfe0538617297c44f9c7b0ee966a1681c5edff051c9e8c5855a (Scanned on 01/17/2017 12:20:25) File SHA256: 2d273b4d841528f20b64af043c21d03f2c59cbf3dc21dcda10c0b6aca3d16641 (Scanned on 01/15/2017 10:48:54) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:57) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "5.9.49.12" (ASN: , Owner: ): ... File SHA256: 146ca3b5d1be28ee3a5b299c21eb6e7c093cef4262c48a23ec2782cbf8c59509 (Scanned on 10/20/2017 05:11:17) File SHA256: b77d736c66a02de55595b93b10e7e48173eb0637dae816cfcf9a43eadc058c38 (Scanned on 08/31/2017 16:47:59) File SHA256: ed89a3148131d0efb99ed791d48cfb9ee9f032ec72656d26384a5c45f8bdff77 (Scanned on 08/31/2017 16:47:44) File SHA256: deb8d22889c6890e28421089002e2b122bfaec3c5f260c98f63e45f3a6e9d7af (Scanned on 08/31/2017 16:31:54) File SHA256: 91aff4c3d692b3981a2574e2625043670102e7dec0d685cdd54548b623d4d9bb (Scanned on 08/31/2017 03:07:17) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "87.98.175.85" (ASN: , Owner: ): ... URL: http://87.98.175.85/ (AV positives: 2/64 scanned on 10/13/2017 22:26:25) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: 146ca3b5d1be28ee3a5b299c21eb6e7c093cef4262c48a23ec2782cbf8c59509 (Scanned on 10/20/2017 05:11:17) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: b81bbf6764ae8ecf9bfddb76e1a379cabe431ea8c387bacbdc0b632f90f2d310 (Scanned on 10/13/2017 17:42:14) File SHA256: 7f70b66d27aa1a9273bd53819faf7242f04feffd1043e437e52546b6386d3d0c (AV positives: 43/64 scanned on 09/02/2017 07:36:13) File SHA256: 88c59f86813b9f16749ca6983519864365353edd340c69d1790e18ecf61e0bee (Scanned on 08/19/2017 22:05:34) File SHA256: 531b164ad07c6b6b9a3e0be937e04e29778b33d04748f1277dc5bf46e94c4f29 (AV positives: 46/65 scanned on 08/15/2017 21:21:43) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (AV positives: 30/64 scanned on 08/08/2017 19:48:23) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (AV positives: 12/64 scanned on 08/07/2017 17:58:41) File SHA256: 40a26dea5b206fdbf669747560cae0c4075a40570b187abf9fc0c6841a46bb26 (AV positives: 58/63 scanned on 07/06/2017 00:46:27) Found malicious artifacts related to "108.61.164.218" (ASN: , Owner: ): ... File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30) Found malicious artifacts related to "23.94.5.133" (ASN: , Owner: ): ... URL: http://23.94.5.133/ (AV positives: 2/64 scanned on 10/13/2017 22:25:45) File SHA256: e1548c04fa71c60068837ab42c39a100092167f68a2956a28aa31fe78c446d1c (Scanned on 10/21/2017 09:19:26) File SHA256: ebb6e7f92027e5e838e1da6dc8d79b617096f48d085b36052fb70c1dfb3a644e (Scanned on 10/15/2017 19:38:16) File SHA256: b81bbf6764ae8ecf9bfddb76e1a379cabe431ea8c387bacbdc0b632f90f2d310 (Scanned on 10/13/2017 17:42:14) File SHA256: 69ba113813c45916ecf6668b856972216dd77e6fdac503bbd7400ab31fe1d40f (Scanned on 08/10/2017 18:16:21) File SHA256: 124508ed0c25a2d123a2a0ca22f34b8e0482fb6ee719e6b2f26d6bb5245cb034 (Scanned on 08/08/2017 18:28:53) Found malicious artifacts related to "51.255.48.78" (ASN: , Owner: ): ... URL: http://51.255.48.78/ (AV positives: 1/65 scanned on 07/19/2017 03:52:53) File SHA256: a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e (Scanned on 08/31/2017 17:12:09) File SHA256: 953fec239651bd73633f558954592768cab43cafe07e9caa240097dac0286ccd (Scanned on 08/31/2017 17:10:31) File SHA256: f3f648ed4f1188685f7afda176d16913b77d5722f21647820d275b47d72a9acf (AV positives: 14/65 scanned on 08/29/2017 14:48:34) File SHA256: 078dfb58efa8d69d6f87698ac41bdaac623c3b7b0dbe1307fdc9fec98d8beb8f (AV positives: 22/65 scanned on 08/12/2017 04:28:41) File SHA256: 4aa4dc793b90a9e4c7b4c5ab5e60af2ad7e8f5ba828bbcf61e90b71021a81ec7 (Scanned on 07/21/2017 17:37:33) File SHA256: cc6bf0264e91ba99f332e0b6ff32e24cd3c728d0d55eeba428542a8e65c97a79 (Scanned on 07/21/2017 17:36:12) File SHA256: 53e1b3afc79a33822471bf3f06a4e22379b99c1a8e4b04798b1c78daaea78799 (Scanned on 07/21/2017 17:32:51) File SHA256: cb2a2457523be36d6e2ecd9069e0ab19b8392766d113fcffd15f7c6dde9a7b1c (AV positives: 38/63 scanned on 07/16/2017 15:42:13) File