188.138.33.220 Checking custom IP address location, whois, time and blacklist.

34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9300e6bbdb4b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9300e6bbdb4b…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c"],"about":{"@type":"SoftwareApplication","name":"http___trinity.glo.pserver.ru_z.exe","applicationCategory":["peexe","executable"],"identifier":"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4a8,Heuristic match: "GET /checkip/ HTTP/1.1User-Agent: AutoItHost: ip-score.com" Pattern match: "http://www.w3.org/TR/html4/loose.dtd" Pattern match: "http://www.ip-score.com/" Pattern match: "www.ip-score.com/" Pattern match: "http://widget.idea.informer.com/tab6.js" Pattern match: "https://apis.google.com/js/plusone.js" Heuristic match: "ip-score.com" Pattern match: "http://www.ip-score.com/scripts/bls_arr.js" Pattern match: "http://www.ip-score" Pattern match: "http://www.ip-score.com/css/style_v3.css" Pattern match: "http://www.ip-score.com/scripts/jquery.min.js" Pattern match: "http://www.ip-score.com/scripts/jquery-ui.min.js" Pattern match: "http://www.ip-score.com/scripts/f_custom_v3.js" Pattern match: "http://www.ip-score.com/scripts/jquery.simpletip-1.3.1.pack.js" Pattern match: "http://www.ip-score.com/checkip/128.84.75.3" Pattern match: "http://www.ip-score.com/checkip/70.104.200.255" Pattern match: "http://www.ip-score.com/checkip/90.81.73.216" Pattern match: "https://ssl" Pattern match: "http://www.liveinternet.ru/click" Pattern match: "counter.yadro.ru/hit?t18.12;r+" Pattern match: "http://s7.addthis.com/js/250/addthis_widget.js#pubid=ipscore"37:T411,"255.255.255.255" Heuristic match: "Germany|iuijep|188.138.33.220|PSPUBWS|WIN_7|X86|No|No|1.0.6|ddd|Pr617X21024X3|Desktop|beta" Heuristic match: "188.138.33.220 Checking custom IP address location, whois, time and blacklist. - loft9159.serverprofi24.de" Heuristic match: "" Heuristic match: "return "188.138.33.220";" Heuristic match: "

188.138.33.220 Germany

" Heuristic match: "

IP range: 188.138.32.0 - 188.138.35.255

" Heuristic match: "

128.84.75.3

" Heuristic match: "

70.104.200.255

" Heuristic match: "

