26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TSPY_DRIDEX.MFO Sample c0c33a4985b8… — Score 96/100 — Hybrid Analysis","description":"Malicious verdict for sample c0c33a4985b8…. Malware family: TSPY_DRIDEX.MFO. Threat score 96/100. 21/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b","keywords":["Malicious","TSPY_DRIDEX.MFO","malware analysis","sandbox report","threat intelligence","c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b"],"about":{"@type":"SoftwareApplication","name":"bettle.php","applicationCategory":["peexe","executable"],"identifier":"c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b","additionalType":"Malicious sample"},"threatScore":96,"malwareFamily":"TSPY_DRIDEX.MFO","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T468,"" (Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931", Key: "BLOB")28:T59b,"" created file "C:\Windows\system32\en-US\odbcint.dll.mui" "" created file "C:\Windows\system32\en-US\MFC42.DLL.mui" "" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" created file "C:\Windows\explorer.exe\" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" created file "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Cookies" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" created file "C:\Windows\system32\rsaenh.dll" "" created file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "" created file "C:\Windows\system32\en-US\WINHTTP.dll.mui" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S9Y0GKU4\104_131_59_185[1].txt" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QA0UPEJW\104_131_59_185[1].txt"29:Tb65,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2a:T8f9,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")2b:T734,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAT7SURBVFhHzZZNayRFGMeXkGMugWw+iPsJPAnqKaDixU+gt1w9KCh48OIqqAdB8SKYgxchi8pmo6Ab2WhenGQ3mZkk89bv3fPePTP5+/yrqju9k9mdXmHBkD/VXVNVz+956aq6ceP//lcul0G1LAtBGCGM2ojaVCenNtrmnb9TvozNyw1CWLaNQv4+fPgI1WoVpaMjOI6DRqOJbq+PQTxCnIyRjETjMUZKE/MsLfuNOHaYjNAbJugOYvSlDcKwGEClUkGpVILruvA8D7ZADONEGUzEII1S48kEk8mlaa+eFZSAxKKBzGPLuWEUFQM4PDyEJSGPZAIBGFLt9ePGCXB5eYnJlNifRobGOZd9kawzNwUM++npKYIgQLfbVQCeHxgvprw3hgmRSsGoqOjI5MXamQtwfHyMWq0mqqNWr8ORNPT7AxXC/GKp13njWTQMwBWIhikEcHZ2Bl88pvdxHE8ZTvN95fFMgHxKBCYFaReJgO/7GEnOOGlWfp/k+XQarqVFoAoBsFCmvZr1HjcasDbvYCKFOXs8VHHKvy5ScagQAAelnuuFoQUj9X6J3v4B+ltbWaSeFq2JKcZCNZACZMbFcPqnIAzAWD5R64MPjZdpTeQh0wjQe+4Rk2eLgALIvOZTPgraoP/2O09MF0OuQ6+N/zeA3Pd9rdrl02y++BKShlWoZjj/mWpgVmFlUZCABN98i+7xAZrvvo/JaKRSk6XKPGdrmNQVAmChTG+t05/euN9H6+NPZYPqo7f9M5pvvoVIgLyN72H98CNiOQnJoEJvosi2UBHyM8zylttq04XolfP5Fwh+2kTw6z14f5cw7vXQubMJ7/YnsL77Gu7vf6o1xurs0AcRzwOeLXO3Yg7Kb7vZqSeGE4ELftuGu7FxbZ+nMa0xhoOBBlCH0hVAodOQg3jWp1IwPF4DH43PbqP53keyU44ygNQQDacAifyeincCKpa+UFIzNwKBAPAI5QRqqNox7N2/0PzqSwy5VY9HCoJGlIdsHzOaqHvAYBire0ScJHIhiYtdSHy5tajJRpzIZy40lIW42CwpQ2ZObzAE1e2L1HOMjny2nhzxcyPAQR2ZyAl5cTG1sABRBJtW3nCnN0BbrnFaA0RdAZBTdi6A6/kIOz0EmbrqPepSerE/7t/Hzs4OHjzYxd7eHg7kBrUl58KF3CEITaMcq9VT8ymuPRfAduUOGLRFERxpKTfswIs68NsaZnd3F6flCv4pHaF6do79/X08OjmRW7DclmnUGEwNBzKPcooAtGwXdScQSdVL23QDWF6ogFwxQBBbFiIM25btICCc/JYaDNsSwUxd+BHVkduVNz8CDcvBueXhvOXiTMS2ZntopCC+joyOillcYGgk9ZRwFN/Zz3EKvAhAvWWj2nRQrtsoN2xUGo56vxComi1REZCWJ0exgDBVTtBRMArIQGmDItWXtgUBak1LGT6pWUqndf1ebenIXAhE3QkFJERTQFoCYvmsGV0vGZCAqXeBcCQ97Lccd34KTspVVMTjU4mAgmAkROyrMiUGomYHqBkQwjAqOjICY4B0MafqoCIF+9Sv4LXX38Avd7dU2AmgIExblr5K0xUIqQ8DcSFFWjNShSsgWWQMUEtgCGUJyN1723j5lVfxwq1b10Fu3ryJxcVFrK2tYX19/bmIa0sEsLq6OjsSKysrCoKDnocWFhawtLSE5eXlDOBf45qzMv90aKwAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":96,"unified_at_epoch_ms":1790559520736,"unified_at":"2026-09-28T01:38:40.736Z","metadata":{"hashes":{"sha256":"c