24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.SP.Sneaky.Generic Sample b4bf6322c67a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b4bf6322c67a…. Malware family: Mint.SP.Sneaky.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","keywords":["Malicious","Mint.SP.Sneaky.Generic","malware analysis","sandbox report","threat intelligence","b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.SP.Sneaky.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta76,".exe" wrote bytes "c0df73771cf97277ccf872770d64747700000000c011b47600000000fc3eb47600000000e013b476000000009457377525e07377c6e0737700000000bc6a367500000000cf31b4760000000093193775000000002c32b47600000000" to virtual address "0x76191000" (part of module "NSI.DLL") ".exe" wrote bytes "711165007a3b6400ab8b02007f950200fc8c0200729602006cc805001ecd61007d266100" to virtual address "0x771407E4" (part of module "USER32.DLL") "HncChecker.exe" wrote bytes "b880118872ffe0" to virtual address "0x76E11368" (part of module "WS2_32.DLL") "HncChecker.exe" wrote bytes "d83afd74" to virtual address "0x74FE0274" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "b890128872ffe0" to virtual address "0x74FD3AD8" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "d83a0200" to virtual address "0x74FD4E38" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "a0118872" to virtual address "0x764CE324" (part of module "WININET.DLL") "HncChecker.exe" wrote bytes "b4360200" to virtual address "0x74FD4D68" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "d83afd74" to virtual address "0x74FE01E0" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "b436fd74" to virtual address "0x74FE025C" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "a0118872" to virtual address "0x73DE4028" (part of module "WEBIO.DLL") "HncChecker.exe" wrote bytes "711165007a3b6400ab8b02007f950200fc8c0200729602006cc805001ecd61007d266100" to virtual address "0x771407E4" (part of module "USER32.DLL") "HncChecker.exe" wrote bytes "7d07777781ed7577ae867477c6e07377effd76772d16757760147777478d7477a8e273776089747700000000ad37e1768b2de176b641e17600000000" to virtual address "0x73C31000" (part of module "WSHTCPIP.DLL") "HncChecker.exe" wrote bytes "b436fd74" to virtual address "0x74FE01E4" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "d83afd74" to virtual address "0x74FE0258" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "b436fd74" to virtual address "0x74FE0278" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "b436fd74" to virtual address "0x74FE0200" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "b4360200" to virtual address "0x74FD4EA4" (part of module "SSPICLI.DLL") "HncChecker.exe" wrote bytes "c0df73771cf97277ccf872770d64747700000000c011b47600000000fc3eb47600000000e013b476000000009457377525e07377c6e0737700000000bc6a367500000000cf31b4760000000093193775000000002c32b47600000000" to virtual address "0x76191000" (part of module "NSI.DLL") "HncChecker.exe" wrote bytes "d83afd74" to virtual address "0x74FE01FC" (part of module "SSPICLI.DLL")26:T470,".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\HncChecker.exe" (Handle: 188) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\HncChecker.exe" (Handle: 188) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\HncChecker.exe" (Handle: 188) ".exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\HncChecker.exe" (Handle: 188) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)27:T471,Found malicious artifacts related to "183.111.174.88": ... URL: http://bitc.kr/MyDB/ (AV positives: 1/80 scanned on 05/13/2020 03:41:54) URL: http://applemoneyplus.com/ (AV positives: 1/71 scanned on 10/26/2019 21:31:32) URL: http://myungs.com/plus/x/index.html (AV positives: 2/71 scanned on 08/08/2019 16:19:03) URL: http://bitc.kr/ (AV positives: 1/70 scanned on 07/01/2019 00:01:05) URL: http://bitc.kr/MyDB/USB.exe (AV positives: 2/70 scanned on 06/28/2019 19:55:42) File SHA256: 979f5e041a05d5f72288667246bb7d2feb1ed5b9c535f3d5f9be9c33c9e9018c (AV positives: 12/71 scanned on 08/28/2019 16:29:00) File SHA256: 5b7af0623dab2ffc0cb66b3f70caebcd9c4b2d3eafbd2c33386becd71f24868a (AV positives: 12/70 scanned on 07/11/2019 12:38:35) File SHA256: 471dac5e86118cd28189747f2d8f1152c4031447c72f9bb42a061cc3d50c36e8 (AV positives: 13/68 scanned on 03/31/2019 12:11:09) File SHA256: f30ef5cd4b5c73f3689d0bec55c215d1567ae68e33f80a9b109509e7dfcdb7ff (AV positives: 36/71 scanned on 03/21/2019 01:47:41) File SHA256: d8737fee6fd99ba12bcc3fd0630748f6e6a1fd691cf65394d93ed6ec42f5321b (AV positives: 16/68 scanned on 11/12/2018 20:46:36)28:T4e3,GetLocalTime@KERNEL32.dll