SHA256: 071868a430256589aa51c7263bf593300dbb7531876a4f17705960ade9223404 (AV positives: 11/60 scanned on 06/28/2017 10:28:47) File SHA256: 362b41a6e6f40d7b91ea0f901a4e45f24212a3a54b828ea70242e10e589aa090 (AV positives: 6/62 scanned on 06/19/2017 15:14:26) Found malicious artifacts related to "144.76.133.38" (ASN: , Owner: ): ... URL: http://144.76.133.38/ (AV positives: 2/64 scanned on 10/13/2017 22:24:15) File SHA256: 645997ffd2825664f0683ef8ab64ad1e095a1e2a4db5b2585a6520d635d9e214 (Scanned on 07/23/2017 20:16:56) File SHA256: 50e315f714b08ce825c5102d7ce8d2f7d23e104bee91e8e86a7d626f37e1d7de (Scanned on 02/22/2017 15:44:32) File SHA256: 565ccdaf5bf38975becfaba1311514121b39c0479f7cd96ae1579fb2fee9c64b (Scanned on 01/29/2017 19:57:57) File SHA256: 6c5dae6a3444d03adebc759d4081df53d189c8ce2c78569860411bc662c4bee9 (Scanned on 01/14/2017 12:10:33) File SHA256: a6d514681add02c6946c4833d7495545baa6ad377b607f843e122068cb1e8e20 (Scanned on 01/04/2017 21:13:06) File SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:57) File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59) File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:45) File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30)28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAHQAAABHAAAAAAAAAAAAAHAABmZgAAcAAAAAAAAAAHAEd3d3d3dABwAAAAAAAAcAd4dmZmZ4dwBwAAAAAABwd4ZmZmZmZmh3BwAAAAAHB3dmZmZmZmZmd3BwAAAAcHhmZmZmbGZmZmaHBwAABwd2ZmbMZ4iGZmZmZ3BwAAAHdmZ4j///jGZmxmdwAABAeGaP//////iIiIdmhwQABnZsj//////4iIiIxmdgBAeGbI//////+IiIiMZocEQHdmyP/////4iIiIjGZ3BAB2Zsj/iPj//4iIiIxmZwAHdmbI/3j8j/+IiIiMZmdwB3ZmyP+IiI//iIiIjGZncAd2Zsj/iIiP/4iIiIxmZ3AHdmbI+I/Pj/iIiIiMZmdwAHZmyPj/j4j/iIiIjGZnAEB3Zsj/////+HiIeIxmdwRAeGbI//////+IiIiMZocEAHdmyP//////iIiIjGZ3AAQHhmj//////4iIiHZocEAAAHdmaIj///jGzMxmdwAAAHB3ZmbMxniIZmZmZncHAAAGB4ZmZmZmxmZmZmhwYAAAAEB3dmZmZmZmZmd3BAAAAAAEB3hmZmZmZmaHcEAAAAAAAGAHeHZmZmeHcAYAAAAAAAAHAHd3d3d3dwBwAAAAAAAAAAQAAHd3AABAAAAAAAAAAAAABEAAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790472728298,"unified_at":"2026-09-27T01:32:08.298Z","metadata":{"hashes":{"sha256":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","sha1":"bc34267b2cf868dd74a0c8c4a9c9d4754fa12611","md5":"9cc129b0e8acaa0cf9c61041a7b247aa","sha512":"1d246689e28e56ebf91a5ff4a90ddac97000fa954ddb1a664c24cad66ba975f3458bde5c6c7599fb75ec40b0ad2aa3f9eb4e1353a014aac3a7f4f63800bfff71","ssdeep":"1536:DWiGnU/wgTQabGnU/wgTQabGnU/wgTQabGnU/wgTQaLnIv5+4+wAQnkZx+cju+gM:aDGv4Gv4Gv4GvnltbnVTgMj","ssdeep_chunks":["1536:DWiGnU/","1536:WiGnU/w","1536:iGnU/wg","1536:GnU/wgT","1536:nU/wgTQ","1536:U/wgTQa","1536:/wgTQab","1536:wgTQabG","1536:gTQabGn","1536:TQabGnU","1536:QabGnU/","1536:abGnU/w","1536:bGnU/wg","1536:/wgTQaL","1536:wgTQaLn","1536:gTQaLnI","1536:TQaLnIv","1536:QaLnIv5","1536:aLnIv5+","1536:LnIv5+4","1536:nIv5+4+","1536:Iv5+4+w","1536:v5+4+wA","1536:5+4+wAQ","1536:+4+wAQn","1536:4+wAQnk","1536:+wAQnkZ","1536:wAQnkZx","1536:AQnkZx+","1536:QnkZx+c","1536:nkZx+cj","1536:kZx+cju","1536:Zx+cju+","1536:x+cju+g","1536:+cju+gM","3072:DWiGnU/","3072:WiGnU/w","3072:iGnU/wg","3072:GnU/wgT","3072:nU/wgTQ","3072:U/wgTQa","3072:/wgTQab","3072:wgTQabG","3072:gTQabGn","3072:TQabGnU","3072:QabGnU/","3072:abGnU/w","3072:bGnU/wg","3072:/wgTQaL","3072:wgTQaLn","3072:gTQaLnI","3072:TQaLnIv","3072:QaLnIv5","3072:aLnIv5+","3072:LnIv5+4","3072:nIv5+4+","3072:Iv5+4+w","3072:v5+4+wA","3072:5+4+wAQ","3072:+4+wAQn","3072:4+wAQnk","3072:+wAQnkZ","3072:wAQnkZx","3072:AQnkZx+","3072:QnkZx+c","3072:nkZx+cj","3072:kZx+cju","3072:Zx+cju+","3072:x+cju+g","3072:+cju+gM","1536:aDGv4Gv","1536:DGv4Gv4","1536:Gv4Gv4G","1536:v4Gv4Gv","1536:4Gv4Gv4","1536:4Gv4Gvn","1536:Gv4Gvnl","1536:v4Gvnlt","1536:4Gvnltb","1536:Gvnltbn","1536:vnltbnV","1536:nltbnVT","1536:ltbnVTg","1536:tbnVTgM","1536:bnVTgMj"],"imphash":"ba2e50054f96ef19615e4e590484b2e3"},"file_info":{"file_name":"ms_office_update.