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b","sha1":"a2723e3a6f1d7293e0d0f1f15ead8eda2da5e822","md5":"265f3b610aed3745ba19fd795a748e57","sha512":"4754ab0372ae38e1ef47d943deb0f5c03114ecf6c097701e0641348de42046b30664685d328bccb8a87945d168cd1af34b01c0703c261f8430959d71606cf336","ssdeep":"3072:UNVn+946cMRDDJqY56ILWiZEMS6/+JufhWwvwmxF1UwJdY0fSFkQIw0IyB:UNV+94LM/qYdSc+8Et0DfTQIVL","ssdeep_chunks":["3072:UNVn+94","3072:NVn+946","3072:Vn+946c","3072:n+946cM","3072:+946cMR","3072:946cMRD","3072:46cMRDD","3072:6cMRDDJ","3072:cMRDDJq","3072:MRDDJqY","3072:RDDJqY5","3072:DDJqY56","3072:DJqY56I","3072:JqY56IL","3072:qY56ILW","3072:Y56ILWi","3072:56ILWiZ","3072:6ILWiZE","3072:ILWiZEM","3072:LWiZEMS","3072:WiZEMS6","3072:iZEMS6/","3072:ZEMS6/+","3072:EMS6/+J","3072:MS6/+Ju","3072:S6/+Juf","3072:6/+Jufh","3072:/+JufhW","3072:+JufhWw","3072:JufhWwv","3072:ufhWwvw","3072:fhWwvwm","3072:hWwvwmx","3072:WwvwmxF","3072:wvwmxF1","3072:vwmxF1U","3072:wmxF1Uw","3072:mxF1UwJ","3072:xF1UwJd","3072:F1UwJdY","3072:1UwJdY0","3072:UwJdY0f","3072:wJdY0fS","3072:JdY0fSF","3072:dY0fSFk","3072:Y0fSFkQ","3072:0fSFkQI","3072:fSFkQIw","3072:SFkQIw0","3072:FkQIw0I","3072:kQIw0Iy","3072:QIw0IyB","6144:UNVn+94","6144:NVn+946","6144:Vn+946c","6144:n+946cM","6144:+946cMR","6144:946cMRD","6144:46cMRDD","6144:6cMRDDJ","6144:cMRDDJq","6144:MRDDJqY","6144:RDDJqY5","6144:DDJqY56","6144:DJqY56I","6144:JqY56IL","6144:qY56ILW","6144:Y56ILWi","6144:56ILWiZ","6144:6ILWiZE","6144:ILWiZEM","6144:LWiZEMS","6144:WiZEMS6","6144:iZEMS6/","6144:ZEMS6/+","6144:EMS6/+J","6144:MS6/+Ju","6144:S6/+Juf","6144:6/+Jufh","6144:/+JufhW","6144:+JufhWw","6144:JufhWwv","6144:ufhWwvw","6144:fhWwvwm","6144:hWwvwmx","6144:WwvwmxF","6144:wvwmxF1","6144:vwmxF1U","6144:wmxF1Uw","6144:mxF1UwJ","6144:xF1UwJd","6144:F1UwJdY","6144:1UwJdY0","6144:UwJdY0f","6144:wJdY0fS","6144:JdY0fSF","6144:dY0fSFk","6144:Y0fSFkQ","6144:0fSFkQI","6144:fSFkQIw","6144:SFkQIw0","6144:FkQIw0I","6144:kQIw0Iy","6144:QIw0IyB","3072:UNV+94L","3072:NV+94LM","3072:V+94LM/","3072:+94LM/q","3072:94LM/qY","3072:4LM/qYd","3072:LM/qYdS","3072:M/qYdSc","3072:/qYdSc+","3072:qYdSc+8","3072:YdSc+8E","3072:dSc+8Et","3072:Sc+8Et0","3072:c+8Et0D","3072:+8Et0Df","3072:8Et0DfT","3072:Et0DfTQ","3072:t0DfTQI","3072:0DfTQIV","3072:DfTQIVL"],"imphash":"0b025ff39559839647e02add9264cbdb"},"file_info":{"file_name":"bettle.php","file_type":["peexe","executable"],"file_type_id":"exe","file_size":208896,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296869000,"last_seen":1677389435000,"last_multi_scan":1677389435000}},"detections":{"summary":{"verdict":"malicious","score":96,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":15,"malicious_count":6,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Tinba","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Tinba","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Taranis.1083","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BPIR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Kelihos.R","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BPIR (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.COYV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Boaxxe.m","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Injector.unrw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PWSZbot-FAKV!265F3B610AED","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.dzitqe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-LU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.MFO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.MFO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject3.VCD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.Eorezo.Win32.21917","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TSPY_DRIDEX.MFO","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.83868394085","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"567aaa0c0e316d9154e09a93"},{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"},{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcess\n