at 7570-179-0040B940 GetSystemTime@KERNEL32.dll at 7570-180-0040B240 GetLocalTime@KERNEL32.dll at 7570-155-0040BB20 GetLocalTime@KERNEL32.dll at 7570-178-0040BA60 GetLocalTime@KERNEL32.DLL at 00009483-00002820-4045-259-00405BA0 GetLocalTime@KERNEL32.DLL at 00009483-00002820-4045-115-0040B940 GetSystemTime@KERNEL32.DLL at 00009483-00002820-4045-116-0040B240 GetLocalTime@KERNEL32.DLL at 00009483-00002820-4045-114-0040BA60 GetLocalTime@KERNEL32.DLL at 00009483-00002820-4045-192-00407300 GetLocalTime@KERNEL32.DLL at 00009483-00002820-4045-91-0040BB20 GetLocalTime@KERNEL32.DLL at 00009483-00002820-9158-91-0040BB20 GetSystemTime@KERNEL32.DLL at 00009483-00002820-9158-116-0040B240 GetLocalTime@KERNEL32.DLL at 00009483-00002820-9158-259-00405BA0 GetLocalTime@KERNEL32.DLL at 00009483-00002820-9158-192-00407300 GetLocalTime@KERNEL32.DLL at 00009483-00002820-9158-114-0040BA60 GetLocalTime@KERNEL32.DLL at 00009483-00002820-9158-115-0040B940 GetLocalTime@KERNEL32.DLL at 00009820-00002856-13892-115-0040B940 GetSystemTime@KERNEL32.DLL at 00009820-00002856-13892-116-0040B240 GetLocalTime@KERNEL32.DLL at 00009820-00002856-13892-91-0040BB20 GetLocalTime@KERNEL32.DLL at 00009820-00002856-13892-192-0040730029:T461,GetVersion@KERNEL32.dll at 7570-1-0040D4BE GetVersion@KERNEL32.DLL at 00009483-00002820-4045-1-0040D4BE GetVersionExW@KERNEL32.DLL at 00009483-00002820-4045-208-00402B10 GetVersionExA@KERNEL32.DLL at 00009483-00002820-4045-69-0041077F GetVersionExA@KERNEL32.DLL at 00009483-00002820-9158-69-0041077F GetVersion@KERNEL32.DLL at 00009483-00002820-9158-1-0040D4BE GetVersionExW@KERNEL32.DLL at 00009483-00002820-9158-208-00402B10 GetVersion@KERNEL32.DLL at 00009820-00002856-13892-1-0040D4BE GetVersionExW@KERNEL32.DLL at 00009820-00002856-13892-208-00402B10 GetVersionExA@KERNEL32.DLL at 00009820-00002856-13892-69-0041077F GetVersion@KERNEL32.DLL at 00009820-00002856-19070-1-0040D4BE GetVersionExA@KERNEL32.DLL at 00009820-00002856-19070-69-0041077F GetVersionExW@KERNEL32.DLL at 00009820-00002856-19070-208-00402B10 GetVersionExA@KERNEL32.DLL at 00009820-00002856-23994-69-0041077F GetVersion@KERNEL32.DLL at 00009820-00002856-23994-1-0040D4BE GetVersionExW@KERNEL32.DLL at 00009820-00002856-23994-208-00402B10 GetVersion@KERNEL32.dll at 27467-1-0040D4BE GetVersionExW@KERNEL32.dll at 27467-273-00402B102a:T467,Module32FirstW@KERNEL32.DLL at 00009483-00002820-4045-245-00403B10 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009483-00002820-4045-247-00403710 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009483-00002820-4045-237-00404CA0 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009483-00002820-9158-247-00403710 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009483-00002820-9158-237-00404CA0 Module32FirstW@KERNEL32.DLL at 00009483-00002820-9158-245-00403B10 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009820-00002856-13892-247-00403710 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009820-00002856-13892-237-00404CA0 Module32FirstW@KERNEL32.DLL at 00009820-00002856-13892-245-00403B10 Module32FirstW@KERNEL32.DLL at 00009820-00002856-19070-245-00403B10 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009820-00002856-19070-237-00404CA0 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009820-00002856-19070-247-00403710 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009820-00002856-23994-237-00404CA0 Module32FirstW@KERNEL32.DLL at 00009820-00002856-23994-245-00403B10 CreateToolhelp32Snapshot@KERNEL32.DLL at 00009820-00002856-23994-247-004037102b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAERGZmZmZmZmZmRERAAAAEZmd3d3d3iIiIh3d3ZAAABniIiIiP////+IiIiIZAAAZ4iP//////////+IiHQABGiIiP//h3d3eP/4iIiEAARoiIj//4dmZmj/+IiIhgAEaIiIj/+Hd3d4/4iIiIYABGiIiI//hmZmaP+IiIiGAARoiIiIj4d3d3j4iIiIhgAEaIiIiI+Hd3do+IiIiIYABGiIiIiPhmZmaPiIiIiGAARoiIiIiIZmZmiIiIiIhgAEaIiIiIiGZmZoiIiIiIYABGiIiIiIhmZmaIiIiIiGAARoiIiP/4ZmZmiIiIiIhgAEaPiP+Hd2ZmZnd4iIiIYABGj///hmZmZmZmaIiIiGAARo////hndnd3do/4iIhgAEaP////d3d3d2f///+IYABGj////4d3d3Z4////+GAARo/////4d3d3j/////hgAEaP/////4d3eP/////4YABHj//////4d3//////92AAR4///////3f///////dAAEd////////////////3QAR3eP//////////////h0AAB3eIiIj//////4iIiHZAAAd3d3d3d3d3d3d3d3dmAAAAR2ZEREREREREREREQAAAAAYAAAAAAAAAAAAAAEAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAB4AAADw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790588838895,"unified_at":"2026-09-28T09:47:18.895Z","metadata":{"hashes":{"sha256":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","sha1":"323258353c244b373c758906d88a2bf9663abf8d","md5":"34c2ac6daa44116713f882694b6b41e8","sha512":"5d4368d