26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a383cc821d58… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a383cc821d58…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b"],"about":{"@type":"SoftwareApplication","name":"update.php","applicationCategory":["peexe","executable"],"identifier":"a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6ec,"" wrote bytes "c0df10771cf90f77ccf80f770d64117700000000c011fb7500000000fc3efb7500000000e013fb75000000009457ee7525e01077c6e0107700000000bc6aed7500000000cf31fb75000000009319ee75000000002c32fb7500000000" to virtual address "0x770B1000" (part of module "NSI.DLL") "" wrote bytes "0efc137781ed1277ae861177c6e01077effd13772d161277c0fc0f77da8f1a7760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000" to virtual address "0x73441000" (part of module "WSHIP6.DLL") "" wrote bytes "711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201" to virtual address "0x75D007E4" (part of module "USER32.DLL") "" wrote bytes "7d07147781ed1277ae861177c6e01077effd13772d16127760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000" to virtual address "0x73351000" (part of module "WSHTCPIP.DLL") "nslookup.exe" wrote bytes "c0df10771cf90f77ccf80f770d64117700000000c011fb7500000000fc3efb7500000000e013fb75000000009457ee7525e01077c6e0107700000000bc6aed7500000000cf31fb75000000009319ee75000000002c32fb7500000000" to virtual address "0x770B1000" (part of module "NSI.DLL") "nslookup.exe" wrote bytes "0efc137781ed1277ae861177c6e01077effd13772d161277c0fc0f77da8f1a7760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000" to virtual address "0x73441000" (part of module "WSHIP6.DLL") "nslookup.exe" wrote bytes "711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201" to virtual address "0x75D007E4" (part of module "USER32.DLL") "nslookup.exe" wrote bytes "7d07147781ed1277ae861177c6e01077effd13772d16127760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000" to virtual address "0x73351000" (part of module "WSHTCPIP.DLL")28:T4c0,"" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 868) "" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 868) "" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 868) "" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 868) "" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 880) "" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 880) "" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 880) "" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 880) "" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 904) "" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 904) "" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 904) "" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\nslookup.exe" (Handle: 904)29:T6c1,Found malicious artifacts related to "66.171.248.178": ... URL: http://ipv4bot.whatismyipaddress.com/ (AV positives: 1/67 scanned on 06/05/2018 21:00:47) URL: http://bot.whatismyipaddress.com/ (AV positives: 1/67 scanned on 06/03/2018 21:16:07) URL: http://66.171.248.178/ (AV positives: 2/67 scanned on 06/01/2018 15:52:50) URL: https://ipv4bot.whatismyipaddress.com/ (AV positives: 1/68 scanned on 05/29/2018 13:09:41) URL: http://bot.whatismyipaddress.com/work/newexe/10.exe (AV positives: 1/68 scanned on 05/22/2018 08:58:48) File SHA256: ae40389ee103ad40134b47585582295eeb4e2ac20bc503542574113f397067f3 (AV positives: 49/68 scanned on 06/06/2018 08:23:47) File SHA256: 460aee75dee4d1ad25a5cf8c7a9d07ead0b2c7bd59c331bfe354f201c0e460db (AV positives: 47/68 scanned on 06/06/2018 08:23:11) File SHA256: 8880d0b2f4f517f9ea1217dd28c34a801f0b043c97483c0886e4540508767d77 (AV positives: 48/68 scanned on 06/06/2018 08:21:29) File SHA256: 2af9b0cf31b3bdef7aa264a7d9b2f00d1ed24cd62d23cb21916e5768addc91e2 (AV positives: 51/68 scanned on 06/06/2018 08:20:46) File SHA256: 3c2ed6916b04780beba0ebf4a458a5e9a080f2c5ddaeacb793af11aca93da2c9 (AV positives: 49/68 scanned on 06/06/2018 08:19:51) File SHA256: 76cc48017c399f49b3f4b1d89dab0773dde7c8eab943ff154182945f3354a15f (Date: 06/06/2018 07:27:33) File SHA256: d6762129bca1fe3b7ffde654c0be40e9692cc22a8d7b7c5d74b617b919df3d6d (Date: 06/06/2018 06:55:38) File SHA256: 752bbb4e9d44b786205233046ab78fb15f34cd2f7fe962c9c0627a7ebec3cc4e (Date: 06/06/2018 06:45:31) File SHA256: bd6db5a61cdbb277f210c7896a1631cacb00feb10d4932bd83c1cc0f495c2d66 (Date: 06/06/2018 06:38:31) File SHA256: 64798b4eb4479dcf25b0ec4eabf52f51139e74ef3dd78613b08c6d6b44a1fd54 (Date: 06/06/2018 