21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tool.Support Sample 84f02fc0d878… — Score 51/100 — Hybrid Analysis","description":"Malicious verdict for sample 84f02fc0d878…. Malware family: Tool.Support. Threat score 51/100. 1/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed","keywords":["Malicious","Tool.Support","malware analysis","sandbox report","threat intelligence","84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed"],"about":{"@type":"SoftwareApplication","name":"84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin","applicationCategory":["peexe","executable"],"identifier":"84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed","additionalType":"Malicious sample"},"threatScore":51,"malwareFamily":"Tool.Support","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T2174,"" (Indicator: "GetDC"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002536.00000000.144620.033C0000.00000004.mdmp")2c:T79c,Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-84-00404DA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-84-00404DA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-350-004097C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-350-004097C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-411-004057BD Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-411-004057BD Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-412-00405664 Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-412-00405664 Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-413-004056BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-413-004056BA Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-458-00408882 Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-458-00408882 Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-459-0040849D Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-459-0040849D Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-460-0040866A Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-460-0040866A Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-461-0040857C Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-461-0040857C Assembly shows XOR instruction xor eax ebp in Stream UID: 19341-462-00408207 Assembly shows XOR instruction xor ecx ebp in Stream UID: 19341-462-00408207 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 19341-495-0040A285 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 19341-495-0040A285 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 19341-495-0040A285 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 19341-495-0040A2852d:Tb62,Pattern match: "www.digicert.com110/" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0l" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0n" Pattern match: "cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0o" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "crl.globalsign.com/gs/gstimestampingg2.crl0t" Pattern match: "secure.globalsign.com/cacert/gstimestampingg2.crt0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0" Pattern match: "https://91.206.169.134/bin/screenconnect.client.application?i=&e=support&y=guest&r=" Heuristic match: "pathext=.com;.exe;.bat;.cm" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0p" Pattern match: "www.digicert.com1+0" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl07" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0j" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0h" Pattern match: "http://cacerts.digicert.com/digicertevcodesigningca-sha2.crt0" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0k" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "www.digicert.com1.0" Pattern match: "http://crl3.digicert.com/assured-cs-g1.crl00" Pattern match: "http://crl4.digicert.com/assured-cs-g1.crl0l" Pattern match: "http://ocsp.digicert.com0l" Pattern match: "http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0" Pattern match: "http://ocsp.digicert.com0i" Pattern match: "http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02" Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0" Pattern match: "http://ocsp.digicert.com0o" Pattern match: "cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0" Pattern match: "digicert.com/digicertassuredidrootca.crl0o" Pattern match: "https://www.glod" Pattern match: "https://www.globalsign.com/repos"2e:T5e8,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002536.00000000.144620.00E1C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002536.00000000.144620.00E1C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002536.00000000.144620.00E1C000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002536.00000000.144620.00E1C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002536.00000000.144620.00E1C000.00000002.mdmp")2f:Tc6f,"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002536.00000000.144620.033C0000.00000004.