21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Yakes Sample 921b66193ecc… — Score 96/100 — Hybrid Analysis","description":"Malicious verdict for sample 921b66193ecc…. Malware family: Trojan.Yakes. Threat score 96/100. 21/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc","keywords":["Malicious","Trojan.Yakes","malware analysis","sandbox report","threat intelligence","921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc"],"about":{"@type":"SoftwareApplication","name":"305606748216_6296395166.exe","applicationCategory":["peexe","executable"],"identifier":"921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc","additionalType":"Malicious sample"},"threatScore":96,"malwareFamily":"Trojan.Yakes","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T51b,"svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")23:T45b,"svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")24:Td84,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAm4SURBVFhHjVdrcFTlGY6KglSLiiEXLiFEBIJFWzvTWv3hFAkE29qxF0frDHU6rT/a6lQ7tWpRQQyigEUlmmCoNxQQ2yJEwBESQtIQNrfdDbkRJyTsJns7e+7n7O45m6fPd0I77XTcNJl3vnO+c873Pu/zPt/7vZuXl+NvfGwU4+ERhEJfYCQ0hAtjQwhdGEI4NIwLHEc5hjg/Fh7G+NgITbx/HhFeDw8PwIXjWS4f3rPTxTfj9Pxbcebab6CpeAV8RbegffNm+DdsRs+mreh9djt8VS+j8/lt8D9Ne2ozup7bjmDVq+havxUBPg/w/uzGlxDc8Ao6n9mCnt8/h7aTbUhEErDSdm4Qp+avwD+Kb0Jr0XI0zrsJvjnlaJ5ejGOXzEbjFUVonD4XJ2YU4VRePlqnzUHT1WU4MbMQDdMK0HB5IVq/WoqWmfNxakYJxwVouboUvrwCHK6vR2d7G9JpC+lM6stBHCOAz+eWe9Y072Z0/XEjLABZWvzcEE7/5glM8N/hvdQRRONVZYiOh6CZCgxDw6Er5+KzBcvx+YJlODJ3CT4rXY6GryxC44mTqKndyq9AEBm42S9Jx+GSFagvWoIjJcvwSUk5uh/fAMd1Edy4xfv45P0PIetk0PzzRzxQh/NmIcIcN6xYiaPfXon6BUtQT8dHipbhcPGNOLpwKQ5NX4RTx0/i3dpXMDFB8NkMrJSBjJP+Xyb2Fd2AA/zwo4LF2D+vHC1/WI80I5Y+PeEBOP7gL2BmMqi9dDbsCRe7L82H1tuLyNl+DNUfxcfX34j9hUuwj7Z/DteZvwx7r5yHllMteGdPrbeGADFB+Gmuk+Ua/yXMPdcvxZ7CxXivoAx7y25C0+PrvUhtou2ofQfNDz+KTMbF2zOu95h59ZJZiA0OIrDvIzS+9Bo+mHMD9vL7PcWL8UHBUuydRwAzFsLX2Ir399TBNE0osoy0Y3tgUhwFI/8GsZOo3yosQ83sxdhFJpqeZAr44muX56N2YTmO/fIRbifAZRSxwCDqKMh4JIQ6Crd6zmLU5JfhTYKoKViEnUWLUFO8FLsvL4a/PYDGg/XYuuMZPLHpMfzu4XVY99sH8C5BhUPnoaixSRBb8ktQnb8Q1dctxBscP1r9U7RW70YNxfZGQTk+vP17aPpzLQ6s+zXenH8LtuUvwufcarsKluC12Qvxen4pdl5XiupruMYsGue2z5qLzu5uNB9pQN27O/DmrpdRvWMjqrY/iy07nsaH7+3C6tWVkwBeJwMbri3CtsISvH5NKTb+4Pt4oXItnq1YjU0r1+D5uyqwqWItqu6qxKa1a/DCqko8L6yiAlVrVqGK720R36ypwIsrV2Nbxd2o+tZ3MRINYTgcRrAtCF9LB1qbW3HiWD1aG46jtaUFnV3+3PWhs/UMOn1d6GptR8eZbvg6zqKrzYeurgD3dzeCZ3oQ9AXQ0dyOtn1/ZcR9CIp3unrQweiliISR8VEMjYUxONyHgcE+9A+NwN/nR89AAIODA7kBRMfDzHUYEUYRiY8hGosgyjGZkBDhfDg6ikgyhoGZM9H7p40YfaMWiWQcSjwKSZKQlCXIqoKkrtEM6LIGTVY5p0HVdIRGhnMDSEoqpEQSibiEaGScYCYXTsgKJMXgsygUTcbAnGIMsQwrPj8SkgKVIGSCTKoyAckUmwKTAJKacCxB57XGAhYOXcgNQE6oiCUYNSOPJ2Qk40nEBYBYFEkpgXiS4BiRr6AQfQ8+hLFzfUjoJgEoiMsJKIoEg85VXYdsKNA1BRrN1lWohonw6PncANSkgVg85jmKSTHIpDYWCyPKe4kOEoxSIsjGssUY/uHPMHKyEZaVohNGSMcSHesqQdChxMgN3pu8FmYZBiLUR86TUlZ0JElnIjEOJUEgCh3TkgnmWWGEqkqadYSr63CqYB7i/iBUNwvVZMQ6c68x3wQjIldIv8E5Q7Nh87mdMnl8h6bQgJamU+aRCykSnUoEQNGpSYlRmATHVKhJhLsDqL8sD7oARdpF5ZNIsWHKpFuDJYwgjBRFaGqwLYKxdIp7CgA2aVSoVpN0yxSUQjoThg6LTi2NTHBRk5El+PwI60iIlU92shQZc61bBKkjRfA2AdmWCY1OTTpP2SYPJosnajg3A5YnIJMUUoB0bl6kXeacQWAyc6nRef/OGjRcW4zW+3/l1XrNVCfFR6e6yRQYBGOQ+rTjAbFtngWZNDunKRiQjaS3zZKMRFFIH7ePQQYUQ0VKT8KkGE06/HDaVVDPncPHJUtw/PY7YTANKTJkWgaNUadTdErjSZiyLR5sHDk3JQOyaVGtVLKV9JRsUnS6KCridOO2SnJxkYame+6DxuNqlA1I3WVXeAeZaTHqVAppm5RTcBYjt9w07y247I5EXxCZKgViryrMmcmINZrCrSPMFBRTTKmJDPaziYHrcF9za1Gc4tR8v6gUn6ysYN2QEB8J4YLvNM6zXEtnB2GRyZTt4M7+n7C4TaEBk3m2ubBBIKbYOnSqMXrdSHkOg3t2o/aKq5Fmq2U6rpeO6PAXOPjjddicdwlqb1iGt3jQ7fvOHfjg1tvw/te+iV3lt022d9RDNBLJLUKd20jQJ/Kupal+y+ZWcr0iIxqWF+mk/28HcLDyPnxa8QDGAn6oQ+cx2XYABstyB2tEXdlyvDy3FCMNzRjt6WSKJrznU4pQF9vFNigggmBOM2ILEUQ6m2JVjGA/j+bjj6338p++6FQAM5kS22a+eS3uQx1+HHr0KRy890d4u/IejPraoY+JqirnZkBEb4pulgpOE4jA3cMOJ3DgCCmegQw7JIuHkptxyFQKLt91WAdcVsMshWZnbKRcdoJsyzMMwOF7WbZjQ80tMENjFOEU2zCTspHhdkkRQMZxUP/kk/hL5b2o+fod2LvqbrJjeY4yLkGKqKlsoXCH1y676Ax14XB0shypE4druHxHMOMynGh0PDcD