34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 94a48d5a5373… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 94a48d5a5373…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a"],"about":{"@type":"SoftwareApplication","name":"mprocess.bin","applicationCategory":["peexe","executable"],"identifier":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T55a,"" wrote bytes "2b45b875f99cb77578ebb6757989b6759397b775d333b875a41db875d0d9b77511a6b7755c39b87541cfb775e19cb7750e45b875b62fb8754123b77500bfb77500000000473fb17600000000ec229e7699e59b7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "0857dd750478e6750000000051c1ca759498ca75ee9cca7575dccc75273ecc75efb2d0750000000046ceb775013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775aa6eb8759fbbb77592bbb77546bab7750abfb77500000000" to virtual address "0x6F471000" (part of module "SHFOLDER.DLL") "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "wuapp.exe" wrote bytes "7739137779a81777be721777d62d17771de2127705a21777c868167757d11d77bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x74CA1000" (part of module "WSHIP6.DLL") "wuapp.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "wuapp.exe" wrote bytes "92e6127779a81777be721777d62d17771de2127705a21777bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x747D1000" (part of module "WSHTCPIP.DLL")37:T861,"" wrote 32 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 52 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 4 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 332) "" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 332) "" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 332) "" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 332) "" wrote 544 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 332) "" wrote 2333 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 332) "" wrote 1024 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 1025 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 12800 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 4608 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 713216 bytes to a remote process "C:\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe" (Handle: 172) "" wrote 1500 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 100) "" wrote 4 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 100) "" wrote 32 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 100) "" wrote 52 bytes to a remote process "C:\Windows\System32\wuapp.exe" (Handle: 100)38:T4d0,Found malicious artifacts related to "78.46.91.134" (ASN: , Owner: ): ... URL: http://aquaman.triathlon.de/shop (AV positives: 1/68 scanned on 12/29/2016 05:27:43) URL: http://aquaman.triathlon.de/haendler (AV positives: 1/68 scanned on 12/18/2016 04:54:11) URL: http://aquaman.triathlon.de/ (AV positives: 1/68 scanned on 12/14/2016 01:54:58) URL: http://aquaman.triathlon.de/auslaufmodelle.html (AV positives: 1/68 scanned on 12/09/2016 04:19:46) URL: http://training.triathlon.de/ (AV positives: 1/68 scanned on 08/01/2016 04:11:33) File SHA256: a1a05fb5c7957631292ff44a86491fc73c019e16a82cf29774b9832791d481c2 (Scanned on 12/14/2017 16:37:31) File SHA256: 3667ffc94201e966030c51023bd90defe853e9c1d717e2a5c944c6feb29f602c (Scanned on 12/14/2017 16:34:38) File SHA256: 53b69fd2003bd96087bcce88f3b9e66db1956540d11abc424d3d07bf3a372ad7 (AV positives: 46/68 scanned on 12/02/2017 02:14:33) File SHA256: 1faff4cf4bfe0d40af1555dc2ca749c5a382197b51b327ad89c4734d6ba75ee3 (Scanned on 12/01/2017 08:49:28) File SHA256: 0ae12268fc8f69c077d522b31b6c13a22c4ea3d8a8890b76128173c9088922a9 (Scanned on 12/01/2017 08:46:07) File SHA256: acd00021d129805c1282d117fb255cefe517da79c0be016332ea5c2c9dcbab93 (Scanned on 11/29/2017 05:47:02)39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIiIgIiAiIiAiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAICAgICAgIiIgIiIgAAAAACIiIiAiICAgICAgIAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAAAAAAAAAIiIgIiIgAAAAAAAAACAgICAgICAgIAAAAAAAJAAiIiIiIiAiIiAAAAAAAmQAICAgICAgICAgAAAAAAMAACIiIiIiICIiIAAAAAAsAAAgICAgICAgICAAAAAAAAAAIiIiIiIgIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAACAgICAgAAAAAAAAAAAAAAAiIiAiIAAAAAAAAAAAAAAAICAgICAAAAAAAAAAAAAAACIiICIgAAAAAAAAAAAAAAAgICAgIAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAADwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf3AAAH9QAAB/EAAAfzAAAH9wAAB/8AAAf/AAAH/wAAB//4AD//+AA///gAP//4AD//+AA///gAP//4AD//+AA//////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793899938684,"unified_at":"2026-11-05T17:32:18.684Z","metadata":{"hashes":{"sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","sha1":"8897cfaf039aa301d3f3e9f1547b9bd7983b8f53","md5":"2a4a2d0721e0d3d7201ca11bfc479922","sha512":"76edf684ad6f26905c07652fa879d18a15bc0d61ce8bd5fdc8f9ca2bb75fba94c5d88fc85389387f511a512460