9de8c15b8b2945ad0aebf1bdc9c5e14dfc2927fb43d254f129675285278116ac9f32e0e3b11aeac10b488fa78c9c57ef1634a911ab76a583b27c4af81","ssdeep":"3072:rNXQoaFxes6EiH6Zq2dIvkapOztAzfb7zgntbeGfCDQomoRoYohoYoloodocoomn:rNXQoaFA6TdIvbxHFGfCDtoLb779qPb","ssdeep_chunks":["3072:rNXQoaF","3072:NXQoaFx","3072:XQoaFxe","3072:QoaFxes","3072:oaFxes6","3072:aFxes6E","3072:Fxes6Ei","3072:xes6EiH","3072:es6EiH6","3072:s6EiH6Z","3072:6EiH6Zq","3072:EiH6Zq2","3072:iH6Zq2d","3072:H6Zq2dI","3072:6Zq2dIv","3072:Zq2dIvk","3072:q2dIvka","3072:2dIvkap","3072:dIvkapO","3072:IvkapOz","3072:vkapOzt","3072:kapOztA","3072:apOztAz","3072:pOztAzf","3072:OztAzfb","3072:ztAzfb7","3072:tAzfb7z","3072:Azfb7zg","3072:zfb7zgn","3072:fb7zgnt","3072:b7zgntb","3072:7zgntbe","3072:zgntbeG","3072:gntbeGf","3072:ntbeGfC","3072:tbeGfCD","3072:beGfCDQ","3072:eGfCDQo","3072:GfCDQom","3072:fCDQomo","3072:CDQomoR","3072:DQomoRo","3072:QomoRoY","3072:omoRoYo","3072:moRoYoh","3072:oRoYoho","3072:RoYohoY","3072:oYohoYo","3072:YohoYol","3072:ohoYolo","3072:hoYoloo","3072:oYolood","3072:Yoloodo","3072:oloodoc","3072:loodoco","3072:oodocoo","3072:odocoom","3072:docoomn","6144:rNXQoaF","6144:NXQoaFx","6144:XQoaFxe","6144:QoaFxes","6144:oaFxes6","6144:aFxes6E","6144:Fxes6Ei","6144:xes6EiH","6144:es6EiH6","6144:s6EiH6Z","6144:6EiH6Zq","6144:EiH6Zq2","6144:iH6Zq2d","6144:H6Zq2dI","6144:6Zq2dIv","6144:Zq2dIvk","6144:q2dIvka","6144:2dIvkap","6144:dIvkapO","6144:IvkapOz","6144:vkapOzt","6144:kapOztA","6144:apOztAz","6144:pOztAzf","6144:OztAzfb","6144:ztAzfb7","6144:tAzfb7z","6144:Azfb7zg","6144:zfb7zgn","6144:fb7zgnt","6144:b7zgntb","6144:7zgntbe","6144:zgntbeG","6144:gntbeGf","6144:ntbeGfC","6144:tbeGfCD","6144:beGfCDQ","6144:eGfCDQo","6144:GfCDQom","6144:fCDQomo","6144:CDQomoR","6144:DQomoRo","6144:QomoRoY","6144:omoRoYo","6144:moRoYoh","6144:oRoYoho","6144:RoYohoY","6144:oYohoYo","6144:YohoYol","6144:ohoYolo","6144:hoYoloo","6144:oYolood","6144:Yoloodo","6144:oloodoc","6144:loodoco","6144:oodocoo","6144:odocoom","6144:docoomn","3072:NXQoaFA","3072:XQoaFA6","3072:QoaFA6T","3072:oaFA6Td","3072:aFA6TdI","3072:FA6TdIv","3072:A6TdIvb","3072:6TdIvbx","3072:TdIvbxH","3072:dIvbxHF","3072:IvbxHFG","3072:vbxHFGf","3072:bxHFGfC","3072:xHFGfCD","3072:HFGfCDt","3072:FGfCDto","3072:GfCDtoL","3072:fCDtoLb","3072:CDtoLb7","3072:DtoLb77","3072:toLb779","3072:oLb779q","3072:Lb779qP","3072:b779qPb"],"imphash":"286a6d2c70e3abce9178b4dde553be1e"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":413696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296353000,"last_seen":1698060946000,"last_multi_scan":1698060946000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["autophyte","corkow","foggybrass","meteit","nukesped","apt","lazarus","labyrinthchollima","manuscrypt","targeted"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":17,"suspicious_count":18,"malicious_count":15,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Akdoor.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.413696.177","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.SP.Sneaky.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Agent-7787914-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.SP.Sneaky.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/NukeSped.AW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic Downloader.x","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.dyiqsz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-BEMP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Manuscrypt.413696","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Backdoo.FBD574B8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Backdoo.FBD574B8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/NukeSped.B.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.Win32.211","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.SP.Sneaky.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"malicious","value":"Tries to delete registry keys using reg.exe"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"malicious","value":"Tries to delete registry keys using reg.exe"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.boniel.co.kr\"\n \"www.genesispure.kr\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"183.111.174.88:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\tmp01632.bat\"\n \"HncChecker.exe\" created file \"%TEMP%\\gwdf.