23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c6aa69524212… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c6aa69524212…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254"],"about":{"@type":"SoftwareApplication","name":"casma.exe","applicationCategory":["peexe","executable"],"identifier":"c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T85c,Found malicious artifacts related to "188.120.225.17" (ASN: 29182, Owner: ISPsystem, cjsc): ... URL: http://dev.axeta.ru/ (AV positives: 1/63 scanned on 07/01/2015 12:30:50) URL: http://admin.axeta.ru/wsimg/prjImg/pdImg/mod2.bin (AV positives: 1/63 scanned on 06/26/2015 08:05:16) URL: http://admin.axeta.ru/ (AV positives: 1/63 scanned on 06/11/2015 12:21:59) URL: http://dev.axeta.ru/yii/framework/cli/gnm/add_visitor.php?referrer=http://termix.ru/modules/lib/k.php (AV positives: 3/63 scanned on 06/06/2015 20:03:04) URL: http://dev.axeta.ru/yii/framework/cli/gnm/module.php?id=tt17 (AV positives: 1/63 scanned on 06/06/2015 20:33:13) File SHA256: 1d21805effe4384075ebf50519ca2a6116d8dd63224a5225adeb09c94fd4706d (AV positives: 32/55 scanned on 07/17/2015 04:20:23) File SHA256: ef4009be68959296f2588607df345e2bde5d164bd8577c05125affdb6a681788 (AV positives: 27/56 scanned on 07/17/2015 01:35:54) File SHA256: c0fb73a65c74e07677d4cb1d1a89bb2f6ccbc5064a6ad29c1c73e41f128fe3ab (AV positives: 18/56 scanned on 07/12/2015 15:10:14) File SHA256: c3635ff9cb9a787cdc9db8f4071ed848a96674ecfcb075a40c3024d7ca9b6810 (AV positives: 38/56 scanned on 07/09/2015 19:04:02) File SHA256: d9ce285518379007aaceb31fc6b1801f5f4b116cb894de620db9c15764485b1e (AV positives: 33/56 scanned on 07/05/2015 15:13:38) Found malicious artifacts related to "95.163.121.33" (ASN: 12695, Owner: Digital Networks CJSC): ... URL: http://95.163.121.33/ (AV positives: 3/67 scanned on 04/20/2016 20:50:08) File SHA256: 57cb033fef3221432a12f5a64877f78c384c983b3b697c6cc98333084c768a1e (AV positives: 37/57 scanned on 03/21/2015 07:35:15) File SHA256: b92139486a540d0342c7bdbc36c415cd16a17e12b069b9a86c8a55db1d06d521 (AV positives: 6/23 scanned on 03/19/2015 15:27:01) File SHA256: 71cf9e03d0a7cde196ac85a1b9c3936bb50b91234af5c044501f30771a3db67b (AV positives: 1/57 scanned on 03/19/2015 13:00:39) File SHA256: a26126f609aae62dc8f0311d4e33f61a14a1e68ea8f35b478c5a4e48943eb77d (AV positives: 23/57 scanned on 03/17/2015 06:11:28) File SHA256: ef11dc3f66080e3aadfc26ad4b5209b2a499c7adfb21b488699c377e8e28007c (AV positives: 30/56 scanned on 03/15/2015 18:34:49)25:T85c,Found malicious artifacts related to "188.120.225.17" (ASN: 29182, Owner: ISPsystem, cjsc): ... URL: http://dev.axeta.ru/ (AV positives: 1/63 scanned on 07/01/2015 12:30:50) URL: http://admin.axeta.ru/wsimg/prjImg/pdImg/mod2.bin (AV positives: 1/63 scanned on 06/26/2015 08:05:16) URL: http://admin.axeta.ru/ (AV positives: 1/63 scanned on 06/11/2015 12:21:59) URL: http://dev.axeta.ru/yii/framework/cli/gnm/add_visitor.php?referrer=http://termix.ru/modules/lib/k.php (AV