06:28:08)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiJeMzM+6Hd3d3d2Z3c3NyIl7ugzMzd3d3d3c3d3d3ciJeju4zM3d3d3d3d3dzdzIiVVV3ZjM3d3d3N3c3N3dyIlVVdmYzN3d3dzdzd3N3ciVVVWZnMzN3d3dzM3dzd3JWVVVmd3d3d3d3d3dzZ3dyVVVVZnN3d3d3d3d3Znd3clVlVWd3dzczd3d3iHZ3d3VVVjN3NzNzd3M3WIZnd3d1VVd3dzc3N3d3d1g2Z3d3dXc3d3c3d3czMzh3dnd3d3N3d3d3d3d3MzM3d3Z3d8d3d3d3dzd3czMzM3czd3fMd3c3c3dzd3MzMzd3Y2d3fMc3M3N27nczMzM3d3dmdnx3d3dz5u53MzMzd3d3ZmZ3c3d1Ve7lVzMzM3d3d2Zmd3dzh1XoZVgzMzN3d3dmZnd1RFd3VVZVJ3c3d3d3aGZgdURVd1hYVXd3d3d3d4d3d3VEVVVXV7d3V3d3d3d3dmDFRVVVWId3d3d3d3d3dmZgxURVWIWzd3d3d3d3e2ZmYLVUVVhVUzd3d3d4eH12ZmZ1VEhVVTMzMzdXd3d3hmZmdVREVVUzMzOHd3d3d4hmZoiIiFhXMzMzJ3d3d3d2iGZ4iIiIhzMzcyVVd1d3dohmeFiIiIMzOHMlVVVVVVVmiHhVRIiDhzM4hVVVVVVVZoh1VURIh3cziHiIiFV3d2ZmgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790443167973,"unified_at":"2026-09-26T17:19:27.973Z","metadata":{"hashes":{"sha256":"a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b","sha1":"8c31c3728468af5203b44cd7503781947d8adb1e","md5":"7416eae42a244877c73dff0249c7773f","sha512":"21f76cda2e9c7f3fd9773b7a7d9c2df57a06e018fe1923622b29f83b8e521c8b1307c59aa3f4f4e344dce2163d42a1666db9d6849445c6434f4522ada96636d3","ssdeep":"6144:r2z2tKgYmo8bsRe2yNRCTqKLCmbiXuh/BOEnod+2hR:r2AtYmo8rfRC/Cmbi+BsEnN2hR","ssdeep_chunks":["6144:r2z2tKg","6144:2z2tKgY","6144:z2tKgYm","6144:2tKgYmo","6144:tKgYmo8","6144:KgYmo8b","6144:gYmo8bs","6144:Ymo8bsR","6144:mo8bsRe","6144:o8bsRe2","6144:8bsRe2y","6144:bsRe2yN","6144:sRe2yNR","6144:Re2yNRC","6144:e2yNRCT","6144:2yNRCTq","6144:yNRCTqK","6144:NRCTqKL","6144:RCTqKLC","6144:CTqKLCm","6144:TqKLCmb","6144:qKLCmbi","6144:KLCmbiX","6144:LCmbiXu","6144:CmbiXuh","6144:mbiXuh/","6144:biXuh/B","6144:iXuh/BO","6144:Xuh/BOE","6144:uh/BOEn","6144:h/BOEno","6144:/BOEnod","6144:BOEnod+","6144:OEnod+2","6144:Enod+2h","6144:nod+2hR","12288:r2z2tKg","12288:2z2tKgY","12288:z2tKgYm","12288:2tKgYmo","12288:tKgYmo8","12288:KgYmo8b","12288:gYmo8bs","12288:Ymo8bsR","12288:mo8bsRe","12288:o8bsRe2","12288:8bsRe2y","12288:bsRe2yN","12288:sRe2yNR","12288:Re2yNRC","12288:e2yNRCT","12288:2yNRCTq","12288:yNRCTqK","12288:NRCTqKL","12288:RCTqKLC","12288:CTqKLCm","12288:TqKLCmb","12288:qKLCmbi","12288:KLCmbiX","12288:LCmbiXu","12288:CmbiXuh","12288:mbiXuh/","12288:biXuh/B","12288:iXuh/BO","12288:Xuh/BOE","12288:uh/BOEn","12288:h/BOEno","12288:/BOEnod","12288:BOEnod+","12288:OEnod+2","12288:Enod+2h","12288:nod+2hR","6144:r2AtYmo","6144:2AtYmo8","6144:AtYmo8r","6144:tYmo8rf","6144:Ymo8rfR","6144:mo8rfRC","6144:o8rfRC/","6144:8rfRC/C","6144:rfRC/Cm","6144:fRC/Cmb","6144:RC/Cmbi","6144:C/Cmbi+","6144:/Cmbi+B","6144:Cmbi+Bs","6144:mbi+BsE","6144:bi+BsEn","6144:i+BsEnN","6144:+BsEnN2","6144:BsEnN2h","6144:sEnN2hR"],"imphash":"1aee9ce8ea66ce8bcc257da4cc36e160"},"file_info":{"file_name":"update.php","file_type":["peexe","executable"],"file_type_id":"exe","file_size":246793,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1525845644000,"last_seen":1660453879000,"last_multi_scan":1660453879000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["GandCrab","ransomware","Ransomware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":22,"malicious_count":10,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Gandcrab.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.GandCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1209693","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.GandCrab.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Chapak.GB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-2dbfb35e!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.GandCrab.Gen.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.GandCrab.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GandCrab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005308411 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXFI-LX!7416EAE42A24","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fbmqid","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Mauvaise.SL1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EYJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.GandCrab.246793","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.E6F51332","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.E6F51332","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 2475-665-00409499\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011582-00001388-9176-16-004033B8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011582-00001388-9176-445-00403387","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API MessageBoxW@USER32.DLL at 00011582-00001388-9176-19-00404E1A\n Found reference to API IsMenu@USER32.DLL at 00011582-00001388-9176-65-0040C790","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00011582-00001388-9176-143-00402881","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00011582-00001388-9176-67-0040CA30\n GetVersionExW@KERNEL32.DLL at 00011582-00001388-9176-62-0040BA30","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00011582-00001388-9176-142-00402041\n GetProcessHeap@KERNEL32.DLL at 00011582-00001388-9176-1-00401612","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00011582-00001388-00000046-20722579624\n \"\" queries volume information of \"C:\\\" at 00011582-00001388-00000046-21698019124\n \"\" queries volume information of \"C:\\\" at 00011582-00001388-00000046-23288777239","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00011582-00001388-00000046-20722579624\n \"\" queries volume information of \"C:\\\" at 00011582-00001388-00000046-21698019124\n \"\" queries volume information of \"C:\\\" at 00011582-00001388-00000046-23288777239","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"carder.bit\"\n \"ns2.wowservers.ru\"\n \"ns1.wowservers.ru\"\n \"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.171.248.178:80\"\n \"81.4.163.122:53\"\n \"190.35.242.126:53\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=153ec3765fc093d6\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\pc_group=WORKGROUP&ransom_id=153ec3765fc093d6\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1Host: carder.bitUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"nslookup.exe\" with commandline \"nslookup carder.bit ns1.wowservers.ru\" (UID: 00012343-00002572)\n Spawned process \"nslookup.exe\" with commandline \"nslookup ransomware.bit ns2.wowservers.ru\" (UID: 00013071-00003692)\n Spawned process \"nslookup.exe\" with commandline \"nslookup carder.bit ns2.wowservers.ru\" (UID: 00013802-00003740)\n Spawned process \"nslookup.exe\" with commandline \"nslookup ransomware.bit ns1.wowservers.ru\" (UID: 00014521-00005004)\n Spawned process \"nslookup.exe\" with commandline \"nslookup carder.bit ns1.wowservers.ru\" (UID: 00015241-00004248)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"zhfsda.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"OE4FGBAN.htm\" has type \"ASCII text with no line terminators\"\n \"win.ini\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ns2.wowservers.ru\"\n Heuristic match: \"ns1.wowservers.ru\"\n Heuristic match: \"ipv4bot.whatismyipaddress.com\"\n Heuristic match: \"v4bot.whatismyipaddress.com\"\n Heuristic match: \"nslookup carder.bit ns1.wowservers.ru\"\n Heuristic match: \"nslookup ransomware.bit ns2.wowservers.ru\"\n Heuristic match: \"nslookup carder.bit ns2.wowservers.ru\"\n Heuristic match: \"nslookup ransomware.bit ns1.wowservers.ru\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"nslookup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Gand_Crab.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"zhfsda.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.87615192102\n 7.87615192102","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00011582-00001388-9176-529-0041D700\n cpuid at 00011582-00001388-9176-444-00402D1C\n cpuid at 15993-609-00403E54","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET CURRENT_EVENTS DNS Query Domain .bit\" (SID: 2017645, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://ipv4bot.whatismyipaddress.com\" as malicious (1% detection rate)\n 6/68 reputation engines marked \"http://ns1.wowservers.ru\" as malicious (8% detection rate)\n 6/68 reputation engines marked \"http://ns2.wowservers.ru\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 81.4.163.122\"\n \"UDP connection to 190.35.242.126\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"zhfsda.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"TSEQSDBRENT\"; Value: \"\"%APPDATA%\\Microsoft\\zhfsda.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.1.111.0\"\n Heuristic match: \"HTTP/1.1 200 OKCache-Control: privateContent-Type: text/htmlServer: Date: Wed, 06 Jun 2018 08:22:40 GMTConnection: closeContent-Length: 13193.70.47.200\"\n \"193.70.47.200\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\OE4FGBAN.htm\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Gand_Crab.exe.bin\" claimed CRC 281170 while the actual is CRC 298872\n \"zhfsda.exe\" claimed CRC 281170 while the actual is CRC 250942","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n VirtualProtect\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n OutputDebugStringW\n CreateFileW\n Sleep\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"6/68 reputation engines marked \"http://ns1.wowservers.ru\" as malicious (8% detection rate)\n 6/68 reputation engines marked \"http://ns2.wowservers.ru\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"54/65 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"54/65 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00011582-00001388-9176-527-0040D960","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00011582-00001388)\n Spawned process \"nslookup.exe\" with commandline \"nslookup carder.bit ns1.wowservers.ru\" (UID: 00012343-00002572)\n Spawned process \"nslookup.exe\" with commandline \"nslookup ransomware.bit ns2.wowservers.ru\" (UID: 00013071-00003692)\n Spawned process \"nslookup.exe\" with