23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T478,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 9a58afcc43ee… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a58afcc43ee…. Malware family: Trojan.Agent. Threat score 100/100. 23/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d"],"about":{"@type":"SoftwareApplication","name":"t.exe","applicationCategory":["peexe","executable"],"identifier":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":23,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T41f,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "Local\WininetStartupMutex" "Local\c:!users!boxn3ae!appdata!roaming!microsoft!windows!cookies!" "Local\c:!users!boxn3ae!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "RasPbFile" "Local\WininetProxyRegistryMutex" "Local\_!MSFTHISTORY!_" "Local\c:!users!boxn3ae!appdata!local!microsoft!windows!history!history.ie5!" "IESQMMUTEX_0_208" "Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!boxn3ae!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!boxn3ae!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\c:!users!boxn3ae!appdata!local!microsoft!windows!temporary internet files!content.ie5!"25:T8fd,"GET / HTTP/1.1 Cookie: D27F=Tbgc/A4RJ92TQ2PZOs26U5N3En24UTboLmfuNYydjAqfmes9p2SBpoy88ppIdIcrI5rywRZymowkM0TF19SXE2HwUWFZ3j12JE177s8FuNBDTjGJYiBvP/yyncrO7JxkyAqWTatGKaX9AYLX9EfDg0bl58Kp7LJ+KimXFbuZ9Ms+Ux6Fkg9NNGNxE0kZzNLuG7CvSjvrtjHLYr33qhxqCfY3tSMlktm9oDzPll0vMVpuoXhkk9t3pWPeIaGjB+Q1+i2KMWRoExJQgdmcDMBSZzH2taHYAW+MaXqzoSjEztQtf8y/64pOvR0tU35o+AlrTavNV2FIIHSN1WiEMoV7TtxgsvyMvp0ZsHh54MsNnz/RjMjQ2L5ces0hDzSfSPimzHSNmwXaZF1QsEQqzdrsvnv2NRbMkRZeSBoHpDNge3Ulhvrjf1vrndTS2k4XwbLTIguRcNpMkqUVHQLsovMOh9TvAP8mak2rZ1xp3G2ywVWM6Rj941DNewSVMCz41Zd9Ap+pUN6VLnzG8bVDPdBb/ZoA2zrm4BHZxOHGOUCeU+83uZQKEioHnHZETxT9QnyVdZ5OwA== User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322) Host: 82.165.142.107:443 Connection: Keep-Alive Cache-Control: no-cache" "GET / HTTP/1.1 Cookie: 656E=cM53I7d4MR1e2RRyPXYpL3JFRN0b40S0EUBNss34nRpDLP/jQKW4IJ8u0J0UAp89sn9E6DFd13uSHIc+O7aJhJZqW3jIu2gfXKJndffQJfmkTdNbpZCDjONMWrqLcstfhpRIQi4Qccue1OR6cAT+W6mSj1Xu3pMsNaV7XFw3Z4bsxmgou/AEGwJ/QsFz1Cn8W57wxfNG/J6pJql4Z82yO5dzTiJR1Ag3dbKLUiNG1cosUicQv4DkFH8UgP5PzqBfpahvGe/eQAxe3dySKbcyFYAprtgOpB12eBD5QOmnZnH7Pw15rJO/GjQBk7w8+hBv0emX8IqJOUL812mwNCcgkDiYK5/Xaj730pvc+bO+6aE/oGNQDw+iAY9Mk6p3mxHZZOqE1/Ut6D+oCOnnwpERuYMtHHUWAJOhafEaMDM6voBZFXbJ3SF90pYf024x3YQKct9eh4C/jb6uU9AJJYtZIgyyMukfgzr21MWTEPN0GtDsI8QdOUdPdgh57qsdH0VW6rkE2xF0JNFeO1mUqo5L2ies8aJhVsr/ptt5hd0C4QHwi9WR User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322) Host: 103.4.18.170:443 Connection: Keep-Alive Cache-Control: no-cache" "GET / HTTP/1.1 Cookie: 70C5=ZsFY35Z5EH32f6pVX19WRDax/zyzZKsFpv89iU41W4g7z9RehFlREWTjV9czQuAK7CDIR17uMHl0I9dclRyGGTg+rzT6XLFl2tlzd5SFYhjC4jjcOgY2Sr68TKuPjbpsAoVSGAdMf+rRMaTHIpDVOdubQaip7LJ+KimXFbuZ9Ms+Ux6Fkg9NNGNxE0kZzNLuG7CvSjvrtjHLYr33qhxqCfY3tSMlktm9oDzPll0vMVpuoXhkk9t3pWPeIaGjB+Q1+i2KMWRoExJQgdmcDMBSZzH2taHYAW+MaXqzoSjEztQtf8y/64pOvR0tU35o+AlrTavNV2FIIHSN1WiEMoV7TtxgsvyMvp0ZsHh54MsNnz/RjMjQ2L5ces0hDzSfSPimzHSNmwXaZF1QsEQqzdrsvnv2NRbMkRZeSBoHpDNge3Ulhvrjf1vrndTS2k4XwbLTIguRcKvIpFb84rXGoDwxXUhsax6vzsA1QpnLWD4UF8YzdJ1r0UgnS37iRZ943nFOhL96ZSCpAdVXmlB6jtGDI/sJGRg4FgNybXhZ05SYvTIforbxi/OPeGLXkNZ1wYx6FsC70A== User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322) Host: 81.88.24.211:443 Connection: Keep-Alive Cache-Control: no-cache"26:T60e,"GET / HTTP/1.1 Cookie: D27F=Tbgc/A4RJ92TQ2PZOs26U5N3En24UTboLmfuNYydjAqfmes9p2SBpoy88ppIdIcrI5rywRZymowkM0TF19SXE2HwUWFZ3j12JE177s8FuNBDTjGJYiBvP/yyncrO7JxkyAqWTatGKaX9AYLX9EfDg0bl58Kp7LJ+KimXFbuZ9Ms+Ux6Fkg9NNGNxE0kZzNLuG7CvSjvrtjHLYr33qhxqCfY3tSMlktm9oDzPll0vMVpuoXhkk9t3pWPeIaGjB+Q1+i2KMWRoExJQgdmcDMBSZzH2taHYAW+MaXqzoSjEztQtf8y/64pOvR0tU35o+AlrTavNV2FIIHSN1WiEMoV7TtxgsvyMvp0ZsHh54MsNnz/RjMjQ2L5ces0hDzSfSPimzHSNmwXaZF1QsEQqzdrsvnv2NRbMkRZeSBoHpDNge3Ulhvrjf1vrndTS2k4XwbLTIguRcNpMkqUVHQLsovMOh9TvAP8mak2rZ1xp3G2ywVWM6Rj941DNewSVMCz41Zd9Ap+pUN6VLnzG8bVDPdBb/ZoA2zrm4BHZxOHGOUCeU+83uZQKEioHnHZETxT9QnyVdZ5OwA== User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322) Host: 82.165.142.107:443 Connection: Keep-Alive Cache-Control: no-cache" "GET / HTTP/1.1 Cookie: 70C5=ZsFY35Z5EH32f6pVX19WRDax/zyzZKsFpv89iU41W4g7z9RehFlREWTjV9czQuAK7CDIR17uMHl0I9dclRyGGTg+rzT6XLFl2tlzd5SFYhjC4jjcOgY2Sr68TKuPjbpsAoVSGAdMf+rRMaTHIpDVOdubQaip7LJ+KimXFbuZ9Ms+Ux6Fkg9NNGNxE0kZzNLuG7CvSjvrtjHLYr33qhxqCfY3tSMlktm9oDzPll0vMVpuoXhkk9t3pWPeIaGjB+Q1+i2KMWRoExJQgdmcDMBSZzH2taHYAW+MaXqzoSjEztQtf8y/64pOvR0tU35o+AlrTavNV2FIIHSN1WiEMoV7TtxgsvyMvp0ZsHh54MsNnz/RjMjQ2L5ces0hDzSfSPimzHSNmwXaZF1QsEQqzdrsvnv2NRbMkRZeSBoHpDNge3Ulhvrjf1vrndTS2k4XwbLTIguRcKvIpFb84rXGoDwxXUhsax6vzsA1QpnLWD4UF8YzdJ1r0UgnS37iRZ943nFOhL96ZSCpAdVXmlB6jtGDI/sJGRg4FgNybXhZ05SYvTIforbxi/OPeGLXkNZ1wYx6FsC70A== User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322) Host: 81.88.24.211:443 Connection: Keep-Alive Cache-Control: no-cache"27:T436,"" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "" touched file "%APPDATA%\Microsoft\Windows\Cookies" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\NpapiAppid.lnk"28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiHM3iIiIiIiIiIiIoAB4iIdRGIiIiIiIiIiIigAAeHdxEXiIiIiIiIiIiIZgAHhRd3d2iIiIiIiIiIiIiZB3hzd3d0Z3iIiIiIiIiIiJeHd3d3d0Z3eIiIiIiIiIiXd3d3d3drczM3iIiIiIiIl3d3d3d3dnMzM3d4iIiIiJWHd0R3d3dzMzOHd3iYiIhzZ3dmd9d3czMzgHcRCWaDM0d2ZmZYeHMzM4DodyfYhzMXdmZndwdnMzM+jgUziIcyVmZVZ3dnCDMzN3fgM4d4gHd1VVV3YAwzMzd3jnd3eIZzdVVVVwIAMzM3d3d3d3eId4d1VVUnfHMzN3d3h3d3iHd2d4dXd3hDMzd3d3d3d4h3d3d4d3d1RFc2d3d3eIhnd3cxEY53VERVXsB3d44HB3dxdjEAd1TFVTcMcXrgdwd3cRZ3IHd1WFXAw6VVx3eDd3M3d3NXd2eILsClVYd3d3d3dndUR3eqd+iFVVVXd3d3d3yHREd3qqpTeHdVd3d3d3mIB0TDZjVVqoh3d3d3d3d3loB8MAMzAIiIqnc3d3d3d3mZiA//AAAAF3N1qoh3d3d5mZY/AAAAABd3VWJVond3mZmZmQAAAAABdVVVVmZ3dVmZmZkAAAAAABVVVWZmd3dUeZmXZmZmZjA2ZFVmZngXd3d5FmZmZmYwA2ZVRmYAAAAOAAAAHgAAAA4AAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCAAAAQAAAgAgAACAEAABgAAAAsAAAAAAAAAAAAAAAAAAAAAAQKAMAIEgBAEAAAAAQAAAAAAAAAAAACAAAAARjAAAAj8AAAD/AAAA/4AAAP/AAAAAQAAAAGAA==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790442901400,"unified_at":"2026-09-26T17:15:01.400Z","metadata":{"hashes":{"sha256":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","sha1":"ba86a77b6e575cb93bc0724dfbea1498028cfc86","md5":"ac765e9809de73f444cd2cce04256dac","sha512":"7b20680e30b2f0b248d29882c6d2f660066ba6893f9d06b40ea5a117739541283761f1a80cf16d384be392147927e9a6122ff3e8de0ce305776ae5b4fa1a391b","ssdeep":"3072:AbYFaHhSJXP6SJEAxCrEg4tMSLrD/L8ldNZfDyXp0L/wGg/IODk4c3:A0FaHC5nxCr4GSLrDj8foq4GEIODk4c","ssdeep_chunks":["3072:AbYFaHh","3072:bYFaHhS","3072:YFaHhSJ","3072:FaHhSJX","3072:aHhSJXP","3072:HhSJXP6","3072:hSJXP6S","3072:SJXP6SJ","3072:JXP6SJE","3072:XP6SJEA","3072:P6SJEAx","3072:6SJEAxC","3072:SJEAxCr","3072:JEAxCrE","3072:EAxCrEg","3072:AxCrEg4","3072:xCrEg4t","3072:CrEg4tM","3072:rEg4tMS","3072:Eg4tMSL","3072:g4tMSLr","3072:4tMSLrD","3072:tMSLrD/","3072:MSLrD/L","3072:SLrD/L8","3072:LrD/L8l","3072:rD/L8ld","3072:D/L8ldN","3072:/L8ldNZ","3072:L8ldNZf","3072:8ldNZfD","3072:ldNZfDy","3072:dNZfDyX","3072:NZfDyXp","3072:ZfDyXp0","3072:fDyXp0L","3072:DyXp0L/","3072:yXp0L/w","3072:Xp0L/wG","3072:p0L/wGg","3072:0L/wGg/","3072:L/wGg/I","3072:/wGg/IO","3072:wGg/IOD","3