891526da64d1cae05e1d2714d806356812ae40","ssdeep":"24576:D3mdLCENxYvrZh6HJ1LK21TN8TBOVGKvIA4:LmdOTvrWJ1+21+VOVGMK","ssdeep_chunks":["24576:D3mdLCE","24576:3mdLCEN","24576:mdLCENx","24576:dLCENxY","24576:LCENxYv","24576:CENxYvr","24576:ENxYvrZ","24576:NxYvrZh","24576:xYvrZh6","24576:YvrZh6H","24576:vrZh6HJ","24576:rZh6HJ1","24576:Zh6HJ1L","24576:h6HJ1LK","24576:6HJ1LK2","24576:HJ1LK21","24576:J1LK21T","24576:1LK21TN","24576:LK21TN8","24576:K21TN8T","24576:21TN8TB","24576:1TN8TBO","24576:TN8TBOV","24576:N8TBOVG","24576:8TBOVGK","24576:TBOVGKv","24576:BOVGKvI","24576:OVGKvIA","24576:VGKvIA4","49152:D3mdLCE","49152:3mdLCEN","49152:mdLCENx","49152:dLCENxY","49152:LCENxYv","49152:CENxYvr","49152:ENxYvrZ","49152:NxYvrZh","49152:xYvrZh6","49152:YvrZh6H","49152:vrZh6HJ","49152:rZh6HJ1","49152:Zh6HJ1L","49152:h6HJ1LK","49152:6HJ1LK2","49152:HJ1LK21","49152:J1LK21T","49152:1LK21TN","49152:LK21TN8","49152:K21TN8T","49152:21TN8TB","49152:1TN8TBO","49152:TN8TBOV","49152:N8TBOVG","49152:8TBOVGK","49152:TBOVGKv","49152:BOVGKvI","49152:OVGKvIA","49152:VGKvIA4","24576:LmdOTvr","24576:mdOTvrW","24576:dOTvrWJ","24576:OTvrWJ1","24576:TvrWJ1+","24576:vrWJ1+2","24576:rWJ1+21","24576:WJ1+21+","24576:J1+21+V","24576:1+21+VO","24576:+21+VOV","24576:21+VOVG","24576:1+VOVGM","24576:+VOVGMK"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"mprocess.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":833249,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1513406905000,"last_seen":1660527813000,"last_multi_scan":1660527813000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["coinminer","miner"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":10,"malicious_count":8,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1220173","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12636474","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12636474 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Zbot.yuak","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.evsrmz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr25.DNSN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pool.minexmr.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"78.46.91.134:4444\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\3cc750f6e17fbeb903ed\"\n \"3cc750f6e17fbeb903ed\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"FunCoil.bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00051416-00002284)\n Spawned process \"msiexec.exe\" (UID: 00051420-00002344)\n Spawned process \"wuapp.exe\" with commandline \"-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2\" (UID: 00052001-00002332)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"FunCoil.bin\" has type \"data\"\n \"education.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\wuapp.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Heuristic match: \"pool.minexmr.com\"\n Heuristic match: \"2016-2017 xmrig.com\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"education.dll\" was detected as \"Armadillo v1.xx - v2.xx\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wuapp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)\n 2/66 reputation engines marked \"http://pool.minexmr.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"education.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\"; Key: \"SHELL\"; Value: \"explorer.exe, %APPDATA%\\omega.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe\" marked \"%TEMP%\\nsz76CD.tmp\" for deletion\n \"C:\\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe\" marked \"%TEMP%\\nsvD924.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsz76CD.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsvD924.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n GetStartupInfoA\n TerminateProcess\n VirtualAlloc\n VirtualProtect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$36","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY DNS request for Monero mining pool\" (SID: 2024789, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ET POLICY Cryptocurrency Miner Checkin\" (SID: 2024792, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ETPRO POLICY XMR CoinMiner Usage\" (SID: 2826930, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ETPRO TROJAN CoinMiner Known Malicious Stratum Authline (2017-11-22 4)\" (SID: 2828692, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/68 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"47/68 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"28/67 Antivirus vendors marked dropped file \"education.dll\" as malicious (classified as \"Trojan.Injector\" with 41% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"47/68 Antivirus vendors marked spawned process \"\" (PID: 2284) as malicious (classified as \"Trojan.Injector\" with 69% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$37","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$38","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 78.46.91.134 on port 4444","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":69,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["coinminer","miner"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a34bf277ca3e1608a293743","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Injector","contacted_countries":["DEU","FRA"],"submit_name":"mprocess.bin","analysis_start_time":"2017-12-16T07:37:36+00:00","indicators_count":{"informative":12,"suspicious":12,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"78.46.91.134","port":4444,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}],"dns_resolutions":[{"domain":"pool.minexmr.com","address":"176.31.117.82","country":"France","registrar_name":"ENOM, INC.","registrar_name_servers":"FRANK.NS.CLOUDFLARE.COM","registrar_creation_date":"2014-06-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}],"processes":[{"pid":948,"ppid":0,"name":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe","command_line":"","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","normalized_path":"C:\\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe","uid":"00041778-00000948","icon":"$39"},{"pid":2284,"ppid":948,"name":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe","command_line":"","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","normalized_path":"C:\\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe","parent_uid":"00041778-00000948","uid":"00051416-00002284"},{"pid":2332,"ppid":2284,"name":"wuapp.exe","command_line":"-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2","sha256":"bb2483d536d2284acba2c2d7fdd20da4b419eaf6887e8a3cd418f7dc27d611d4","normalized_path":"%WINDIR%\\System32\\wuapp.exe","parent_uid":"00051416-00002284","uid":"00052001-00002332"},{"pid":2344,"ppid":948,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00041778-00000948","uid":"00051420-00002344"}],"all_imported_dlls":["apphelp.dll","FWPUCLNT.DLL","clbcatq.dll","Wldap32.dll","profapi.dll","mpr.dll","rpcrt4.dll","version.dll","oleaut32.dll","sfc.dll","sfc_os.dll","advapi32.dll","msctf.dll","uxtheme.dll","IPHLPAPI.DLL","userenv.dll","wshqos.dll","msacm32.dll","AcLayers.dll","rpcss.dll","winnsi.dll","WSHTCPIP.DLL","nsi.dll","mswsock.dll","ntdll.dll","setupapi.dll","System.dll","devobj.dll","propsys.dll","dhcpcsvc6.dll","dhcpcsvc.dll","lpk.dll","cryptbase.dll","powrprof.dll","winrnr.dll","sspicli.dll","winmm.dll","samcli.dll","msasn1.dll","kernel32.dll","psapi.dll","ws2_32.dll","dwmapi.dll","wininet.dll","shlwapi.dll","rasadhlp.dll","crypt32.dll","usp10.dll","msvcrt.dll","nlaapi.dll","pnrpnsp.dll","dnsapi.dll","AcGenral.dll","gdi32.dll","wship6.dll","user32.dll","ole32.dll","cfgmgr32.dll","urlmon.dll","KernelBase.dll","shell32.dll","comctl32.dll","NapiNSP.dll","iertutil.dll","msi.dll","sechost.dll","imm32.dll","shfolder.dll","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"education.dll","sha256":"f304d5935191e55e7744eb284699234dfe4b6ed9ce7d6c2b2d94b5f9b4e269af","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"name":"FunCoil.bin","sha256":"c7b138ac2d47f736a50f9fbcd4a50ca75dd6ee524ce64ebc0dc161e17beb8d3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"name":"System.dll","sha256":"fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"C:\\Users\\0AbFmG5","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%TEMP%\\Tutorial1","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%TEMP%\\education.dll","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%TEMP%\\nsvD924.tmp","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%TEMP%\\FunCoil.bin","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"C:\\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%APPDATA%\\omega.exe","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"C:\\94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%APPDATA%\\omega.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\wuapp.exe","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\3cc750f6e17fbeb903ed","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]},{"name":"3cc750f6e17fbeb903ed","sources":[{"report_type":"sandbox","report_id":"5a34bf277ca3e1608a293743"}]}]}},"report_ids":{"sandbox_job_ids":["5a34bf277ca3e1608a293743"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 94a48d5a5373… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 94a48d5a5373…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 94a48d5a5373… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 94a48d5a5373…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 94a48d5a5373… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 94a48d5a5373…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null