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":100864,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1508688860000,"last_seen":1662379140000,"last_multi_scan":1662379140000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","chthonic","zeus"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":13,"malicious_count":15,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.nhsed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12510366","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Injector.DDEK-0656","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12510366 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Wauchos.CY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Cthonic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 00512b621 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Agent.hhok","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.adk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wauchos.etzvhj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.MauvaiseRI.S5257136","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Inject-CUM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Backdoor.Trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Banker.CHP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"letit2.bit\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.63.25.55:53\"\n \"5.9.49.12:53\"\n \"87.98.175.85:53\"\n \"141.138.157.53:53\"\n \"45.63.99.180:53\"\n \"45.32.28.232:53\"\n \"108.61.164.218:53\"\n \"45.56.117.118:53\"\n \"23.94.5.133:53\"\n \"51.255.48.78:53\"\n \"35.189.99.49:80\"\n \"144.76.133.38:53\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\{0AC140EE-6B04-692D-0A57-CCDBE577D2BD}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{B7B86AF6-AB5A-1998-B44F-0C1145C7A2AE}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{B345CE8B-063F-FA59-B80F-376008C48F47}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{8AFC80A9-6C82-53BC-A376-B9425FFB740E}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{74FD0CDF-DE18-A5AB-4DF1-B89D8950A2E5}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\{E6CF43EA-DAEA-AE86-A9BA-D190F6F99DE1}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\{495FB90E-48C9-02EB-0375-BA8D4A0AC496}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{18FBEC9B-775F-84C6-DDD7-4027A99C1303}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00028539-00001468) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00028539-00001468) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00014529-00003012)\n Spawned process \"msiexec.exe\" (UID: 00014701-00003140)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"uDebuggingToolsForWindows(x86).exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\msiexec.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"uDebuggingToolsForWindows(x86).exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.40900666154\n 7.40900666154","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"msiexec.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /q/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 880\" with no payload\n \"POST /q/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 912\" with no payload\n \"POST /q/www/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 240\" with no payload\n \"POST /q/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 896\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"msiexec.exe\" called \"OpenService\" to access the \"WinDefend\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"wuauserv\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"WdNisSvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"wscsvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"SharedAccess\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"MpsSvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"SharedAccess\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"MpsSvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"uDebuggingToolsForWindows(x86).exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"UDEBUGGINGTOOLSFORWINDOWS(X86)\"; Value: \"%APPDATA%\\uDebuggingToolsForWindows(x86)\\uDebuggingToolsForWindows(x86).exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoA\n GetModuleHandleA\n LockResource\n GetProcAddress\n FindResourceA\n GetModuleFileNameA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$24","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN TCP DNS Query Domain .bit\" (SID: 2826593, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ETPRO TROJAN Chthonic CnC Beacon 2\" (SID: 2809653, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/67 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/67 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/67 Antivirus vendors marked dropped file \"uDebuggingToolsForWindows(x86).exe\" as malicious (classified as \"QVM07.1.AC83.Malware\" with 19% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/67 Antivirus vendors marked spawned process \"\" (PID: 3012) as malicious (classified as \"QVM07.1.AC83.Malware\" with 19% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00028539-00001468)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2017-10-22.17:58:07.214 (UID: 00028539-00001468)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 12 (or more) hosts in at least 3 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wuauserv\" (Indicator: \"wuauserv\")\n \"wscsvc\" (Indicator: \"wscsvc\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"msiexec.exe\" called \"OpenService\" to access the \"WinDefend\" service (\"Windows Defender\")\n \"msiexec.exe\" called \"OpenService\" to access the \"wuauserv\" service (\"Windows Update\")\n \"msiexec.exe\" called \"OpenService\" to access the \"wscsvc\" service (\"Windows Security Center\")\n \"msiexec.exe\" called \"OpenService\" to access the \"MpsSvc\" service (\"Windows Firewall\")","origin":"API Call","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"level":"malicious","category":"System Security","name":"Sent a control code to a critical system service","description":"\"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\" (\"Windows Defender\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\" (\"Windows Update\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\" (\"Windows Security Center\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"MpsSvc\" (\"Windows Firewall\")","origin":"API Call","relevance":10,"id":"api-78","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the windows product ID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["banker","chthonic","zeus"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59ecc1d17ca3e11de5460985","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM07.1.AC83.Malware","contacted_countries":["DEU","FRA","USA"],"submit_name":"ms_office_update.exe","analysis_start_time":"2017-10-22T17:02:56+00:00","indicators_count":{"informative":8,"suspicious":14,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.63.25.55","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"5.9.49.12","port":53,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"87.98.175.85","port":53,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"141.138.157.53","port":53,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"45.63.99.180","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"45.32.28.232","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"108.61.164.218","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"45.56.117.118","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"23.94.5.133","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"51.255.48.78","port":53,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"35.189.99.49","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"address":"144.76.133.38","port":53,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}],"dns_resolutions":[{"domain":"letit2.bit","address":"35.189.99.49","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}],"http_requests":[{"host":"letit2.bit","host_ip":"35.189.99.49:80","url":"/q/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /q/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 