24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 85045d9898d2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 85045d9898d2…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516"],"about":{"@type":"SoftwareApplication","name":"bounty-14321970328608663","applicationCategory":["elf","64bits","executable"],"identifier":"85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T590,Calls a syscall: "clone" Calls a syscall: "execve" Calls a syscall: "brk" Calls a syscall: "arch_prctl" Calls a syscall: "access" Calls a syscall: "openat" Calls a syscall: "fstat" Calls a syscall: "mmap" Calls a syscall: "close" Calls a syscall: "read" Calls a syscall: "pread" Calls a syscall: "mprotect" Calls a syscall: "munmap" Calls a syscall: "set_tid_address" Calls a syscall: "set_robust_list" Calls a syscall: "rt_sigaction" Calls a syscall: "rt_sigprocmask" Calls a syscall: "readlink" Calls a syscall: "stat" Calls a syscall: "getrandom" Calls a syscall: "sysinfo" Calls a syscall: "lseek" Calls a syscall: "sigaltstack" Calls a syscall: "getdents64" Calls a syscall: "fcntl" Calls a syscall: "ioctl" Calls a syscall: "dup" Calls a syscall: "lstat" Calls a syscall: "gettid" Calls a syscall: "write" Calls a syscall: "exit_group" Calls a syscall: "procexit" Calls a syscall: "open" Calls a syscall: "create" Calls a syscall: "umask" Calls a syscall: "setsid" Calls a syscall: "socket" Calls a syscall: "chdir" Calls a syscall: "getpid" Calls a syscall: "clock_nanosleep" Calls a syscall: "uname" Calls a syscall: "pipe" Calls a syscall: "wait4" Calls a syscall: "bind" Calls a syscall: "getsockname" Calls a syscall: "sendto" Calls a syscall: "recvmsg" Calls a syscall: "geteuid" Calls a syscall: "getcwd" Calls a syscall: "socketpair" Calls a syscall: "connect"26:Tdea,Found reference to API "libpthread.so.0" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_mutex_destroy" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "recvfrom" (Indicator: "recvfrom"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_mutex_init" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_mutex_lock" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "accept" (Indicator: "accept"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "fcntl" (Indicator: "fcntl"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_create" (Indicator: "creat"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_create" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_join" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "connect" (Indicator: "connect"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_detach" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "sendto" (Indicator: "sendto"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "pthread_mutex_unlock" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "lseek" (Indicator: "lseek"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "dlclose" (Indicator: "close"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "dlopen" (Indicator: "open"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "socket" (Indicator: "socket"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "gmtime_r" (Indicator: "time"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "readdir" (Indicator: "read"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "fopen" (Indicator: "open"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "closedir" (Indicator: "close"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "listen" (Indicator: "listen"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "select" (Indicator: "select"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "socketpair" (Indicator: "socket"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "socketpair" (Indicator: "socketpair"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516") Found reference to API "popen" (Indicator: "open"; File: "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790350545730,"unified_at":"2026-09-25T15:35:45.730Z","metadata":{"hashes":{"sha256":"85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516","sha1":"5aac78b6ee9784d9d021b2e326adcdd770d1bd2a","md5":"cab3948912818c6a44a52ed44017b43a","sha512":"4e3a231d70d23bfca33d096cfc67d4290b81e60faa6436184a5481e9445790573dab1a7cc8c275cd04db070d127029c4fcc7765bf11daef7c0aabf71fde8d0c6","ssdeep":"49152:zqRjxOptt99eGf6a9yr9wKA0H3FgmAyB7fCu/AiMa6ITTCba0eFY1tKd3TR1y1+H:WRNOff6KyhA0H1cyBzZnMa6QCba0eFYy","ssdeep_chunks":["49152:zqRjxOp","49152:qRjxOpt","49152:RjxOptt","49152:jxOptt9","49152:xOptt99","49152:Optt99e","49152:ptt99eG","49152:tt99eGf","49152:t99eGf6","49152:99eGf6a","49152:9eGf6a9","49152:eGf6a9y","49152:Gf6a9yr","49152:f6a9yr9","49152:6a9yr9w","49152:a9yr9wK","49152:9yr9wKA","49152:yr9wKA0","49152:r9wKA0H","49152:9wKA0H3","49152:wKA0H3F","49152:KA0H3Fg","49152:A0H3Fgm","49152:0H3FgmA","49152:H3FgmAy","49152:3FgmAyB","49152:FgmAyB7","49152:gmAyB7f","49152:mAyB7fC","49152:AyB7fCu","49152:yB7fCu/","49152:B7fCu/A","49152:7fCu/Ai","49152:fCu/AiM","49152:Cu/AiMa","49152:u/AiMa6","49152:/AiMa6I","49152:AiMa6IT","49152:iMa6ITT","49152:Ma6ITTC","49152:a6ITTCb","49152:6ITTCba","49152:ITTCba0","49152:TTCba0e","49152:TCba0eF","49152:Cba0eFY","49152:ba0eFY1","49152:a0eFY1t","49152:0eFY1tK","49152:eFY1tKd","49152:FY1tKd3","49152:Y1tKd3T","49152:1tKd3TR","49152:tKd3TR1","49152:Kd3TR1y","49152:d3TR1y1","49152:3TR1y1+","49152:TR1y1+H","98304:zqRjxOp","98304:qRjxOpt","98304:RjxOptt","98304:jxOptt9","98304:xOptt99","98304:Optt99e","98304:ptt99eG","98304:tt99eGf","98304:t99eGf6","98304:99eGf6a","98304:9eGf6a9","98304:eGf6a9y","98304:Gf6a9yr","98304:f6a9yr9","98304:6a9yr9w","98304:a9yr9wK","98304:9yr9wKA","98304:yr9wKA0","98304:r9wKA0H","98304:9wKA0H3","98304:wKA0H3F","98304:KA0H3Fg","98304:A0H3Fgm","98304:0H3FgmA","98304