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\tmp01632.bat\" on 2020-5-13.07:34:20.593\n \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\gwdf.bat\" on 2020-5-13.07:59:01.046","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"HncChecker.exe\" with commandline \"/s\" (UID: 00178652-00000852)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\tmp01632.bat\" (UID: 00178655-00002924)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\gwdf.bat\" (UID: 00184664-00003580)\n Spawned process \"reg.exe\" with commandline \"reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Current ...\" (UID: 00184673-00001164)\n Spawned process \"reg.exe\" with commandline \"reg delete HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Curren ...\" (UID: 00184680-00003396)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"HncChecker.exe\" with commandline \"/s\" (UID: 00178652-00000852)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\tmp01632.bat\" (UID: 00178655-00002924)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\gwdf.bat\" (UID: 00184664-00003580)\n Spawned process \"reg.exe\" with commandline \"reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Current ...\" (UID: 00184673-00001164)\n Spawned process \"reg.exe\" with commandline \"reg delete HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Curren ...\" (UID: 00184680-00003396)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"HncChecker.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"tmp01632.bat\" has type \"ASCII text with CRLF line terminators\"\n \"gwdf.bat\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"HncChecker.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"HncChecker.exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \"HncChecker.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \"HncChecker.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\reg.exe\"\n \"reg.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\reg.exe.mui\"\n \"reg.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"reg.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.yahoo.com\"\n Pattern match: \"www.uc.com\"\n Pattern match: \"www.paypal.com\"\n Pattern match: \"www.oracle.com\"\n Pattern match: \"www.microsoft.com\"\n Pattern match: \"www.hp.com\"\n Pattern match: \"www.dell.com\"\n Pattern match: \"www.bing.com\"\n Pattern match: \"www.apple.com\"\n Pattern match: \"www.amazon.com\"\n Heuristic match: \"all.baidu.com\"\n Heuristic match: \"ad.naver.com\"\n Pattern match: \"http://www.genesispure.kr/upload/main.php\"\n Pattern match: \"http://www.boniel.co.kr/html/face/board.php\"\n Pattern match: \"www.boniel.co.kr\"\n Pattern match: \"www.genesispure.kr\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"www.paypal.com\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"HncChecker.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"HncChecker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"HncChecker.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"HncChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/79 reputation engines marked \"http://www.uc.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /html/face/board.php HTTP/1.1\nCache-Control: max-age=0\nConnection: Keep-Alive\nContent-Type: multipart/form-data; boundary=----FormBoundarybKyvQbOzrvSBnE6Ea\nAccept: */*\nAccept-Language: ko-KR\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 389\nHost: www.boniel.co.kr\" with no payload\n \"POST /html/face/board.php HTTP/1.1\nCache-Control: max-age=0\nConnection: Keep-Alive\nContent-Type: multipart/form-data; boundary=----FormBoundaryWbDWJRjQ9k7XoZpcIh\nAccept: */*\nAccept-Language: ko-KR\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 390\nHost: www.boniel.co.kr\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"HncChecker.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"HNCCHECKER\"; Value: \"\"%USERPROFILE%\\HncChecker.exe\" /s\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 183.111.174.88 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"HncChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetTempPathA\n WriteFile\n CopyFileW\n GetModuleFileNameW\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n TerminateProcess\n LoadLibraryW\n GetVersionExW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n FindNextFileW\n FindFirstFileW\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleW\n CreateProcessA\n CreateProcessW\n Sleep\n VirtualAlloc\n WSAStartup","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%USERPROFILE%\\HncChecker.