072:Gg/IODk","3072:g/IODk4","3072:/IODk4c","3072:IODk4c3","6144:AbYFaHh","6144:bYFaHhS","6144:YFaHhSJ","6144:FaHhSJX","6144:aHhSJXP","6144:HhSJXP6","6144:hSJXP6S","6144:SJXP6SJ","6144:JXP6SJE","6144:XP6SJEA","6144:P6SJEAx","6144:6SJEAxC","6144:SJEAxCr","6144:JEAxCrE","6144:EAxCrEg","6144:AxCrEg4","6144:xCrEg4t","6144:CrEg4tM","6144:rEg4tMS","6144:Eg4tMSL","6144:g4tMSLr","6144:4tMSLrD","6144:tMSLrD/","6144:MSLrD/L","6144:SLrD/L8","6144:LrD/L8l","6144:rD/L8ld","6144:D/L8ldN","6144:/L8ldNZ","6144:L8ldNZf","6144:8ldNZfD","6144:ldNZfDy","6144:dNZfDyX","6144:NZfDyXp","6144:ZfDyXp0","6144:fDyXp0L","6144:DyXp0L/","6144:yXp0L/w","6144:Xp0L/wG","6144:p0L/wGg","6144:0L/wGg/","6144:L/wGg/I","6144:/wGg/IO","6144:wGg/IOD","6144:Gg/IODk","6144:g/IODk4","6144:/IODk4c","6144:IODk4c3","3072:A0FaHC5","3072:0FaHC5n","3072:FaHC5nx","3072:aHC5nxC","3072:HC5nxCr","3072:C5nxCr4","3072:5nxCr4G","3072:nxCr4GS","3072:xCr4GSL","3072:Cr4GSLr","3072:r4GSLrD","3072:4GSLrDj","3072:GSLrDj8","3072:SLrDj8f","3072:LrDj8fo","3072:rDj8foq","3072:Dj8foq4","3072:j8foq4G","3072:8foq4GE","3072:foq4GEI","3072:oq4GEIO","3072:q4GEIOD","3072:4GEIODk","3072:GEIODk4","3072:EIODk4c"],"imphash":"80175d36d6474b465262ca5d073695d8"},"file_info":{"file_name":"t.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":176128,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286929000,"last_seen":1651738344000,"last_multi_scan":1651738344000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["emotet","banker"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":16,"suspicious_count":13,"malicious_count":6,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.toOg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.btkeo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.5046725","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-4ba5db7d!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.5046725 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Emotet.AO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Adware ( 00539ed31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.nezvsg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.abu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.exkbhi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.MauvaiseRI.S5244144","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Wonton-ZJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Kovter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_EMOTET.XXTN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_EMOTET.XXTN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ater.ABD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Winlock","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00014393-00002980-63792-12-0100148E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014393-00002980-63792-33-01002B2E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014393-00002980-63792-344-0100315B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016309-00003624-2633-12-0100148E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016309-00003624-2633-33-01002B2E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014393-00002980-63792-160-010042F6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00015475-00003096-0000010C-43014674\n \"\" queries volume information of \"C:\\\" at 00015475-00003096-0000010C-44406134\n \"\" queries volume information of \"%LOCALAPPDATA%\\NpapiAppid\\NpapiAppid.exe\" at 00015475-00003096-0000010C-44408052\n \"NpapiAppid.exe\" queries volume information of \"C:\\\" at 00017906-00003732-0000010C-49807486","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00015475-00003096-0000010C-43014674\n \"\" queries volume information of \"C:\\\" at 00015475-00003096-0000010C-44406134\n \"NpapiAppid.exe\" queries volume information of \"C:\\\" at 00017906-00003732-0000010C-49807486","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\T.