90.81.73.216

"38:T85f,"C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\indexv2[1].php" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\k[1].htm" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\meversion[1]" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\Windows6.1-KB2670838-x86[1].cab" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QIJSVQWS\2017022714175786396[1].jpg" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRW5BOH4\lu_hot_word[1].png" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\bs-components[1].css" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\jslibraries[1]" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022715465019764[1].jpg" for deletion "C:\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\IE11-Windows6.1-KB2841134-x86[1].cab" for deletion39:T5b3,"" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\indexv2[1].php" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\k[1].htm" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\meversion[1]" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QIJSVQWS\2017022714175786396[1].jpg" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRW5BOH4\lu_hot_word[1].png" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\bs-components[1].css" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\jslibraries[1]" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\2017022715465019764[1].jpg" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADO3AVS6\IE11-Windows6.1-KB2841134-x86[1].cab" with delete access3a:T531,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx FindResourceW Process32NextW LockResource GetCommandLineW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto3b:T6cd,Found malicious artifacts related to "95.211.125.236" (ASN: , Owner: ): ... URL: http://ip-score.com/checkip/ (AV positives: 1/66 scanned on 12/17/2017 19:19:16) URL: http://www.ip-score.com/checkip/ (AV positives: 1/66 scanned on 11/29/2017 15:43:42) URL: http://ip-score.com/checkip (AV positives: 2/65 scanned on 06/05/2017 05:08:08) URL: http://www.ip-score.com/sl/sl.xap (AV positives: 1/68 scanned on 01/13/2017 10:57:34) URL: http://www.ip-score.com/checkip (AV positives: 1/68 scanned on 12/06/2016 08:37:56) File SHA256: f0d1ceec4212e51f0f976fe218f3332c5f50fb1a16b4965971ec0d3ef7392f0b (AV positives: 26/68 scanned on 12/18/2017 04:28:33) File SHA256: d9265c0070b62c6101a18f2ebe0843bc3ee28305830228d0c9b343c74b6d48db (AV positives: 33/68 scanned on 12/18/2017 01:07:00) File SHA256: 3036f3516642f260f8d64984f44b050f311dfb2514e275e24fe0fc858b82c7e8 (AV positives: 44/68 scanned on 12/17/2017 16:17:39) File SHA256: 789e77478c48c2456545a6c60ae1fbcf6ae198f797205e30b78e70798fe22652 (AV positives: 21/67 scanned on 12/17/2017 04:17:19) File SHA256: 6e3f6cb795aee808ebad0235080644789b20bfa870dbf87719811c51f1e9c726 (AV positives: 33/66 scanned on 12/17/2017 02:36:04) File SHA256: 326f75d5b708645174894504a5ca968651ba033785dc7bcfa272be9d058a4053 (Scanned on 12/16/2017 17:47:29) File SHA256: 6616f278fe722f7585c201fb5a36f8733d229eda6ad7e69932f18b255db65c9f (Scanned on 12/16/2017 14:50:29) File SHA256: 8a8f862f849005682d7834ae44a4e3c8cbd10273d30ae913a1ece2ff882966ce (Scanned on 12/15/2017 20:33:18) File SHA256: 88306232a929957f09debe5de5cefc46fab5e5bcdae7c5278fae7df2506f551f (Scanned on 12/15/2017 13:52:38) File SHA256: d97ef7b174bce636a4c2f1bde4f6fd1a749ee55f306dbbf3f1bb55c05ff64215 (Scanned on 12/15/2017 04:38:03)3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A1qU4tVYlDTiHNnWGOOhnHVc+ZljGdWvCauUXk4l4Q71Y/leGNnF3aFwQd6e9im7Y53PHIdVZuI1Ze4p47oo2BHOPk4lWeDpTxoJaRrdnJ95oP+locHeHQEWFpHalgmF4bY7Tj5aTZzUmRhDuYX3F56NTyBeZq1ZHuIMOdjh3jbeHw3etNVUtd7fm2MljWLg0PXV4cUt1W4GVRFfX61d159gopYm1aofY5yN3KIXok3fcZaZeNlw3WEmGjseBt4e8mgiKHo5XNY6JJ15VINd+GGcTQlq4c3fYhjV3hmaHhzM36KEAOHeIdytxi3enOHGOU3CO17OFhm4ld9MjMYWH6INyNsid3jZVULaFeLkI11quxnRWflh3Nm6wPX1Wd7m4BogJf3WHp5Rl2X2HuHARc2LnGORb2LXGd+OJGNeHV+OYeNhXh3lnwx5WVnhciONSd1M57nd3dT9t6DdnFna2YWjCzWN1/Xc3N1qxNaejBOh6t4tarolmiOyHBmiG53bX64ZI91NRczWii3iCc4g3tpW4+zZNc1iqiFJOONNm3YW32HVjgnoxEjMziDhtScmb4150eEOIWHfaZTyIfWt+S8dxh9mCXS11VzVVimemwyIlghfohXhHCKhjdKfXZzdVpYvpedNjZ9KOZ3foV1hVfIM4eEecl7V2DfiTN+NnVzgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793951421635,"unified_at":"2026-11-06T07:50:21.635Z","metadata":{"hashes":{"sha256":"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c","sha1":"e3d609d3d1420d104a2b419707ecbdb2aa32ec00","md5":"c64abd344059e7343b16f11f9c8b1661","sha512":"fad09cb7f665319ae7c42bea9589fdc3094333e799bfadb70d44a5e192a5fa45cc6e014f24e760ab6803e8e0dadfa73db149138dffd85ccabfb907dde1250554","ssdeep":"24576:o4lavt0LkLL9IMixoEgeaRhMziX5Cg/rHJnq9MmCS:/kwkn9IMHeaRhMziprFaPCS","ssdeep_chunks":["24576:o4lavt0","24576:4lavt0L","24576:lavt0Lk","24576:avt0LkL","24576:vt0LkLL","24576:t0LkLL9","24576:0LkLL9I","24576:LkLL9IM","24576:kLL9IMi","24576:LL9IMix","24576:L9IMixo","24576:9IMixoE","24576:IMixoEg","24576:MixoEge","24576:ixoEgea","24576:xoEgeaR","24576:oEgeaRh","24576:EgeaRhM","24576:geaRhMz","24576:eaRhMzi","24576:aRhMziX","24576:RhMziX5","24576:hMziX5C","24576:MziX5Cg","24576:ziX5Cg/","24576:iX5Cg/r","24576:X5Cg/rH","24576:5Cg/rHJ","24576:Cg/rHJn","24576:g/rHJnq","24576:/rHJnq9","24576:rHJnq9M","24576:HJnq9Mm","24576:Jnq9MmC","24576:nq9MmCS","49152:o4lavt0","49152:4lavt0L","49152:lavt0Lk","49152:avt0LkL","49152:vt0LkLL","49152:t0LkLL9","49152:0LkLL9I","49152:LkLL9IM","49152:kLL9IMi","49152:LL9IMix","49152:L9IMixo","49152:9IMixoE","49152:IMixoEg","49152:MixoEge","49152:ixoEgea","49152:xoEgeaR","49152:oEgeaRh","49152:EgeaRhM","49152:geaRhMz","49152:eaRhMzi","49152:aRhMziX","49152:RhMziX5","49152:hMziX5C","49152:MziX5Cg","49152:ziX5Cg/","49152:iX5Cg/r","49152:X5Cg/rH","49152:5Cg/rHJ","49152:Cg/rHJn","49152:g/rHJnq","49152:/rHJnq9","49152:rHJnq9M","49152:HJnq9Mm","49152:Jnq9MmC","49152:nq9MmCS","24576:/kwkn9I","24576:kwkn9IM","24576:wkn9IMH","24576:kn9IMHe","24576:n9IMHea","24576:9IMHeaR","24576:IMHeaRh","24576:MHeaRhM","24576:HeaRhMz","24576:aRhMzip","24576:RhMzipr","24576:hMziprF","24576:MziprFa","24576:ziprFaP","24576:iprFaPC","24576:prFaPCS"],"imphash":"0e136cae6f625c80ecae333d9e2a37fa"},"file_info":{"file_name":"http___trinity.glo.pserver.ru_z.