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ETPRO MALWARE Win32/Agent.WTE/Manuscrypt HTTP CnC Beacon\" (SID: 2821725, Rev: 5, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/72 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/72 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"52/72 Antivirus vendors marked dropped file \"HncChecker.exe\" as malicious (classified as \"Trojan.Generic\" with 72% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"52/72 Antivirus vendors marked spawned process \"HncChecker.exe\" (PID: 852) as malicious (classified as \"Trojan.Generic\" with 72% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"C:\\b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe\"\n \".exe\" allocated memory in \"%USERPROFILE%\\HncChecker.exe:Zone.Identifier\"\n \"HncChecker.exe\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$26","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"APT_Lazarus_RAT_Jun18_1\" classified file \"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.bin\" as \"lazarus,apt\" based on indicators: \"Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\",Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\",Content-Disposition: form-data; name=\"board_id\",Cache-Control: max-age=0\" (Reference: https://twitter.com/DrunkBinary/status/1002587521073721346, Author: Florian Roth)\n YARA signature \"APT_Lazarus_RAT_Jun18_1\" classified file \"HncChecker.exe\" as \"lazarus,apt\" based on indicators: \"Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\",Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\",Content-Disposition: form-data; name=\"board_id\",Cache-Control: max-age=0\" (Reference: https://twitter.com/DrunkBinary/status/1002587521073721346, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"malicious","category":"System Security","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v HncChecker /f\" (UID: 00184673-00001164)\n Process \"reg.exe\" with commandline \"reg delete HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v HncChecker /f\" (UID: 00184680-00003396)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"HncChecker.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00178546-00003828)\n Spawned process \"HncChecker.exe\" with commandline \"/s\" (UID: 00178652-00000852)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\tmp01632.bat\" (UID: 00178655-00002924)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\gwdf.bat\" (UID: 00184664-00003580)\n Spawned process \"reg.exe\" with commandline \"reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v HncChecker /f\" (UID: 00184673-00001164)\n Spawned process \"reg.exe\" with commandline \"reg delete HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v HncChecker /f\" (UID: 00184680-00003396)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00065227-00003084) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00065227-00003084) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"reg.exe\" (UID: 00070910-00003140) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"HncChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"HncChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"HncChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$28","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00009483-00002820-4045-267-00405A50\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009483-00002820-4045-221-00406160\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009483-00002820-9158-267-00405A50\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009483-00002820-9158-221-00406160\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009820-00002856-13892-267-00405A50\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009820-00002856-13892-221-00406160\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009820-00002856-19070-267-00405A50\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009820-00002856-19070-221-00406160\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009820-00002856-23994-221-00406160\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00009820-00002856-23994-267-00405A50","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOGPFAULTERRORBOX\n \"\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"HncChecker.exe\" set its error mode to SEM_NOGPFAULTERRORBOX\n \"HncChecker.