commandline \"nslookup carder.bit ns2.wowservers.ru\" (UID: 00013802-00003740)\n Spawned process \"nslookup.exe\" with commandline \"nslookup ransomware.bit ns1.wowservers.ru\" (UID: 00014521-00005004)\n Spawned process \"nslookup.exe\" with commandline \"nslookup carder.bit ns1.wowservers.ru\" (UID: 00015241-00004248)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"nslookup.exe\" (UID: 00045577-00003692) was launched with new environment variables: \"__COMPAT_LAYER=\"VistaSetup\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\update.php.exe\" marked \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\"\n \"\" touched \"L:\"\n \"\" touched \"M:\"\n \"\" touched \"N:\"\n \"\" touched \"O:\"\n \"\" touched \"P:\"\n \"\" touched \"Q:\"\n \"\" touched \"R:\"\n \"\" touched \"S:\"\n \"\" touched \"T:\"\n \"\" touched \"U:\"\n \"\" touched \"V:\"\n \"\" touched \"W:\"\n \"\" touched \"X:\"\n \"\" touched \"Y:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["GandCrab","ransomware","Ransomware"],"sample_flags":["Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"5b17992b7ca3e1251d1e81d4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CYP","PAN","USA"],"submit_name":"Gand_Crab.exe","analysis_start_time":"2018-06-06T09:17:45+00:00","indicators_count":{"informative":19,"suspicious":23,"malicious":13},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5af28e8b7ca3e1546d7f2158","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gandcrab.Exp","contacted_countries":["JOR","KWT","USA"],"submit_name":"update.php","analysis_start_time":"2018-05-09T08:00:57+00:00","indicators_count":{"informative":19,"suspicious":28,"malicious":13},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.171.248.178","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"address":"81.4.163.122","port":53,"protocol":"UDP","country":"Cyprus","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"address":"190.35.242.126","port":53,"protocol":"UDP","country":"Panama","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"address":"94.249.60.127","port":53,"protocol":"UDP","country":"Jordan","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"address":"89.203.10.56","port":53,"protocol":"UDP","country":"Kuwait","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}],"dns_resolutions":[{"domain":"ns2.wowservers.ru","ttl":149,"country":"-","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"domain":"ns1.wowservers.ru","ttl":149,"country":"-","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"domain":"ipv4bot.whatismyipaddress.com","address":"66.171.248.178","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"domain":"carder.bit","address":"66.171.248.178","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}],"http_requests":[{"host":"carder.bit","host_ip":"66.171.248.178:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: carder.bit\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}],"processes":[{"pid":1372,"ppid":0,"name":"update.php.exe","command_line":"","sha256":"a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b","normalized_path":"C:\\update.php.exe","uid":"00043952-00001372","icon":"$2a"},{"pid":3692,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00045577-00003692"},{"pid":2780,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00046749-00002780"},{"pid":3384,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00047906-00003384"},{"pid":2864,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00049049-00002864"},{"pid":2904,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00050189-00002904"},{"pid":2404,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00051331-00002404"},{"pid":3848,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00052470-00003848"},{"pid":3872,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00053611-00003872"},{"pid":2764,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00054752-00002764"},{"pid":3548,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00055893-00003548"},{"pid":3324,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00057033-00003324"},{"pid":3972,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00058176-00003972"},{"pid":3228,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00059319-00003228"},{"pid":3584,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00060457-00003584"},{"pid":2220,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00061598-00002220"},{"pid":1652,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00062748-00001652"},{"pid":1636,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00063900-00001636"},{"pid":3080,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00065039-00003080"},{"pid":3996,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00066180-00003996"},{"pid":3960,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00067323-00003960"},{"pid":1760,"ppid":1372,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00043952-00001372","uid":"00068465-00001760"}],"all_imported_dlls":["msvcr100.dll","advapi32.dll","dwmapi.dll","msasn1.dll","dnsapi.dll","nlaapi.dll","urlmon.dll","dhcpcsvc.dll","npmproxy.