CreateFileW\n GetModuleHandleA\n GetStartupInfoA\n CreateThread\n FindNextFileW\n GetModuleFileNameW\n DeleteFileW\n RegDeleteKeyA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"567aaa0c0e316d9154e09a93"},{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"},{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/53 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"567aaa0c0e316d9154e09a93"},{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"},{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 76390000\n \"\" loaded module \"SHELL32.DLL\" at base 766C0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"SHGetSpecialFolderPathW@shell32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.131.59.185:243\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab80CE.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar80EF.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab8390.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar8391.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA4C6.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA4C7.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\6d1ebb1ac03550809aa073c342e55c6d\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00009308-00001092)\n Spawned process \"Explorer.EXE\" with commandline \"\"\n\"\\Device\\HarddiskVolume2\\Windows\\explorer.exe\"\n\"2015-12-23.06:11:21.469\"\n00002df4\n0\n\"C:\\Windows\\Explorer.EXE\" (UID: 00011764-00001548)\n Spawned process \"taskhost.exe\" (UID: 00012227-00001480)\n Spawned process \"taskhost.exe\" (UID: 00015059-00002244)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df\" has type \"data\"\n \"Tar80EF.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"TarA4C7.tmp\" has type \"data\"\n \"Cab8390.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Cab80CE.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"CabA4C6.tmp\" has type \"Microsoft Cabinet archive data, 49695 bytes, 1 file\"\n \"Tar8391.tmp\" has type \"data\"\n \"104_131_59_185[1].txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab80CE.tmp\" for deletion\n \"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar80EF.tmp\" for deletion\n \"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab8390.tmp\" for deletion\n \"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar8391.tmp\" for deletion\n \"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA4C6.tmp\" for deletion\n \"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA4C7.tmp\" for deletion\n \"C:\\bettle.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\104_131_59_185[1].txt\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab80CE.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar80EF.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab8390.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar8391.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabA4C6.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarA4C7.