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1080320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1513592935000,"last_seen":1676659312000,"last_multi_scan":1676659312000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Loda","keylogger","autoit"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":18,"malicious_count":6,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.m0M3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1245465","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.219","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.219 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Autoit.CO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051b2ef1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.Win32.Autoit.apy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"AutoIt/Injector.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Autoit.ewekhr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr11.CTYM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Autoit.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 28697-2130-00428E19","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 28697-1766-004486AE","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 28697-2037-0041E47B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.dll (Target: \"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe.bin\"; Stream UID: \"28697-1766-004486AE\")\n which is directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00448826h\". See related instructions: \"...+0 push ebp+1 mov ebp, esp+3 sub esp, 0Ch+6 push esi+7 push edi+8 mov edi, edx+10 push edi+11 mov esi, ecx+13 call dword ptr [0048D23Ch] ;GetLocalTime+19 cmp word ptr [esi], 0000h+23 je 00448826h\" ... at 28697-1766-004486AE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 28697-2202-0043B94E\n GetProcessHeap@KERNEL32.dll at 28697-2203-0043B982\n GetProcessHeap@KERNEL32.dll at 28697-2206-0043B78E\n GetProcessHeap@KERNEL32.dll at 28697-2205-0043B593\n GetProcessHeap@KERNEL32.dll at 28697-2207-0043B7EF\n GetProcessHeap@KERNEL32.dll at 28697-2201-0043B850\n GetProcessHeap@KERNEL32.dll at 28697-2200-0043B398\n GetProcessHeap@KERNEL32.dll at 28697-2204-0043B8E7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-score.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"95.211.125.236:80\"\n \"185.118.167.221:4000\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.dll at 28697-2024-0041CC12\n UnregisterHotKey@USER32.dll at 28697-1892-004045A7","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"IESQMMUTEX_0_191\"\n \"Local\\!IETld!Mutex\"\n \"IESQMMUTEX_0_208\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"RasPbFile\"\n \"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /checkip/ HTTP/1.1User-Agent: AutoItHost: ip-score.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"%WINDIR%\\system32\\WININET.dll\",DispatchAPICall 1\" (UID: 00020750-00000992)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"checkip[1].htm\" has type \"HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.84749593362","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00019805-00003936-29194-421-001EE08F\n cpuid at 00019805-00003936-29194-1285-001F7254","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"rundll32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service\n \"rundll32.exe\" called \"OpenService\" to access the \"rasman\" service\n \"rundll32.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"rundll32.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\")\n \"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\\WEBBROWSER\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00019805-00003936-29194-2012-002291DC","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$37","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recvfrom@WSOCK32.DLL at 00019805-00003936-29194-2023-00229A66\n recv@WSOCK32.DLL at 00019805-00003936-29194-2015-0022936F\n InternetReadFile@WININET.DLL at 00019805-00003936-29194-1867-0022550C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$38","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$39","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$3a","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"rundll32.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\Windata\\LFPYUQ.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN Loda Logger CnC Beacon\" (SID: 2822116, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile\" (SID: 2008350, Rev: 7, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET POLICY External IP Lookup ip-score.com\" (SID: 2022892, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 656)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 656)\n \"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 656)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 656)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$3b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-score.