24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Hiddentear.A.Generic Sample 8ebcac480103… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8ebcac480103…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9","keywords":["Malicious","Ransom.Hiddentear.A.Generic","malware analysis","sandbox report","threat intelligence","8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9"],"about":{"@type":"SoftwareApplication","name":"Sample_5a55fa0bed9ecc0f9ba445fb.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Hiddentear.A.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T455,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\a28d99c0b82e7decf411fb2587cce83f\System.Management.ni.dll.aux" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" "" touched file "C:\Windows\symbols\exe\brc.pdb" "" touched file "C:\Windows\exe\brc.pdb" "" touched file "C:\Windows\brc.pdb"26:T462,"We have received your payment and will now proceed to decrypt your files.\r\nPlease do not close this window or shut down your computer until the process is finished." (Source: 600003e-form_dec~InitializeComponent, Indicator: "decrypt your files") "Any attempt to decrypt your files or remove this program will render your files unaccessible forever!" (Source: 6000046-form_ran~InitializeComponent, Indicator: "decrypt your files") "We will look into the problem and, if we need your assistance in solving it, send you instructions on how to decrypt your files." (Source: 6000049-HelpForm~InitializeComponent, Indicator: "decrypt your files") "We have received your payment and will now proceed to decrypt your files.Please do not close this window or shut down your computer until the process is finished." (Source: 00040171-00003244.00000000.40672.00E72000.00000020.mdmp, Indicator: "decrypt your files") "he problem and, if we need your assistance in solving it, send you instructions on how to decrypt your files." (Source: 00040171-00003244.00000000.40672.00E72000.00000020.mdmp, Indicator: "decrypt your files")27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAADMzMAAAAAAAAAAAAAAAAId4hzMAAAAAAAAAAAAAAAB4eIgzAAAAAAAAAAAAAAAIgzAIcwAAAAAAAAAAAAAACHMzN3MAAAAAAAAAAAAAAAiHiIgzAAAAAAAAAAd3d3d4iIh3MwAAAAAAAAd3cHd3eIh3dzMAAAAAAHd3d4h3d3CIN3MwAAAAd3N3iIiIc3d3B3czMzAAB3eIiIiIiDMHd3MzMzdzF3iIiIj/+Ig6d3N4h3czdziIiP///4iId3d4iHMzN3M4iI/////4h3eHiIiHd3dzOIiP//+Id3iIh3iIczMzMziIiIh4iIiIiIeIiIN3eHM4eIiI/4iIiPiHiIiDMzMzOIiI//iI//+Ih4iIczd4czAAiIiP/////4eIiIMzNzMwAACIiI/////3iIiHd3dzMAAAAAiIiP+Ih4iIh3MzN3AAAAAAAIiId3hzMzNzeDNwAAAAAACIiIiIc4Mzc3gwAAAAAAAAAAAAAAODAAd3MAAAAAAAAAAAAAADgwAHczAAAAAAAAAAAAAAA3MABzMwAAAAAAAAAAAAAAM3MAMzMAAAAAAAAAAAAAADMzMzMzAAAAAAAAAAAAAAAzMzMzMwAAAAAAAAAAAAAAAzODMzAAAAAAAAAAAAAAAAAzMzMAAAAAAAAAAAAAAAAAAAAAAAD///4P///4B///+Af///DH///wB///8Af/8AAH/8AAB/4AAA/gAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgAAAA+AAAAP8AAAD/4AAA/+AAA///8cP///HD///xw///8MP///AD///wA///+Af///wP/////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791357464414,"unified_at":"2026-10-07T07:17:44.414Z","metadata":{"hashes":{"sha256":"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9","sha1":"4409ce6af0262f42cdae218e1f52bf2042c33b82","md5":"9fe1deee2cbd64cc6ce51564c89ffdb0","sha512":"09243f68d9d0cf75318c7fe390860e2c889e8a2e1c4df35d26e6a24b8f529d4b264ec0bdd801acfc495d61282cbed9a61b44b45952055fd44ce0532c7cef0935","ssdeep":"6144:6+vEE2V112idzOqd2V112idzOqI2V112idzOqz2V112idzOqc2V112idzOqHmZoU:fCJhdCJhICJhzCJhcCJhH3LcICJZ","ssdeep_chunks":["6144:6+vEE2V","6144:+vEE2V1","6144:vEE2V11","6144:EE2V112","6144:E2V112i","6144:2V112id","6144:V112idz","6144:112idzO","6144:12idzOq","6144:2idzOqd","6144:idzOqd2","6144:dzOqd2V","6144:zOqd2V1","6144:Oqd2V11","6144:qd2V112","6144:d2V112i","6144:2idzOqI","6144:idzOqI2","6144:dzOqI2V","6144:zOqI2V1","6144:OqI2V11","6144:qI2V112","6144:I2V112i","6144:2idzOqz","6144:idzOqz2","6144:dzOqz2V","6144:zOqz2V1","6144:Oqz2V11","6144:qz2V112","6144:z2V112i","6144:2idzOqc","6144:idzOqc2","6144:dzOqc2V","6144:zOqc2V1","6144:Oqc2V11","6144:qc2V112","6144:c2V112i","6144:2idzOqH","6144:idzOqHm","6144:dzOqHmZ","6144:zOqHmZo","6144:OqHmZoU","12288:6+vEE2V","12288:+vEE2V1","12288:vEE2V11","12288:EE2V112","12288:E2V112i","12288:2V112id","12288:V112idz","12288:112idzO","12288:12idzOq","12288:2idzOqd","12288:idzOqd2","12288:dzOqd2V","12288:zOqd2V1","12288:Oqd2V11","12288:qd2V112","12288:d2V112i","12288:2idzOqI","12288:idzOqI2","12288:dzOqI2V","12288:zOqI2V1","12288:OqI2V11","12288:qI2V112","12288:I2V112i","12288:2idzOqz","12288:idzOqz2","12288:dzOqz2V","12288:zOqz2V1","12288:Oqz2V11","12288:qz2V112","12288:z2V112i","12288:2idzOqc","12288:idzOqc2","12288:dzOqc2V","12288:zOqc2V1","12288:Oqc2V11","12288:qc2V112","12288:c2V112i","12288:2idzOqH","12288:idzOqHm","12288:dzOqHmZ","12288:zOqHmZo","12288:OqHmZoU","6144:fCJhdCJ","6144:CJhdCJh","6144:JhdCJhI","6144:hdCJhIC","6144:dCJhICJ","6144:CJhICJh","6144:JhICJhz","6144:hICJhzC","6144:ICJhzCJ","6144:CJhzCJh","6144:JhzCJhc","6144:hzCJhcC","6144:zCJhcCJ","6144:CJhcCJh","6144:JhcCJhH","6144:hcCJhH3","6144:cCJhH3L","6144:CJhH3Lc","6144:JhH3LcI","6144:hH3LcIC","6144:H3LcICJ","6144:3LcICJZ"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Sample_5a55fa0bed9ecc0f9ba445fb.