/J4NJLtYvnzwiafoaAJtH/8d5z455BGe5mIOAbpsWNMOWWLEAkjWmfDYAB27E8w4G1lXGLthce9w9/CKIhzLDSArCggXstUU1rPX6zl0FI/mTfO2WiYlIhKUi+hdghMgHKZFxMYUMA2iiRVjlk4945fCxA8UMf4fAEREaWQZiWmloY6GJukTlYzzDiPNsr12RJQ0L1oRnXCaFQAm54Rz71r8WBUM8BsxTgmAb/ITJiAr5CciEzWHde5ilN6PDTqaoNQ985L1H+b9GOE/H3rzF3+ciOjFfWwqDXwROoe+gV70BHvgP9MPf387enqD6B0Kwt/bCf8ArY/Wf9HEdV+XNxcUc+L+X+94zyYtQOvu60CgcwD/BE1ZuApjFRrUAAAAAElFTkSuQmCC18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":96,"unified_at_epoch_ms":1790265738883,"unified_at":"2026-09-24T16:02:18.883Z","metadata":{"hashes":{"sha256":"921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc","sha1":"e1fc0af4a7117692e7843bb06915fc303f07433a","md5":"3da3fc4dd870bf747c77f6afa968389e","sha512":"6d38761865391d4ebbeef48fcaef03571a42bd5715703566b0ce70bb5d7d749134af985ecfbdadf6fe1b9acbe901a78c3be83bd3e0c62dfca8dfbbcb26798578","ssdeep":"384:ItlmIgklF3FiKGRm327EWcp15UVH5edbm6om6KjqtTc0iZYifd4s:Itl5gKhkBcpbU6o6jshQYud","ssdeep_chunks":["384:ItlmIgk","384:tlmIgkl","384:lmIgklF","384:mIgklF3","384:IgklF3F","384:gklF3Fi","384:klF3FiK","384:lF3FiKG","384:F3FiKGR","384:3FiKGRm","384:FiKGRm3","384:iKGRm32","384:KGRm327","384:GRm327E","384:Rm327EW","384:m327EWc","384:327EWcp","384:27EWcp1","384:7EWcp15","384:EWcp15U","384:Wcp15UV","384:cp15UVH","384:p15UVH5","384:15UVH5e","384:5UVH5ed","384:UVH5edb","384:VH5edbm","384:H5edbm6","384:5edbm6o","384:edbm6om","384:dbm6om6","384:bm6om6K","384:m6om6Kj","384:6om6Kjq","384:om6Kjqt","384:m6KjqtT","384:6KjqtTc","384:KjqtTc0","384:jqtTc0i","384:qtTc0iZ","384:tTc0iZY","384:Tc0iZYi","384:c0iZYif","384:0iZYifd","384:iZYifd4","384:ZYifd4s","768:ItlmIgk","768:tlmIgkl","768:lmIgklF","768:mIgklF3","768:IgklF3F","768:gklF3Fi","768:klF3FiK","768:lF3FiKG","768:F3FiKGR","768:3FiKGRm","768:FiKGRm3","768:iKGRm32","768:KGRm327","768:GRm327E","768:Rm327EW","768:m327EWc","768:327EWcp","768:27EWcp1","768:7EWcp15","768:EWcp15U","768:Wcp15UV","768:cp15UVH","768:p15UVH5","768:15UVH5e","768:5UVH5ed","768:UVH5edb","768:VH5edbm","768:H5edbm6","768:5edbm6o","768:edbm6om","768:dbm6om6","768:bm6om6K","768:m6om6Kj","768:6om6Kjq","768:om6Kjqt","768:m6KjqtT","768:6KjqtTc","768:KjqtTc0","768:jqtTc0i","768:qtTc0iZ","768:tTc0iZY","768:Tc0iZYi","768:c0iZYif","768:0iZYifd","768:iZYifd4","768:ZYifd4s","384:Itl5gKh","384:tl5gKhk","384:l5gKhkB","384:5gKhkBc","384:gKhkBcp","384:KhkBcpb","384:hkBcpbU","384:kBcpbU6","384:BcpbU6o","384:cpbU6o6","384:pbU6o6j","384:bU6o6js","384:U6o6jsh","384:6o6jshQ","384:o6jshQY","384:6jshQYu","384:jshQYud"],"imphash":"148df7d6ac93af72627f5418240128d2"},"file_info":{"file_name":"305606748216_6296395166.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":38912,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297220000,"last_seen":1677377271000,"last_multi_scan":1677377271000}},"detections":{"summary":{"verdict":"malicious","score":96,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":16,"malicious_count":10,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1215608","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Upatre.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Upatre.DPK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Upatre.FH.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Upatre.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.ECMN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055dd191 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Downloader-FAHF!3DA3FC4DD870","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.dyjbsq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Upatre-VP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_UP.88728D35","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_UP.88728D35","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt_s.JSK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes.Win32.41309","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Yakes","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"CRYPT32.DLL\" at base 769C0000\n \"\" loaded module \"USER32.DLL\" at base 76E80000\n \"\" loaded module \"NTDLL.DLL\" at base 77450000\n \"\" loaded module \"KERNEL32.DLL\" at base 76150000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\APPHELP.DLL\" at base 748B0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"svchost.exe\" (UID: 00186968-00000172)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"SCHEDLGU.TXT\" has type \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\"\n \"setupact.log\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\svchost.