24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ea,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Suspicious:TrojanDrop.Agent.A.gaau Sample 8d330aabb2f7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8d330aabb2f7…. Malware family: Suspicious:TrojanDrop.Agent.A.gaau. Threat score 100/100. 19/27 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494","keywords":["Malicious","Suspicious:TrojanDrop.Agent.A.gaau","malware analysis","sandbox report","threat intelligence","8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494"],"about":{"@type":"SoftwareApplication","name":"4013563150234652.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Suspicious:TrojanDrop.Agent.A.gaau","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6e7,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Updater.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Updater.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "Updater.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "Updater.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "Updater.exe.bin" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "Updater.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Updater.exe.bin"26:T2af6,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "8d330aabb2f7c7ca00d5ace55110f7d4f977f2bae53f5605f2bf4230b19eb494.bin") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Updater.exe.bin") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "Updater.exe.bin") file/memory contains long string with (Indicator: "Rijndael"; File: "Updater.exe.bin") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "Updater.exe.bin") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "Updater.exe.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp")27:T425,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: YARA signature match - AES encryption28:T460,file/memory contains long string(File: "Updater.exe.bin") Found string "get_UserName" (Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found string "get_OSVersion" (Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found string "get_Is64BitOperatingSystem" (Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found string "get_MachineName" (Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found string "GetDrives" (Source: "00000000-00000924.00000000.138764.00E92000.00000002.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp") Found string "UserName" (Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp")29:T9f2,"" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000924.00000000.138764.032C0000.00000004.mdmp, 00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.032C0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.032C0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.032C0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp, 00000000-00000924.00000001.140686.054D0000.00000004.mdmp, 00000000-00000924.00000002.142607.054D0000.00000004.mdmp, 00000000-00000924.00000003.148113.054D0000.00000004.mdmp")41:T892,"" (Indicator: "password"; Source: "00000000-00000924.00000000.138764.054D0000.00000004.mdmp")44:Ta14,"