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}],"incidents":[{"name":"Remote Access","details_count":3,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"},{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":40,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":67,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["Loda","keylogger","autoit"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"5a3795d37ca3e1764919dad4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","RUS"],"submit_name":"http___trinity.glo.pserver.ru_z.exe","analysis_start_time":"2017-12-18T11:18:17+00:00","indicators_count":{"informative":17,"suspicious":29,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.211.125.236","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"address":"185.118.167.221","port":4000,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}],"dns_resolutions":[{"domain":"ip-score.com","address":"95.211.125.236","country":"Netherlands","registrar_name":"PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM","registrar_name_servers":"NS1.55DNS.BIZ","registrar_creation_date":"2010-12-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}],"http_requests":[{"host":"ip-score.com","host_ip":"95.211.125.236:80","url":"/checkip/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /checkip/ HTTP/1.1\nUser-Agent: AutoIt\nHost: ip-score.com","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}],"processes":[{"pid":3936,"ppid":0,"name":"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe","command_line":"","sha256":"9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c","normalized_path":"C:\\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe","uid":"00019805-00003936","icon":"$3c"},{"pid":992,"ppid":3936,"name":"rundll32.exe","command_line":"\"%WINDIR%\\system32\\WININET.dll\",DispatchAPICall 1","sha256":"5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00019805-00003936","uid":"00020750-00000992"}],"all_imported_dlls":["FWPUCLNT.DLL","uxtheme.dll","rtutils.dll","wship6.dll","msxml3.dll","propsys.dll","kernel32.dll","gdi32.dll","wininet.dll","msctf.dll","Wldap32.dll","msvfw32.dll","rpcrt4.dll","shlwapi.dll","mpr.dll","sechost.dll","urlmon.dll","shell32.dll","cryptbase.dll","RpcRtRemote.dll","dnsapi.dll","rasadhlp.dll","KernelBase.dll","usp10.dll","advapi32.dll","imm32.dll","dwmapi.dll","dhcpcsvc6.dll","wsock32.dll","winnsi.dll","devobj.dll","ntmarta.dll","rasapi32.dll","dui70.dll","nlaapi.dll","mswsock.dll","imagehlp.dll","IPHLPAPI.DLL","ws2_32.dll","version.dll","winmm.dll","crypt32.dll","comdlg32.dll","netprofm.dll","msasn1.dll","nsi.dll","setupapi.dll","dhcpcsvc.dll","avicap32.dll","AcLayers.dll","user32.dll","iertutil.dll","cryptsp.dll","sxs.dll","psapi.dll","lpk.dll","oleaut32.dll","npmproxy.dll","ExplorerFrame.dll","winrnr.dll","WSHTCPIP.DLL","SensApi.dll","userenv.dll","sspicli.dll","rsaenh.dll","ntdll.dll","comctl32.dll","profapi.dll","cfgmgr32.dll","rasman.dll","apphelp.dll","normaliz.dll","actxprxy.dll","msvcrt.dll","shdocvw.dll","ieframe.dll","pnrpnsp.dll","ole32.dll","rpcss.dll","clbcatq.dll","msxml3r.dll","duser.dll","NapiNSP.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"checkip[1].htm","sha256":"e177872b251971a579695893d44c543d9627042b13559e6f0248e00e76828302","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Windata","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"C:\\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Windata\\LFPYUQ.exe","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"C:\\9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Windata\\LFPYUQ.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\checkip[1].htm","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\msvfw32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\avicap32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\winver.exe","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\winver.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\en-US\\explorerframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\ExplorerFrame.dll","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_LOW!_","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!low!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!low!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!low!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!low!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!low!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!low!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]},{"name":"Local\\_!MSFTHISTORY!_LOW!_","sources":[{"report_type":"sandbox","report_id":"5a3795d37ca3e1764919dad4"}]}]}},"report_ids":{"sandbox_job_ids":["5a3795d37ca3e1764919dad4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9300e6bbdb4b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9300e6bbdb4b…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9300e6bbdb4b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9300e6bbdb4b…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9300e6bbdb4bd12e1a1f58a5a50759811d39437e3cbe2769164d5d04e199656c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9300e6bbdb4b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9300e6bbdb4b…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]] 32:null