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":525824,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1515872553000,"last_seen":1690594493000,"last_multi_scan":1690594493000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","ransomware"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":7,"malicious_count":2,"total":16},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Lazagcrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.Lazagcrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hiddentear.A.50580B72","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hiddentear.A.50580B72 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.BIL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.LockFile.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005237891 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ric.exayxx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.CB5216D9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.CB5216D9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptoTear.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.980738","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Hiddentear.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"e:\\Projects\\brc\\brc\\obj\\x86\\Release\\brc.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6D3E0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 6ACC0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Org.BouncyCastle.Math.EC\"\n Heuristic match: \"wfmmp8@sigaint.org\"\n Heuristic match: \"anycoindirect.eu\"\n Pattern match: \"https://disk.swissdisk.com/tifu17/\"\n Pattern match: \"https://anycoindirect.eu/en/buy/bitcoins\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"If you're not familiar with bitcoins, you can buy them via PayPal or bank transfer at:\" (Indicator: \"paypal\")\n \"iar with bitcoins, you can buy them via PayPal or bank transfer at:\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe.bin\" was detected as \".NET executable\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00040171-00003244-00000105-92170644","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.34406972817\n 7.452143832","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_Processor\" (Indicator: \"win32_process\"; File: \"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe.bin\")\n \"Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe.bin\")\n \"Win32_BaseBoard\" (Indicator: \"win32_baseboard\"; File: \"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$26","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"27/67 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"27/67 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","ransomware"],"sandbox_reports":[{"id":"5a5a5fc77ca3e145e4390183","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.Hiddentear.A","submit_name":"Sample_5a55fa0bed9ecc0f9ba445fb.bin","analysis_start_time":"2018-01-13T20:36:57+00:00","indicators_count":{"informative":7,"suspicious":7,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}],"processes":[{"pid":3244,"ppid":0,"name":"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe","command_line":"","sha256":"8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9","normalized_path":"C:\\8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe","uid":"00040171-00003244","icon":"$27"}],"all_imported_dlls":["System.ni.dll","System.Drawing.ni.dll","ntdll.dll","mscoree.dll","msvcrt.dll","sechost.dll","mscoreei.dll","msctf.dll","wmiutils.dll","wbemprox.dll","mscorlib.ni.dll","rpcss.dll","cryptbase.dll","clrjit.dll","wbemcomn.dll","nsi.dll","fastprox.dll","rpcrt4.dll","clr.dll","msvcr120_clr0400.dll","WMINet_Utils.dll","ws2_32.dll","KernelBase.dll","shlwapi.dll","imm32.dll","oleaut32.dll","rsaenh.dll","clbcatq.dll","usp10.dll","cryptsp.dll","nlssorting.dll","user32.dll","mscorlib.dll","wbemsvc.dll","ntdsapi.dll","mscorrc.dll","kernel32.dll","advapi32.dll","ole32.dll","System.Windows.Forms.ni.dll","System.Management.ni.dll","RpcRtRemote.dll","bcrypt.dll","diasymreader.dll","gdi32.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"C:\\8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe.config","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"C:\\8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9.exe","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"C:\\brc.pdb","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\symbols\\exe\\brc.pdb","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\exe\\brc.pdb","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]},{"path":"%WINDIR%\\brc.pdb","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a5a5fc77ca3e145e4390183"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a5a5fc77ca3e145e4390183"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Hiddentear.A.Generic Sample 8ebcac480103… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8ebcac480103…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Hiddentear.A.Generic Sample 8ebcac480103… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8ebcac480103…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8ebcac480103e4adcddde5602db27fc0949386f8134d034aa0896b9cb08110b9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Hiddentear.A.Generic Sample 8ebcac480103… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8ebcac480103…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]