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\T.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"82.165.142.107:443\"\n \"103.4.18.170:443\"\n \"46.163.78.94:443\"\n \"81.88.24.211:443\"\n \"45.79.186.178:8080\"\n \"87.106.77.193:8080\"\n \"62.75.145.252:8080\"\n \"178.79.172.45:8080\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$24","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$25","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"CN3BE54745\"\n \"NpapiAppid.exe\" searching for class \"CN3BE54745\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015475-00003096)\n Spawned process \"NpapiAppid.exe\" with commandline \"-U309631403823324\" (UID: 00016309-00003624)\n Spawned process \"NpapiAppid.exe\" with commandline \"-U309631403823324\" (UID: 00017906-00003732)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"NpapiAppid.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"NpapiAppid.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Thu May 11 20:55:18 2017 mtime=Thu May 11 20:55:18 2017 atime=Thu May 11 20:55:29 2017 length=176128 window=hide\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"NpapiAppid.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"t.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.78276218466","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NpapiAppid.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"NpapiAppid.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"NpapiAppid.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"NpapiAppid.exe\" called \"OpenService\" to access the \"rasman\" service\n \"NpapiAppid.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"NpapiAppid.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"82.165.142.107\"\n \"103.4.18.170\"\n \"81.88.24.211\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"NpapiAppid.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"NpapiAppid.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MinimumChart.lnk\" with delete access\n \"\" opened \"%APPDATA%\\MinimumChart\\MinimumChart.exe\" with delete access\n \"\" opened \"C:\\t.exe\" with delete access\n \"NpapiAppid.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MinimumChart.lnk\" with delete access\n \"NpapiAppid.exe\" opened \"%APPDATA%\\MinimumChart\\MinimumChart.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"NpapiAppid.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"NpapiAppid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"NpapiAppid.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"t.exe.bin\" claimed CRC 231952 while the actual is CRC 214726","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n GetFileAttributesW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n Sleep\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET CNC Feodo Tracker Reported CnC Server group 1\" (SID: 2404300, Rev: 4578, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/61 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/61 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/61 Antivirus vendors marked spawned process \"\" (PID: 2980) as malicious (classified as \"DangerousObject.Multi\" with 22% detection rate)\n 14/61 Antivirus vendors marked spawned process \"\" (PID: 3096) as malicious (classified as \"DangerousObject.Multi\" with 22% detection rate)\n 14/61 Antivirus vendors marked spawned process \"NpapiAppid.exe\" (PID: 3624) as malicious (classified as \"DangerousObject.Multi\" with 22% detection rate)\n 14/61 Antivirus vendors marked spawned process \"NpapiAppid.exe\" (PID: 3732) as malicious (classified as \"DangerousObject.Multi\" with 22% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"82.165.142.107\" (ASN: 8560, Owner: 1&1 Internet AG): ...