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","webio.dll","winnsi.dll","bcrypt.dll","wow64.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wship6.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","RpcRtRemote.dll","pnrpnsp.dll","nsi.dll","KernelBase.dll","gdi32.dll","wsock32.dll","sspicli.dll","bcryptprimitives.dll","cryptbase.dll","rasadhlp.dll","comctl32.dll","kernel32.dll","msvcrt.dll","wshqos.dll","msctf.dll","ole32.dll","clbcatq.dll","shlwapi.dll","ws2_32.dll","imm32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","mswsock.dll","winrnr.dll","usp10.dll","normaliz.dll","profapi.dll","netprofm.dll","WSHTCPIP.DLL","apphelp.dll","FWPUCLNT.DLL","user32.dll","uxtheme.dll","wininet.dll","userenv.dll","psapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","crypt32.dll","wow64win.dll","sechost.dll","shell32.dll","version.dll","cryptsp.dll","rsaenh.dll","winhttp.dll","rpcrt4.dll","lpk.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","NapiNSP.dll","cfgmgr32.dll","ntdll.dll","wow64cpu.dll","oleaut32.dll","secur32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","devobj.dll","Wldap32.dll","rasman.dll","sfc.dll","setupapi.dll","rtutils.dll","winmm.dll","samcli.dll","msacm32.dll","SensApi.dll","sfc_os.dll","ntmarta.dll","mpr.dll","AcGenral.dll","rpcss.dll","rasapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"zhfsda.exe","sha256":"c75133e9185886db6b86f377c9a0b05c8bd0a8a8bfa39f98fe48e97e62df4538","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"name":"OE4FGBAN.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"name":"win.ini","sha256":"6a83761bb67e530b22d4b65bf09469fab0a453235eaf5a5fc99739b6b53a400f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"inohnk.exe","sha256":"0c178e50eedbd6c464bb22a78324743424f0d63ed7a0c9901ed859391e397aac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"ipv4bot_whatismyipaddress_com[1].htm","sha256":"e38ee7ad0d45a01a4d35a323398574a53313d96a76b8d763cc444bf7624a0576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}],"files_written":[{"path":"%WINDIR%\\win.ini","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"C:\\Gand_Crab.exe","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%APPDATA%\\Microsoft\\zhfsda.exe","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\f97550c135f4b3517b2ed67285c29cdb_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\SysWOW64\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%APPDATA%\\Microsoft\\inohnk.exe","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\S-1-5-18","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\S-1-5-18\\074ebcdc29f7dcc8d683b02525ab4e60_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\074ebcdc29f7dcc8d683b02525ab4e60_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\System32\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\UPDATE_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\UPDATE_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=153ec3765fc093d6","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"},{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=153ec3765fc093d6","sources":[{"report_type":"sandbox","report_id":"5b17992b7ca3e1251d1e81d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\c:!users!otmvkmp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=5f879236c1f7e93e","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\c:!users!otmvkmp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"Local\\c:!users!otmvkmp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=5f879236c1f7e93e","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!otmvkmp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!otmvkmp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!otmvkmp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af28e8b7ca3e1546d7f2158"}]}]}},"report_ids":{"sandbox_job_ids":["5b17992b7ca3e1251d1e81d4","5af28e8b7ca3e1546d7f2158"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a383cc821d58… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a383cc821d58…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a383cc821d58… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a383cc821d58…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a383cc821d58c21466acbb16171c972093a7a6db8646c716ca3b9b710b4d197b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a383cc821d58… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a383cc821d58…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]