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Installation/Persistance","name":"File system monitor detected changes at critical system location","description":"Found a system modification for file \"SCHEDLGU.TXT\" (Context: \"C:\\Windows\\Tasks\\SCHEDLGU.TXT\", Type: \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\", Additional Info: Existing file modified)\n Found a system modification for file \"setupact.log\" (Context: \"C:\\Windows\\setupact.log\", Type: \"ASCII text, with CRLF line terminators\", Additional Info: Existing file modified)","origin":"Binary File","relevance":5,"id":"binary-13","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetCommandLineW\n GetModuleFileNameA\n GetModuleHandleA\n GetStartupInfoA\n GetTickCount\n UnhandledExceptionFilter","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/55 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"svchost.exe\" (PID: 00000172)\n \"\" wrote 52 bytes to a foreign process \"svchost.exe\" (PID: 00000172)\n \"\" wrote 4 bytes to a foreign process \"svchost.exe\" (PID: 00000172)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"myip.dnsomatic.com\"\n \"stun.noc.ams-ix.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.215.92.215:80\"\n \"197.149.90.166:12121\"\n \"92.247.244.122:443\"\n \"93.123.88.180:443\"\n \"31.47.104.149:443\"\n \"80.95.103.167:443\"\n \"80.95.103.138:443\"\n \"88.101.108.254:443\"\n \"173.194.43.73:80\"\n \"91.200.16.56:3478\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nAccept: text/*, application/*\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36\nHost: myip.dnsomatic.com\nCache-Control: no-cache\"\n \"GET /28IT12/0oShZiN8pu/0/61-SP1/0/FDMBEFJBMKBEMM HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36\nHost: 197.149.90.166:12121\nCache-Control: no-cache\"\n \"GET /28IT12/0oShZiN8pu/41/5/1/FDMBEFJBMKBEMM HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36\nHost: 197.149.90.166:12121\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 85 calls to GetProcAddress@KERNEL32.DLL at 00268375-00003728-62707-40-00403F80","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"thlNKxftUKoQKxX.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 91.200.16.56\" with description \"Payload with 20 bytes: 00010000BCB3040021A6FDFF211A4EFB9DA94AFB\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"retrafish.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"thlNKxftUKoQKxX.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"209.126.97.199\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.215.92.215 on port 80 is sent without HTTP header\n TCP traffic to 92.247.244.122 on port 443 is sent without HTTP header\n TCP traffic to 93.123.88.180 on port 443 is sent without HTTP header\n TCP traffic to 31.47.104.149 on port 443 is sent without HTTP header\n TCP traffic to 80.95.103.167 on port 443 is sent without HTTP header\n TCP traffic to 80.95.103.138 on port 443 is sent without HTTP header\n TCP traffic to 88.101.108.254 on port 443 is sent without HTTP header\n TCP traffic to 173.194.43.73 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00268375-00003728-62707-10-004030E0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"retrafish.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"thlNKxftUKoQKxX.