\nURL: http://82.165.142.107:443/ (AV positives: 3/64 scanned on 05/11/2017 13:41:56)\n URL: http://82.165.142.107/ (AV positives: 3/64 scanned on 05/11/2017 13:20:43)\n URL: http://82.165.142.107/es/ (AV positives: 3/64 scanned on 05/11/2017 12:16:00)\n File SHA256: 5068833e8e3f5bf939d207d87242cb89d60e859d2fb44558115a8b3390dbd8cb (AV positives: 34/61 scanned on 05/10/2017 10:23:40)\n File SHA256: 0b2ed93d8230ee16dd571ca67687cdd90d638e66ee97966f8dc71dce74da9c38 (AV positives: 2/50 scanned on 02/07/2014 19:53:33)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.79.186.178 on port 8080\n TCP traffic to 87.106.77.193 on port 8080\n TCP traffic to 62.75.145.252 on port 8080\n TCP traffic to 178.79.172.45 on port 8080","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["emotet","banker"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59146d4faac2ed455df6bf99","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["AUS","DEU","GBR","USA"],"submit_name":"t.exe","analysis_start_time":"2017-05-11T14:55:31+00:00","indicators_count":{"informative":16,"suspicious":19,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"82.165.142.107","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"103.4.18.170","port":443,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"46.163.78.94","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"81.88.24.211","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"45.79.186.178","port":8080,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"87.106.77.193","port":8080,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"62.75.145.252","port":8080,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"address":"178.79.172.45","port":8080,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}],"dns_resolutions":null,"http_requests":[{"host":"82.165.142.107","host_ip":"82.165.142.107:443","url":"/","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET / HTTP/1.1\nCookie: D27F=Tbgc/A4RJ92TQ2PZOs26U5N3En24UTboLmfuNYydjAqfmes9p2SBpoy88ppIdIcrI5rywRZymowkM0TF19SXE2HwUWFZ3j12JE177s8FuNBDTjGJYiBvP/yyncrO7JxkyAqWTatGKaX9AYLX9EfDg0bl58Kp7LJ+KimXFbuZ9Ms+Ux6Fkg9NNGNxE0kZzNLuG7CvSjvrtjHLYr33qhxqCfY3tSMlktm9oDzPll0vMVpuoXhkk9t3pWPeIaGjB+Q1+i2KMWRoExJQgdmcDMBSZzH2taHYAW+MaXqzoSjEztQtf8y/64pOvR0tU35o+AlrTavNV2FIIHSN1WiEMoV7TtxgsvyMvp0ZsHh54MsNnz/RjMjQ2L5ces0hDzSfSPimzHSNmwXaZF1QsEQqzdrsvnv2NRbMkRZeSBoHpDNge3Ulhvrjf1vrndTS2k4XwbLTIguRcNpMkqUVHQLsovMOh9TvAP8mak2rZ1xp3G2ywVWM6Rj941DNewSVMCz41Zd9Ap+pUN6VLnzG8bVDPdBb/ZoA2zrm4BHZxOHGOUCeU+83uZQKEioHnHZETxT9QnyVdZ5OwA==\nUser-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322)\nHost: 82.165.142.107:443\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}],"processes":[{"pid":2980,"ppid":0,"name":"t.exe","command_line":"","sha256":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","normalized_path":"C:\\t.exe","uid":"00014393-00002980","icon":"$28"},{"pid":3096,"ppid":2980,"name":"t.exe","command_line":"","sha256":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","normalized_path":"C:\\t.exe","parent_uid":"00014393-00002980","uid":"00015475-00003096"},{"pid":3624,"ppid":3096,"name":"NpapiAppid.exe","command_line":"-U309631403823324","sha256":