:H3FgmAy","98304:3FgmAyB","98304:FgmAyB7","98304:gmAyB7f","98304:mAyB7fC","98304:AyB7fCu","98304:yB7fCu/","98304:B7fCu/A","98304:7fCu/Ai","98304:fCu/AiM","98304:Cu/AiMa","98304:u/AiMa6","98304:/AiMa6I","98304:AiMa6IT","98304:iMa6ITT","98304:Ma6ITTC","98304:a6ITTCb","98304:6ITTCba","98304:ITTCba0","98304:TTCba0e","98304:TCba0eF","98304:Cba0eFY","98304:ba0eFY1","98304:a0eFY1t","98304:0eFY1tK","98304:eFY1tKd","98304:FY1tKd3","98304:Y1tKd3T","98304:1tKd3TR","98304:tKd3TR1","98304:Kd3TR1y","98304:d3TR1y1","98304:3TR1y1+","98304:TR1y1+H","49152:WRNOff6","49152:RNOff6K","49152:NOff6Ky","49152:Off6Kyh","49152:ff6KyhA","49152:f6KyhA0","49152:6KyhA0H","49152:KyhA0H1","49152:yhA0H1c","49152:hA0H1cy","49152:A0H1cyB","49152:0H1cyBz","49152:H1cyBzZ","49152:1cyBzZn","49152:cyBzZnM","49152:yBzZnMa","49152:BzZnMa6","49152:zZnMa6Q","49152:ZnMa6QC","49152:nMa6QCb","49152:Ma6QCba","49152:a6QCba0","49152:6QCba0e","49152:QCba0eF","49152:ba0eFYy"],"imphash":"Unknown"},"file_info":{"file_name":"bounty-14321970328608663","file_type":["elf","64bits","executable"],"file_type_id":"64-bit elf","file_size":2818000,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1757678479000,"last_seen":1759749004000,"last_multi_scan":1759749004000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":23},"sandbox_signatures":{"informative_count":24,"suspicious_count":5,"malicious_count":3,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Linux.NukeSped.f","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"LINUX/AVI.Lazarus.fqgnm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.38912608","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Alevaul_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.38912608 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Linux/NukeSped.F trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!6C7C5F00515B5F04","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Elf64.NukeSped.ldaljg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"ELF/PoolRAT!CAB394891281","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"E64/ABTrojan.ZTCT-","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Unix Shell","attack_id":"T1059.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/004","identifiers":[{"type":"informative","value":"Executes shell scripts"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls native functions (syscalls)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"},{"type":"informative","value":"Contains ability to set the socket options (syscall string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Persistence","technique":"Systemd Service","attack_id":"T1543.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/002","identifiers":[{"type":"malicious","value":"Attempts to daemonize process using system calls"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Defense Evasion","technique":"Linux and Mac File and Directory Permissions Modification","attack_id":"T1222.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/002","identifiers":[{"type":"informative","value":"Sets default file mode creation mask"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Credential Access","technique":"/etc/passwd and /etc/shadow","attack_id":"T1003.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/008","identifiers":[{"type":"suspicious","value":"Reads users database (/etc/passwd file) (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Calls a system call typically used to retrieve the current address to which the socket is bound"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls a system call typically used to get directory entries"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Queries system general information (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads hosts file (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Gets user and/or group ID (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"suspicious","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"suspicious","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Environment Awareness","name":"Gets user and/or group ID (syscall)","description":"/home/ubuntu/85045d9898d28c9 used: geteuid","origin":"API Call","mitre_attack_id":"T1033","id":"api-1004","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"General","name":"Executes shell scripts","description":"/home/ubuntu/85045d9898d28c9 executed: \"sh\" with commandline \"sh -c lsb_release -ds 2>/dev/null\"","origin":"Monitored Target","mitre_attack_id":"T1059.004","relevance":3,"id":"target-5115","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"paxosfuture.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"General","name":"Sets default file mode creation mask","description":"/home/ubuntu/85045d9898d28c9 set umask","origin":"API Call","mitre_attack_id":"T1222.002","id":"api-1147","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"apdl.cf\" has type \"data\"- [targetUID: 81822714-1790]\n \"xweb_log.md\" has type \"ASCII text\"- [targetUID: 81822714-1790]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"sh reads file /lib/x86_64-linux-gnu/libc.so.6\n sh reads file /lib/x86_64-linux-gnu/libpthread.so.0\n sh reads file /lib/x86_64-linux-gnu/libdl.so.2\n sh reads file /lib/x86_64-linux-gnu/libutil.so.1\n sh reads file /lib/x86_64-linux-gnu/libm.so.6\n sh reads file /lib/x86_64-linux-gnu/libexpat.so.1\n sh reads file /lib/x86_64-linux-gnu/libz.so.1\n sh reads file /etc/localtime\n sh reads file /usr/lib/python3.8/encodings/__pycache__/__init__.cpython-38.pyc\n sh reads file /usr/lib/python3.8/__pycache__/codecs.cpython-38.pyc\n sh reads file /usr/lib/python3.8/encodings/__pycache__/aliases.cpython-38.pyc\n sh reads file /usr/lib/python3.8/encodings/__pycache__/utf_8.cpython-38.pyc\n