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$22","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"1/55 Antivirus vendors marked dropped file \"retrafish.exe\" as malicious (classified as \"QVM07.1.Malware\" with 1% detection rate)\n 1/55 Antivirus vendors marked dropped file \"thlNKxftUKoQKxX.exe\" as malicious (classified as \"QVM07.1.Malware\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"retrafish.exe\" allocated 00000088 bytes of memory in \"thlNKxftUKoQKxX.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"retrafish.exe\" wrote 512 bytes starting with PE header signature to file \"C:\\Windows\\thlNKxftUKoQKxX.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"myip.dnsomatic.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 197.149.90.166 on port 12121","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"svchost.exe\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$23","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":69,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":null,"sample_flags":["Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"5630bdfb0e316de346e1c325","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"suspicious","threat_score":35,"malware_family":"Trojan.Fakedoc","submit_name":"305606748216_6296395166.exe","analysis_start_time":"2015-10-28T07:22:42+00:00","indicators_count":{"informative":4,"suspicious":5,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5630bdfb0e316de346e1c323","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Trojan.Fakedoc","contacted_countries":["BGR","CZE","NGA","NLD","USA"],"submit_name":"305606748216_6296395166.exe","analysis_start_time":"2015-10-28T07:23:23+00:00","indicators_count":{"informative":7,"suspicious":21,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.215.92.215","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"197.149.90.166","port":12121,"protocol":"TCP","country":"Nigeria","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"92.247.244.122","port":443,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"93.123.88.180","port":443,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"31.47.104.149","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"80.95.103.167","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"80.95.103.138","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"88.101.108.254","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"173.194.43.73","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"address":"91.200.16.56","port":3478,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}],"dns_resolutions":[{"domain":"stun.noc.ams-ix.net","address":"91.200.16.56","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"domain":"myip.dnsomatic.com","address":"67.215.92.215","country":"United States","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}],"http_requests":[{"host":"myip.dnsomatic.com","host_ip":"67.215.92.215:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"host":"","host_ip":"192.168.56.15:49159","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"host":"197.149.90.166:12121","host_ip":"197.149.90.166:12121","url":"/28IT12/0oShZiN8pu/0/61-SP1/0/FDMBEFJBMKBEMM","method":"GET","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"host":"197.149.90.166:12121","host_ip":"197.149.90.166:12121","url":"/28IT12/0oShZiN8pu/41/5/1/FDMBEFJBMKBEMM","method":"GET","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}],"processes":[{"pid":2368,"ppid":0,"name":"921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc.exe","command_line":"","normalized_path":"","uid":"00122109-00002368","icon":"$24"},{"pid":1844,"ppid":0,"name":"svchost.exe","command_line":"","normalized_path":"","uid":"00135968-00001844"},{"pid":3728,"ppid":0,"name":"retrafish.exe","command_line":"","normalized_path":"","uid":"00268375-00003728"},{"pid":2020,"ppid":0,"name":"thlNKxftUKoQKxX.exe","command_line":"