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\104_131_59_185[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053ba775858bb77186abb77653cbc770000000000bfe5760000000056cce576000000007ccae576000000003768d4756a2cbc77d62dbc77000000002069d4750000000029a6e57600000000a48dd47500000000f70ee57600000000\" to virtual address \"0x77D91000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"92e6b77779a8bc77be72bc77d62dbc771de2b77705a2bc77bee3b777616fbc776841ba770050ba7700000000ad3762778b2d6277b641627700000000\" to virtual address \"0x75021000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"7739b87779a8bc77be72bc77d62dbc771de2b77705a2bc77c868bb7757d1c277bee3b777616fbc776841ba770050ba7700000000ad3762778b2d6277b641627700000000\" to virtual address \"0x756F1000\" (part of module \"WSHIP6.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\bettle.exe\"\n \"\" allocated memory in \"C:\\Windows\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00011764-00001548)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$2a","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00008789-00004064)\n Spawned process \"\" (UID: 00009308-00001092)\n Spawned process \"Explorer.EXE\" with commandline \"\"\n\"\\Device\\HarddiskVolume2\\Windows\\explorer.exe\"\n\"2015-12-23.06:11:21.469\"\n00002df4\n0\n\"C:\\Windows\\Explorer.EXE\" (UID: 00011764-00001548)\n Spawned process \"taskhost.exe\" (UID: 00012227-00001480)\n Spawned process \"taskhost.exe\" (UID: 00015059-00002244)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"567aaadc0e316dfc4ecd6e2b","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Injector.COYV","contacted_countries":["USA"],"submit_name":"bettle.exe","analysis_start_time":"2015-12-23T08:08:56+00:00","indicators_count":{"informative":8,"suspicious":21,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"567aaa0c0e316d9154e09a93","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"suspicious","threat_score":12,"malware_family":"Injector.COYV","submit_name":"bettle.exe","analysis_start_time":"2015-12-23T08:05:25+00:00","indicators_count":{"informative":0,"suspicious":2,"malicious":1},"is_in_unified_schema":true},{"id":"567a8b040e316dae5add10d5","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":12,"malware_family":"HW32.Packed","submit_name":"bettle.php","analysis_start_time":"2015-12-23T05:53:29+00:00","indicators_count":{"informative":2,"suspicious":2,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.131.59.185","port":243,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}],"processes":[{"pid":4064,"ppid":0,"name":"bettle.exe","command_line":"","normalized_path":"","uid":"00008789-00004064","icon":"$2b"},{"pid":1092,"ppid":0,"name":"bettle.exe","command_line":"","normalized_path":"","uid":"00009308-00001092"},{"pid":1548,"ppid":0,"name":"Explorer.EXE","command_line":"\",\"\\Device\\HarddiskVolume2\\Windows\\explorer.exe\",\"2015-12-23.06:11:21.469\",00002df4,0,\"C:\\Windows\\Explorer.EXE","normalized_path":"","uid":"00011764-00001548"},{"pid":1480,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00012227-00001480"},{"pid":2244,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00015059-00002244"}],"all_imported_dlls":["MSCTF.dll","LPK.dll","CFGMGR32.dll","msvcrt.dll","ADVAPI32.dll","USP10.dll","odbcint.dll","PSAPI.DLL","SETUPAPI.dll","RPCRT4.dll","sechost.dll","USER32.dll","ole32.dll","ntdll.dll","KERNELBASE.dll","SspiCli.dll","DEVOBJ.dll","GDI32.dll","MFC42.DLL","kernel32.dll","VERSION.dll","IMM32.DLL","CRYPTBASE.dll","OLEAUT32.dll","ODBC32.dll","shell32.dll","advapi32.dll","crypt32.dll","rsaenh.dll","wshqos.dll","cfgmgr32.dll","cryptsp.dll","rtutils.dll","gpapi.dll","gdi32.dll","lpk.dll","msctf.dll","wininet.dll","nsi.dll","nlaapi.dll","bcrypt.dll","imm32.dll","comctl32.dll","wship6.dll","bcryptprimitives.dll","dhcpcsvc.dll","odbc32.dll","shlwapi.dll","wintrust.dll","pnrpnsp.dll","sspicli.dll","profapi.dll","WSHTCPIP.DLL","cryptnet.dll","psapi.dll","NapiNSP.dll","devobj.dll","ntmarta.dll","normaliz.dll","devrtl.dll","dhcpcsvc6.dll","IPHLPAPI.DLL","rasapi32.dll","SensApi.dll","rasadhlp.dll","secur32.dll","KernelBase.dll","mfc42.dll","usp10.dll","Wldap32.dll","schannel.dll","rpcrt4.dll","apphelp.dll","userenv.dll","ncrypt.dll","winhttp.dll","setupapi.dll","winnsi.dll","credssp.dll","webio.dll","oleaut32.dll","iertutil.dll","ws2_32.dll","cryptbase.dll","rasman.dll","urlmon.dll","cabinet.dll","FWPUCLNT.DLL","user32.dll","msasn1.dll","dnsapi.dll","mswsock.dll","winrnr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"104_131_59_185[1].txt","sha256":"92a242d06f7644d998025317226fa11e2c6e80d65ab2a1dcb53af144f6938349","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"Tar80EF.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"Tar8391.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"TarA4C7.tmp","sha256":"99c5a557900b23a4b655aad969ca3c08c57b6849ec709ac5295325afe014bb55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"ce0b0b1fc8c3b224baf114231c174e7decdeaf170978eb18dbcb55b6a8f2f4ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"Cab80CE.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"Cab8390.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"CabA4C6.tmp","sha256":"a300bd739f69c1af1d686c88dc0c0d45957f34822b6df69a42070de2dfa70b99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"408e02f5157bbad1d0893abc5eb1384e063fc05714bbc8d0af1482a8506b82f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}],"files_written":[{"path":"%SAMPLEDIR%\\bettle.exe","sources":[{"report_type":"sandbox","report_id":"567aaa0c0e316d9154e09a93"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"},{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\CSIDL_","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"},{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\CSIDL_X","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"},{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%SAMPLEDIR%\\bettle.php.ex_","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"}]},{"path":"%SAMPLEDIR%\\bettle.php.exe","sources":[{"report_type":"sandbox","report_id":"567a8b040e316dae5add10d5"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%WINDIR%\\explorer.exe\\","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"C:\\bettle.ex_","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"C:\\bettle.exe","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%TEMP%\\Cab80CE.tmp","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%TEMP%\\Cab8390.tmp","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%TEMP%\\CabA4C6.tmp","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\104_131_59_185[1].txt","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\6d1ebb1ac03550809aa073c342e55c6d","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"567aaadc0e316dfc4ecd6e2b"}]}]}},"report_ids":{"sandbox_job_ids":["567aaadc0e316dfc4ecd6e2b","567aaa0c0e316d9154e09a93","567a8b040e316dae5add10d5"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TSPY_DRIDEX.MFO Sample c0c33a4985b8… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c0c33a4985b8…. Malware family: TSPY_DRIDEX.MFO. Threat score 96/100. 21/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b"}],["$","meta","4",{"property":"og:title","content":"Malicious TSPY_DRIDEX.MFO Sample c0c33a4985b8… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c0c33a4985b8…. Malware family: TSPY_DRIDEX.MFO. Threat score 96/100. 21/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TSPY_DRIDEX.MFO Sample c0c33a4985b8… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c0c33a4985b8…. Malware family: TSPY_DRIDEX.MFO. Threat score 96/100. 21/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]