880","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"host":"letit2.bit","host_ip":"35.189.99.49:80","url":"/q/www/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /q/www/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 240","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}],"processes":[{"pid":2936,"ppid":0,"name":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe","command_line":"","sha256":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","normalized_path":"C:\\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe","uid":"00014437-00002936","icon":"$28"},{"pid":3012,"ppid":2936,"name":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe","command_line":"","sha256":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","normalized_path":"C:\\7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b.exe","parent_uid":"00014437-00002936","uid":"00014529-00003012","icon":"$29"},{"pid":3140,"ppid":3012,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00014529-00003012","uid":"00014701-00003140","icon":"$2a"},{"pid":1468,"ppid":3140,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00014701-00003140","uid":"00028539-00001468","icon":"$2b"}],"all_imported_dlls":["cryptbase.dll","Wldap32.dll","mswsock.dll","WSHTCPIP.DLL","apphelp.dll","advapi32.dll","profapi.dll","AcGenral.dll","iertutil.dll","dnsapi.dll","nsi.dll","oleaut32.dll","kernel32.dll","msvcrt.dll","gdi32.dll","lpk.dll","sspicli.dll","cfgmgr32.dll","devobj.dll","rpcrt4.dll","userenv.dll","ws2_32.dll","psapi.dll","sechost.dll","msacm32.dll","dwmapi.dll","crypt32.dll","secur32.dll","ntmarta.dll","IPHLPAPI.DLL","ole32.dll","winmm.dll","urlmon.dll","rpcss.dll","winnsi.dll","uxtheme.dll","msi.dll","AcLayers.dll","user32.dll","imm32.dll","msctf.dll","sfc.dll","sfc_os.dll","ntdll.dll","KernelBase.dll","usp10.dll","shlwapi.dll","shell32.dll","mpr.dll","samcli.dll","version.dll","setupapi.dll","wininet.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"uDebuggingToolsForWindows(x86).exe","sha256":"7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%APPDATA%\\uDebuggingToolsForWindows(x86)","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\UDEBUGGINGTOOLSFORWINDOWS(X86)\\","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\ADOBER\\","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861F\\7BE8966DF205B91F95F3C56EF972BE0264B35C865450FB69B9861F","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{0AC140EE-6B04-692D-0A57-CCDBE577D2BD}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{B7B86AF6-AB5A-1998-B44F-0C1145C7A2AE}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{B345CE8B-063F-FA59-B80F-376008C48F47}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{8AFC80A9-6C82-53BC-A376-B9425FFB740E}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{74FD0CDF-DE18-A5AB-4DF1-B89D8950A2E5}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{E6CF43EA-DAEA-AE86-A9BA-D190F6F99DE1}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{495FB90E-48C9-02EB-0375-BA8D4A0AC496}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{18FBEC9B-775F-84C6-DDD7-4027A99C1303}","sources":[{"report_type":"sandbox","report_id":"59ecc1d17ca3e11de5460985"}]}]}},"report_ids":{"sandbox_job_ids":["59ecc1d17ca3e11de5460985"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7be8966df205… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7be8966df205…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 15 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7be8966df205… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7be8966df205…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 15 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7be8966df205b91f95f3c56ef972be0264b35c865450fb69b9861fd82748e69b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7be8966df205… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7be8966df205…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 15 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]