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\retrafish.exe","normalized_path":"","uid":"00297015-00002020"}],"all_imported_dlls":["CFGMGR32.dll","GDI32.dll","KERNELBASE.dll","CRYPTBASE.dll","OLEAUT32.dll","sechost.dll","uxtheme.dll","USER32.dll","PSAPI.DLL","SHLWAPI.dll","SHELL32.dll","kernel32.dll","profapi.dll","USP10.dll","IMM32.DLL","MSCTF.dll","apphelp.dll","wininet.dll","SETUPAPI.dll","ADVAPI32.dll","DEVOBJ.dll","crypt32.dll","RPCRT4.dll","SspiCli.dll","msvcrt.dll","ntdll.dll","comctl32.dll","LPK.dll","ole32.dll","VERSION.dll","wintrust.dll","rsaenh.dll","Cabinet.dll","dhcpcsvc.DLL","USERENV.dll","CRYPTSP.dll","dnsapi.DLL","winrnr.dll","ws2_32.DLL","mswsock.dll","bcryptprimitives.dll","ntmarta.dll","RASAPI32.dll","cryptnet.dll","NLAapi.dll","wshtcpip.dll","ncrypt.dll","secur32.dll","urlmon.dll","NSI.dll","rasadhlp.dll","WINHTTP.dll","wship6.dll","rtutils.dll","credssp.dll","iphlpapi.DLL","napinsp.dll","CRYPT32.dll","schannel.DLL","pnrpnsp.dll","DEVRTL.dll","dwmapi.dll","GPAPI.dll","sensapi.dll","dhcpcsvc6.DLL","Normaliz.dll","fwpuclnt.dll","COMCTL32.dll","rasman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SCHEDLGU.TXT","sha256":"2db542c0f74830b1a4f1c5c907d8c4b1672226eba80f23002013d1a57e1b75ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"}]},{"name":"retrafish.exe","sha256":"e5e4c1fc51ebdbd6fd31b7a05fb7d7d7da4be9d07fc40bc5e9f7657c518a1894","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"thlNKxftUKoQKxX.exe","sha256":"e5e4c1fc51ebdbd6fd31b7a05fb7d7d7da4be9d07fc40bc5e9f7657c518a1894","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"b2a2d3eae788535705a56cbd9df7e49c011abda1959b9b57c9ec8ad378bc7a62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"eagle2[1].png","sha256":"75e26f1a4582376043d84f9c3bbfd79cfc631a2d5ad040a0ff46cbc6d905cfd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"myip_dnsomatic_com[1].htm","sha256":"a236775d29d4b092b227026c4c42a3f152a4dd44862f4d3786a0c97190f60609","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"CabABE1.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"CabAC70.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"CabC345.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"TarABE2.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"TarAC71.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"TarC356.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}],"files_written":[{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%WINDIR%\\system32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\myip_dnsomatic_com[1].htm","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\eagle2[1].png","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%TEMP%\\retrafish.exe","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%TEMP%\\emp1.txt","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"path":"%WINDIR%\\thlNKxftUKoQKxX.exe","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SVCHOST_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c325"},{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5630bdfb0e316de346e1c323"}]}]}},"report_ids":{"sandbox_job_ids":["5630bdfb0e316de346e1c323","5630bdfb0e316de346e1c325"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Yakes Sample 921b66193ecc… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 921b66193ecc…. Malware family: Trojan.Yakes. Threat score 96/100. 21/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Yakes Sample 921b66193ecc… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 921b66193ecc…. Malware family: Trojan.Yakes. Threat score 96/100. 21/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/921b66193ecc326ab61950157e149567631727835523fc4d38471afcfce5f5fc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Yakes Sample 921b66193ecc… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 921b66193ecc…. Malware family: Trojan.Yakes. Threat score 96/100. 21/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]