26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.SelfDel Sample 9c88c66f44eb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9c88c66f44eb…. Malware family: Trojan.SelfDel. Threat score 100/100. 22/27 AV engines flagged this file. 14 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9c88c66f44eba049dcf45204315aaf8ba1e660822f9e97aec51b1c305f5fdf14","keywords":["Malicious","Trojan.SelfDel","malware analysis","sandbox report","threat intelligence","9c88c66f44eba049dcf45204315aaf8ba1e660822f9e97aec51b1c305f5fdf14"],"about":{"@type":"SoftwareApplication","name":"E2251A00F5D025EE89228720DC5C2F65.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"9c88c66f44eba049dcf45204315aaf8ba1e660822f9e97aec51b1c305f5fdf14","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.SelfDel","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T839,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")28:T789,".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")29:T4da,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "tasklist.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")2a:T84d,Spawned process "Safe.exe" (UID: 00035059-00002984) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00035075-00002844) Spawned process "cmd.exe" with commandline "/c wevtutil.exe enum-logs > "%ALLUSERSPROFILE%\EventLog.txt"" (UID: 00036853-00002592) Spawned process "wevtutil.exe" with commandline "enum-logs" (UID: 00036914-00002348) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "Analytic"" (UID: 00037253-00004088) Spawned process "wevtutil.exe" with commandline "clear-log "Analytic"" (UID: 00037322-00002628) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "Application"" (UID: 00037566-00002884) Spawned process "wevtutil.exe" with commandline "clear-log "Application"" (UID: 00037847-00003284) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "DirectShowFilterGraph"" (UID: 00038766-00003340) Spawned process "wevtutil.exe" with commandline "clear-log "DirectShowFilterGraph"" (UID: 00038822-00004044) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "DirectShowPluginControl"" (UID: 00039424-00003188) Spawned process "wevtutil.exe" with commandline "clear-log "DirectShowPluginControl"" (UID: 00039606-00003172) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "EndpointMapper"" (UID: 00040579-00002220) Spawned process "wevtutil.exe" with commandline "clear-log "EndpointMapper"" (UID: 00040633-00002180) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "ForwardedEvents"" (UID: 00041173-00000264) Spawned process "wevtutil.exe" with commandline "clear-log "ForwardedEvents"" (UID: 00041204-00003068) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "HardwareEvents"" (UID: 00042059-00002324) Spawned process "wevtutil.exe" with commandline "clear-log "HardwareEvents"" (UID: 00042422-00002484) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "Internet Explorer"" (UID: 00043609-00002752) Spawned process "wevtutil.exe" with commandline "clear-log "Internet Explorer"" (UID: 00043633-00003420)2b:T84d,Spawned process "Safe.exe" (UID: 00035059-00002984) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00035075-00002844) Spawned process "cmd.exe" with commandline "/c wevtutil.exe enum-logs > "%ALLUSERSPROFILE%\EventLog.txt"" (UID: 00036853-00002592) Spawned process "wevtutil.exe" with commandline "enum-logs" (UID: 00036914-00002348) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "Analytic"" (UID: 00037253-00004088) Spawned process "wevtutil.exe" with commandline "clear-log "Analytic"" (UID: 00037322-00002628) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "Application"" (UID: 00037566-00002884) Spawned process "wevtutil.exe" with commandline "clear-log "Application"" (UID: 00037847-00003284) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "DirectShowFilterGraph"" (UID: 00038766-00003340) Spawned process "wevtutil.exe" with commandline "clear-log "DirectShowFilterGraph"" (UID: 00038822-00004044) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "DirectShowPluginControl"" (UID: 00039424-00003188) Spawned process "wevtutil.exe" with commandline "clear-log "DirectShowPluginControl"" (UID: 00039606-00003172) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "EndpointMapper"" (UID: 00040579-00002220) Spawned process "wevtutil.exe" with commandline "clear-log "EndpointMapper"" (UID: 00040633-00002180) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "ForwardedEvents"" (UID: 00041173-00000264) Spawned process "wevtutil.exe" with commandline "clear-log "ForwardedEvents"" (UID: 00041204-00003068) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "HardwareEvents"" (UID: 00042059-00002324) Spawned process "wevtutil.exe" with commandline "clear-log "HardwareEvents"" (UID: 00042422-00002484) Spawned process "cmd.exe" with commandline "/c wevtutil.exe clear-log "Internet Explorer"" (UID: 00043609-00002752) Spawned process "wevtutil.exe" with commandline "clear-log "Internet Explorer"" (UID: 00043633-00003420)2c:T671,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23c.dat" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\System32\l_intl.nls" ".exe" touched file "C:\Windows\assembly\pubpol47.dat" ".exe" touched file "C:\Windows\System32\tzres.dll"2d:T543,".exe" queried SystemProcessInformation at 00028772-00002584-00000105-17518185497 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-24493585893 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-31848976110 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-39497899725 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-46882179081 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-52889496776 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-58605517058 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-65015527908 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-72888024268 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-79717611924 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-85846598777 ".exe" queried SystemProcessInformation at 00028772-00002584-00000105-133403129199 "tasklist.exe" queried SystemProcessInformation at 00035075-00002844-00000105-122965518230 "tasklist.exe" queried SystemProcessInformation at 00035075-00002844-00000105-1229674733192e:T9a6,""sldm", "sldx", "sql", "sqlite", "sqlite-shm", "sqlite-wal", "sqlite3", "sqlitedb", "sr2", "srb", "srf", "srs", "srt", "srw", "st4", "st5", "st6", "st7", "st8", "stc", "std", "sti", "stm", "stw", "stx", "svg", "swf", "sxc", "sxd", "sxg", "sxi", "sxm", "sxw", "tbb", "tbn", "tex", "tga", "thm", "tlg", "tlx", "txt", "usr", "vbox", "vdi", "vhd", "vhdx", "vmdk", "vmsd", "vmx", "vmxf", "vob", "wab", "wad", "wallet", "war", "wav", "wb2", "wma", "wmf", "wmv", "wpd", "wps", "x3f", "x11", "xis", "xla", "xlam", "xlk", "xlm", "xlr", "xls"" (Indicator: "vbox") "VirtualBox Graphics Adapter" (Indicator: "virtualbox") "VMware SVGA" (Indicator: "vmware") "VMSrvc" (Indicator: "vmsrvc") "VMUSrvc" (Indicator: "vmusrvc") "VBoxTrayToolWndClass" (Indicator: "vbox") "VBoxTrayToolWndClass" (Indicator: "vboxtray") "VBoxTrayToolWnd" (Indicator: "vbox") "VBoxTrayToolWnd" (Indicator: "vboxtray") "vmtoolsd" (Indicator: "vmtools") "vmwaretray" (Indicator: "vmware") "vmwaretray" (Indicator: "vmwaretray") "vmwareuser" (Indicator: "vmware") "vmwareuser" (Indicator: "vmwareuser") ""sldm", "sldx", "sql", "sqlite", "sqlite-shm", "sqlite-wal", "sqlite3", "sqlitedb", "sr2", "srb", "srf", "srs", "srt", "srw", "st4", "st5", "st6", "st7", "st8", "stc", "std", "sti", "stm", "stw", "stx", "svg", "swf", "sxc", "sxd", "sxg", "sxi", "sxm", "sxw", "tbb", "tbn", "tex", "tga", "thm", "tlg", "tlx", "txt", "usr", "vbox", "vdi", "vhd", "vhdx", "vmdk", "vmsd", "vmx", "vmxf", "vob", "wab", "wad", "wallet", "war", "wav", "wb2", "wma", "wmf", "wmv", "wpd", "wps", "x3f", "x11", "xis", "xla", "xlam", "xlk", "xlm", "xlr", "xls" (Indicator: "vbox")2f:T6f6,".

\r\n

# Read the following instructions carefully to decrypt your files.

\r\n
\r\n\t\t\t

\r\n -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\t\t\t
\r\n %Encrypted\r\n
\r\n -----END KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\t\t\t

\r\n\t\t\t
\r\n\t\t\t

What happened to my computer?

\r\n\t\t\t

All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by" (Source: 9c88c66f44eba049dcf45204315aaf8ba1e660822f9e97aec51b1c305f5fdf14.bin, Indicator: "decrypt your files") "!\r\n

DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!

\r\n

DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE!

\r\n \r\n
\r\n\t\t\t

Additional

\r\n\t\t\t

\r\n

Project" (Source: 9c88c66f44eba049dcf45204315aaf8ba1e660822f9e97aec51b1c305f5fdf14.bin, Indicator: "decrypt your files") "/C reg add \"HKLM\\SOFTWARE\\CheckMAL\\AppCheck\" /v ProductVersion /t REG_SZ /d \"Please contact with \"Kraken Cryptor\" support for decrypt your files.\" /f" (Source: 60000f4-~, Indicator: "decrypt your files") "
# Read the following instructions carefully to decrypt your files.
" (Source: # How to Decrypt Files.html, Indicator: "decrypt your files") "
DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!