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00009483-00002820-4045-518-00412FAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009483-00002820-4045-561-00412F9B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009483-00002820-9158-518-00412FAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009483-00002820-9158-561-00412F9B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009820-00002856-13892-561-00412F9B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009820-00002856-13892-518-00412FAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009820-00002856-19070-518-00412FAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009820-00002856-19070-561-00412F9B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009820-00002856-23994-518-00412FAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009820-00002856-23994-561-00412F9B\n SetUnhandledExceptionFilter@KERNEL32.dll at 27467-672-00412F9B\n SetUnhandledExceptionFilter@KERNEL32.dll at 27467-604-00412FAE","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 115 calls to GetProcAddress@KERNEL32.DLL at 00009483-00002820-4045-18-00401470\n Found 115 calls to GetProcAddress@KERNEL32.DLL at 00009483-00002820-9158-18-00401470\n Found 115 calls to GetProcAddress@KERNEL32.DLL at 00009820-00002856-13892-18-00401470\n Found 115 calls to GetProcAddress@KERNEL32.DLL at 00009820-00002856-19070-18-00401470\n Found 115 calls to GetProcAddress@KERNEL32.DLL at 00009820-00002856-23994-18-00401470","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$29","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"HncChecker.exe\" created file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"HncChecker.exe\" created file \"%WINDIR%\\system32\\tzres.dll\"\n \"HncChecker.exe\" created file \"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.2.2.2\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"$2a","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%USERPROFILE%\\HncChecker.exe\"\n \"\" allocated memory in \"C:\\Windows\\System32\\cmd.exe\"\n \"HncChecker.exe\" allocated memory in \"C:\\Windows\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"%USERPROFILE%\\HncChecker.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["autophyte","corkow","foggybrass","meteit","nukesped","apt","lazarus","labyrinthchollima","manuscrypt","targeted"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"60fb7f8b6510ce620824025e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Mint.SP.Sneaky","contacted_countries":["KOR"],"submit_name":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe","analysis_start_time":"2021-07-24T02:48:47+00:00","indicators_count":{"informative":16,"suspicious":16,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5ebb868d6fedb973f6278648","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["KOR"],"submit_name":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe","analysis_start_time":"2020-05-13T05:33:06+00:00","indicators_count":{"informative":14,"suspicious":13,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56bfa42e0e316d3a513a84f8","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["KOR"],"submit_name":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba(4)","analysis_start_time":"2016-02-13T15:46:41+00:00","indicators_count":{"informative":10,"suspicious":18,"malicious":8},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"183.111.174.88","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"address":"58.229.163.18","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"address":"117.52.91.52","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}],"dns_resolutions":[{"domain":"www.boniel.co.kr","address":"183.111.174.88","ttl":1258,"country":"Korea, Republic of","registrar_name":"Whois Corp.(http://whois.co.kr)","registrar_name_servers":"ns1.cafe24.com","registrar_creation_date":"2008-07-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"domain":"www.genesispure.kr","ttl":299,"country":"-","registrar_name":"Whois Corp.(http://whois.co.kr)","registrar_name_servers":"ns1.whoisdomain.kr","registrar_creation_date":"2008-09-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}],"http_requests":[{"host":"www.boniel.co.kr","host_ip":"183.111.174.88:80","url":"/html/face/board.php","method":"POST","header":"POST /html/face/board.php HTTP/1.1\nCache-Control: max-age=0\nConnection: Keep-Alive\nContent-Type: multipart/form-data; boundary=----FormBoundarybKyvQbOzrvSBnE6Ea\nAccept: */*\nAccept-Language: ko-KR\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 389\nHost: www.boniel.co.kr","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"host":"www.genesispure.kr","host_ip":"117.52.91.52:80","url":"/upload/main.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"}],"processes":[{"pid":3828,"ppid":0,"name":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe","command_line":"","sha256":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","normalized_path":"C:\\b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe","uid":"00178546-00003828","icon":"$2b"},{"pid":852,"ppid":3828,"name":"HncChecker.exe","command_line":"/s","sha256":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","normalized_path":"%USERPROFILE%\\HncChecker.exe","parent_uid":"00178546-00003828","uid":"00178652-00000852"},{"pid":3580,"ppid":852,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\gwdf.