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699c12db3dd4ef8de30b4982","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002536.00000000.144620.033C0000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699c12db3dd4ef8de30b4982","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\" Microsoft Corporation\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"699c12db3dd4ef8de30b4982","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature to detect screenconnect RMM tool file \"sample.bin\"","id":"yara-557","level":"suspicious","mitre_attack_id":"T1219","name":"YARA signature match - RMM tools","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"699c12db3dd4ef8de30b4982","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":43},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":97,"malicious_count":1,"suspicious_count":6,"total":104}},"summary":{"score":51,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed.bin","file_size":86408,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"1273eaec87da7c0a308253f29e7857eb","md5":"b1766075a9efaeae98c32d632aab68bf","sha1":"38e4a306066c770487a7819216cedc6c865d4583","sha256":"84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed","sha512":"b77afcecb994110efb60828e71a08e1a43e090a7a3290a7e18931970a33742569aaa4af5ac0914af9050a127370eaa1ae92e052403e650923d9c43d77ab59e90","ssdeep":"1536:HXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvx:XE3x5KBDYiKWm/iSw0fRMvygJ","ssdeep_chunks":["1536:HXn1JYS","1536:Xn1JYSn","1536:n1JYSnE","1536:1JYSnEx","1536:JYSnExF","1536:YSnExFk","1536:SnExFkc","1536:nExFkcg","1536:ExFkcgK","1536:xFkcgKK","1536:FkcgKKj","1536:kcgKKjx","1536:cgKKjxf","1536:gKKjxfm","1536:KKjxfmq","1536:Kjxfmqs","1536:jxfmqsh","1536:xfmqshi","1536:fmqshiK","1536:mqshiKW","1536:qshiKW5","1536:shiKW5X","1536:hiKW5Xs","1536:iKW5Xs/","1536:KW5Xs/i","1536:W5Xs/iY","1536:5Xs/iYQ","1536:Xs/iYQq","1536:s/iYQqQ","1536:/iYQqQJ","1536:iYQqQJt","1536:YQqQJts","1536:QqQJtsW","1536:qQJtsWF","1536:QJtsWFc","1536:JtsWFcd","1536:tsWFcdf","1536:sWFcdfR","1536:WFcdfRM","1536:FcdfRMv","1536:cdfRMvb","1536:dfRMvb+","1536:fRMvb+x","1536:RMvb+xW","1536:Mvb+xWv","1536:vb+xWvx","3072:HXn1JYS","3072:Xn1JYSn","3072:n1JYSnE","3072:1JYSnEx","3072:JYSnExF","3072:YSnExFk","3072:SnExFkc","3072:nExFkcg","3072:ExFkcgK","3072:xFkcgKK","3072:FkcgKKj","3072:kcgKKjx","3072:cgKKjxf","3072:gKKjxfm","3072:KKjxfmq","3072:Kjxfmqs","3072:jxfmqsh","3072:xfmqshi","3072:fmqshiK","3072:mqshiKW","3072:qshiKW5","3072:shiKW5X","3072:hiKW5Xs","3072:iKW5Xs/","3072:KW5Xs/i","3072:W5Xs/iY","3072:5Xs/iYQ","3072:Xs/iYQq","3072:s/iYQqQ","3072:/iYQqQJ","3072:iYQqQJt","3072:YQqQJts","3072:QqQJtsW","3072:qQJtsWF","3072:QJtsWFc","3072:JtsWFcd","3072:tsWFcdf","3072:sWFcdfR","3072:WFcdfRM","3072:FcdfRMv","3072:cdfRMvb","3072:dfRMvb+","3072:fRMvb+x","3072:RMvb+xW","3072:Mvb+xWv","3072:vb+xWvx","1536:XE3x5KB","1536:E3x5KBD","1536:3x5KBDY","1536:x5KBDYi","1536:5KBDYiK","1536:KBDYiKW","1536:BDYiKWm","1536:DYiKWm/","1536:YiKWm/i","1536:iKWm/iS","1536:KWm/iSw","1536:Wm/iSw0","1536:m/iSw0f","1536:/iSw0fR","1536:iSw0fRM","1536:Sw0fRMv","1536:w0fRMvy","1536:0fRMvyg","1536:fRMvygJ"]},"submissions":{"first_seen":1771764571000,"last_multi_scan":1771836124000,"last_seen":1771836124000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["699c12db3dd4ef8de30b4982"]},"schema_version":"1.0.9","sha256":"84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed","threat_score":51,"unified_at":"2026-09-18T22:58:52.696Z","unified_at_epoch_ms":1789772332696,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Tool.Support Sample 84f02fc0d878… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 84f02fc0d878…. Malware family: Tool.Support. Threat score 51/100. 1/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed"}],["$","meta","4",{"property":"og:title","content":"Malicious Tool.Support Sample 84f02fc0d878… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 84f02fc0d878…. Malware family: Tool.Support. Threat score 51/100. 1/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/84f02fc0d878c124a2b324b7ea04ca36265cd87667f7a6af5f39a266068886ed"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Tool.Support Sample 84f02fc0d878… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 84f02fc0d878…. Malware family: Tool.Support. Threat score 51/100. 1/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]