sh reads file /usr/lib/python3.8/encodings/__pycache__/latin_1.cpython-38.pyc\n sh reads file /usr/lib/python3.8/__pycache__/io.cpython-38.pyc\n sh reads file /usr/lib/python3.8/__pycache__/abc.cpython-38.pyc\n sh reads file /usr/lib/python3.8/__pycache__/site.cpython-38.pyc","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"Calls a system call typically used to retrieve the current address to which the socket is bound","description":"/home/ubuntu/85045d9898d28c9 executed: getsockname","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1152","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the socket options (syscall string)","description":"Observed string: \"setsockopt\" (Indicator: \"setsockopt\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-5002","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"paxosfuture.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"paxosfuture.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://h\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"Found string \"libcurl/H\" (Indicator: \"libcurl\"; File: \"85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to get directory entries","description":"sh executed: getdents64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1153","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries system general information (syscall)","description":"sh used: sysinfo\n /home/ubuntu/85045d9898d28c9 used: uname","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1006","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"paxosfuture.com\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"suspicious","category":"Network Related","name":"Reads hosts file (syscall)","description":"85045d9898d28c9 read: /etc/host.conf\n 85045d9898d28c9 read: /etc/hosts","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-1028","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":1,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads users database (/etc/passwd file) (syscall)","description":"85045d9898d28c9 reads: /etc/passwd","origin":"API Call","mitre_attack_id":"T1003.008","relevance":10,"id":"api-1009","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to discard command(s) output","description":"/home/ubuntu/85045d9898d28c9 executed: \"sh\" with commandline \"sh -c lsb_release -ds 2>/dev/null\"","origin":"Monitored Target","relevance":10,"id":"target-5074","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"malicious","category":"Installation/Persistence","name":"Attempts to daemonize process using system calls","description":"/home/ubuntu/85045d9898d28c9 daemonizes itself into background with: setsid","origin":"API Call","mitre_attack_id":"T1543.002","relevance":3,"id":"api-1003","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Multi_POOLRAT\" matched file \"sample.bin\" as \"Detects POOLRAT\" (Author: ditekshen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries system general information (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"68e3a38c04813d271b049581","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516","analysis_start_time":"2025-10-06T11:12:35+00:00","indicators_count":{"informative":24,"suspicious":5,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"paxosfuture.com","country":"-","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}],"processes":[{"pid":1790,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"81822714-1790"},{"pid":1792,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"83682791-1792"},{"pid":1793,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"84392896-1793"},{"pid":1811,"ppid":1793,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"84392896-1793","uid":"20060265-1811"},{"pid":1799,"ppid":1793,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"84392896-1793","uid":"89936012-1799"},{"pid":1803,"ppid":1793,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"84392896-1793","uid":"130404549-1803"},{"pid":1808,"ppid":1793,"name":"sh","command_line":"sh -c lsb_release -ds 2>/dev/null","normalized_path":"sh","parent_uid":"84392896-1793","uid":"166962357-1808"},{"pid":1795,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"84773897-1795"},{"pid":1796,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"85294898-1796"},{"pid":1797,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"85795900-1797"},{"pid":1798,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"88655989-1798"},{"pid":1802,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"129124526-1802"},{"pid":1807,"ppid":0,"name":"85045d9898d28c9","command_line":"","normalized_path":"/home/ubuntu/85045d9898d28c9","uid":"166982407-1807"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"apdl.cf","sha256":"a33942469643ce5d94e099456a457b252df6f6228a9bec4c645e5b711a26bb69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"name":"xweb_log.md","sha256":"74e657f408ccee35de4e1e52402cc7f75f0b53937b1486d655b16bbfae521b5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]}],"files_written":[{"path":"/etc/apdl.cf","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]},{"path":"/tmp/xweb_log.md","sources":[{"report_type":"sandbox","report_id":"68e3a38c04813d271b049581"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["68e3a38c04813d271b049581"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 85045d9898d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 85045d9898d2…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 85045d9898d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 85045d9898d2…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 85045d9898d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 85045d9898d2…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]