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00178652-00000852","uid":"00184664-00003580"},{"pid":1164,"ppid":3580,"name":"reg.exe","command_line":"reg delete HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v HncChecker /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00184664-00003580","uid":"00184673-00001164"},{"pid":3396,"ppid":3580,"name":"reg.exe","command_line":"reg delete HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v HncChecker /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00184664-00003580","uid":"00184680-00003396"},{"pid":2924,"ppid":3828,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %TEMP%\\tmp01632.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00178546-00003828","uid":"00178655-00002924"}],"all_imported_dlls":["userenv.dll","nlaapi.dll","KernelBase.dll","webio.dll","tzres.dll","gdi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","winnsi.dll","wow64.dll","sspicli.dll","winhttp.dll","msctf.dll","apphelp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","advapi32.dll","sechost.dll","shell32.dll","oleaut32.dll","urlmon.dll","normaliz.dll","dhcpcsvc6.dll","wow64cpu.dll","api-ms-win-downlevel-user32-l1-1-0.dll","version.dll","imm32.dll","cryptsp.dll","winbrand.dll","kernel32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wininet.dll","IPHLPAPI.DLL","ws2_32.dll","lpk.dll","wtsapi32.dll","mswsock.dll","WSHTCPIP.DLL","dnsapi.dll","credssp.dll","user32.dll","iertutil.dll","wsock32.dll","NapiNSP.dll","api-ms-win-core-synch-l1-2-0.dll","wow64win.dll","msvcrt.dll","cryptbase.dll","winrnr.dll","FWPUCLNT.DLL","ole32.dll","profapi.dll","dhcpcsvc.dll","pnrpnsp.dll","rasadhlp.dll","ntdll.dll","usp10.dll","shlwapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rpcrt4.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nsi.dll","cfgmgr32.dll","wship6.dll","wshqos.dll","crypt32.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"HncChecker.exe","sha256":"b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"name":"gwdf.bat","sha256":"70fcf37abc236f2ece4e940e3e9cb3c0e253359d088bec81ba335b135ed14bda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"name":"tmp01632.bat","sha256":"3f2b262d3b2925b1cd459fdf24451df8525e84f3ef4e6d8b04776e37b26f5c61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}],"files_written":[{"path":"C:\\b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%USERPROFILE%\\HncChecker.exe","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"C:\\b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%USERPROFILE%\\HncChecker.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%TEMP%\\tmp01632.bat","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%WINDIR%\\SysWOW64\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"path":"%TEMP%\\gwdf.bat","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"C:\\b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba_4_.exe","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]},{"key":"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"key":"SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"56bfa42e0e316d3a513a84f8"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\HNCCHECKER\\HNCCHECKER","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\HNCCHECKER\\HNCCHECKER","sources":[{"report_type":"sandbox","report_id":"5ebb868d6fedb973f6278648"},{"report_type":"sandbox","report_id":"60fb7f8b6510ce620824025e"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["60fb7f8b6510ce620824025e","56bfa42e0e316d3a513a84f8","5ebb868d6fedb973f6278648"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Mint.SP.Sneaky.Generic Sample b4bf6322c67a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b4bf6322c67a…. Malware family: Mint.SP.Sneaky.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.SP.Sneaky.Generic Sample b4bf6322c67a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b4bf6322c67a…. Malware family: Mint.SP.Sneaky.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b4bf6322c67a23553d5a9af6fcd9510eb613ffac963a21e32a9ced83132a09ba"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.SP.Sneaky.Generic Sample b4bf6322c67a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b4bf6322c67a…. Malware family: Mint.SP.Sneaky.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]