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","normalized_path":"%LOCALAPPDATA%\\NpapiAppid\\NpapiAppid.exe","parent_uid":"00015475-00003096","uid":"00016309-00003624"},{"pid":3732,"ppid":3624,"name":"NpapiAppid.exe","command_line":"-U309631403823324","sha256":"9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d","normalized_path":"%LOCALAPPDATA%\\NpapiAppid\\NpapiAppid.exe","parent_uid":"00016309-00003624","uid":"00017906-00003732"}],"all_imported_dlls":["rpcrt4.dll","clbcatq.dll","NapiNSP.dll","netutils.dll","msasn1.dll","ntmarta.dll","sechost.dll","comctl32.dll","cryptsp.dll","wship6.dll","IPHLPAPI.DLL","winnsi.dll","gdi32.dll","shlwapi.dll","rasapi32.dll","setupapi.dll","rpcss.dll","devobj.dll","normaliz.dll","imm32.dll","propsys.dll","RpcRtRemote.dll","urlmon.dll","kernel32.dll","shell32.dll","Wldap32.dll","OLMAPI32.DLL","crypt32.dll","wininet.dll","sspicli.dll","rtutils.dll","ntdll.dll","msvcrt.dll","msctf.dll","advapi32.dll","user32.dll","apphelp.dll","cfgmgr32.dll","rsaenh.dll","slc.dll","mswsock.dll","winrnr.dll","lpk.dll","usp10.dll","ole32.dll","cryptbase.dll","profapi.dll","KernelBase.dll","linkinfo.dll","ntshrui.dll","nsi.dll","pnrpnsp.dll","dwmapi.dll","oleaut32.dll","rasman.dll","WSHTCPIP.DLL","uxtheme.dll","cscapi.dll","ws2_32.dll","SensApi.dll","rasadhlp.dll","srvcli.dll","iertutil.dll","dnsapi.dll","nlaapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"NpapiAppid.lnk","sha256":"307df3ea3bc10bdc32e455b336ad6d95ad52f0cc79d02e11b7095ee4ea3a855d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}],"files_written":[{"path":"%TEMP%\\6A63.tmp","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%TEMP%\\7309.tmp","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%WINDIR%\\system32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"C:\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"C:\\Users\\bOxn3Ae","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\NpapiAppid.lnk","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\NpapiAppid\\NpapiAppid.exe","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%TEMP%\\C90E.tmp","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\OLMAPI32.DLL","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\CLIENTS\\MAIL\\","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"key":"HKLM\\SOFTWARE\\CLIENTS\\MAIL\\MICROSOFT OUTLOOK\\","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\c:!users!boxn3ae!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\c:!users!boxn3ae!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\c:!users!boxn3ae!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!boxn3ae!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!boxn3ae!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!boxn3ae!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59146d4faac2ed455df6bf99"}]}]}},"report_ids":{"sandbox_job_ids":["59146d4faac2ed455df6bf99"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 9a58afcc43ee… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9a58afcc43ee…. Malware family: Trojan.Agent. Threat score 100/100. 23/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 9a58afcc43ee… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9a58afcc43ee…. Malware family: Trojan.Agent. Threat score 100/100. 23/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a58afcc43eec9adf73f5a885faa37dc8cd68b54abbeeed9207a92b6ca4c522d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 9a58afcc43ee… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9a58afcc43ee…. Malware family: Trojan.Agent. Threat score 100/100. 23/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]