positives: 3/63 scanned on 06/06/2015 20:03:04) URL: http://dev.axeta.ru/yii/framework/cli/gnm/module.php?id=tt17 (AV positives: 1/63 scanned on 06/06/2015 20:33:13) File SHA256: 1d21805effe4384075ebf50519ca2a6116d8dd63224a5225adeb09c94fd4706d (AV positives: 32/55 scanned on 07/17/2015 04:20:23) File SHA256: ef4009be68959296f2588607df345e2bde5d164bd8577c05125affdb6a681788 (AV positives: 27/56 scanned on 07/17/2015 01:35:54) File SHA256: c0fb73a65c74e07677d4cb1d1a89bb2f6ccbc5064a6ad29c1c73e41f128fe3ab (AV positives: 18/56 scanned on 07/12/2015 15:10:14) File SHA256: c3635ff9cb9a787cdc9db8f4071ed848a96674ecfcb075a40c3024d7ca9b6810 (AV positives: 38/56 scanned on 07/09/2015 19:04:02) File SHA256: d9ce285518379007aaceb31fc6b1801f5f4b116cb894de620db9c15764485b1e (AV positives: 33/56 scanned on 07/05/2015 15:13:38) Found malicious artifacts related to "95.163.121.33" (ASN: 12695, Owner: Digital Networks CJSC): ... URL: http://95.163.121.33/ (AV positives: 3/67 scanned on 04/20/2016 20:50:08) File SHA256: 57cb033fef3221432a12f5a64877f78c384c983b3b697c6cc98333084c768a1e (AV positives: 37/57 scanned on 03/21/2015 07:35:15) File SHA256: b92139486a540d0342c7bdbc36c415cd16a17e12b069b9a86c8a55db1d06d521 (AV positives: 6/23 scanned on 03/19/2015 15:27:01) File SHA256: 71cf9e03d0a7cde196ac85a1b9c3936bb50b91234af5c044501f30771a3db67b (AV positives: 1/57 scanned on 03/19/2015 13:00:39) File SHA256: a26126f609aae62dc8f0311d4e33f61a14a1e68ea8f35b478c5a4e48943eb77d (AV positives: 23/57 scanned on 03/17/2015 06:11:28) File SHA256: ef11dc3f66080e3aadfc26ad4b5209b2a499c7adfb21b488699c377e8e28007c (AV positives: 30/56 scanned on 03/15/2015 18:34:49)26:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444131771,"unified_at":"2026-09-26T17:35:31.771Z","metadata":{"hashes":{"sha256":"c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254","sha1":"26e55289c75acabbe37d580eb057eb317829cfa9","md5":"b5f9de68d8dff6595e1b6d753dabb534","sha512":"c7d6bd3d6fad7416f831b08da174f4ccdf73affc18c43d20d96c96436146b7e8ff63a19667c9ecbfef141366f148367d270f6540b8cdbd19228c4b2eaa94a176","ssdeep":"1536:F8ZqyfVdd42bNBWGfB7EHs/n+yRKoeDMBgC+IGk87Hs:F8ZL/dVWCB7EHsGyRWFk8s","ssdeep_chunks":["1536:F8ZqyfV","1536:8ZqyfVd","1536:ZqyfVdd","1536:qyfVdd4","1536:yfVdd42","1536:fVdd42b","1536:Vdd42bN","1536:dd42bNB","1536:d42bNBW","1536:42bNBWG","1536:2bNBWGf","1536:bNBWGfB","1536:NBWGfB7","1536:BWGfB7E","1536:WGfB7EH","1536:GfB7EHs","1536:fB7EHs/","1536:B7EHs/n","1536:7EHs/n+","1536:EHs/n+y","1536:Hs/n+yR","1536:s/n+yRK","1536:/n+yRKo","1536:n+yRKoe","1536:+yRKoeD","1536:yRKoeDM","1536:RKoeDMB","1536:KoeDMBg","1536:oeDMBgC","1536:eDMBgC+","1536:DMBgC+I","1536:MBgC+IG","1536:BgC+IGk","1536:gC+IGk8","1536:C+IGk87","1536:+IGk87H","1536:IGk87Hs","3072:F8ZqyfV","3072:8ZqyfVd","3072:ZqyfVdd","3072:qyfVdd4","3072:yfVdd42","3072:fVdd42b","3072:Vdd42bN","3072:dd42bNB","3072:d42bNBW","3072:42bNBWG","3072:2bNBWGf","3072:bNBWGfB","3072:NBWGfB7","3072:BWGfB7E","3072:WGfB7EH","3072:GfB7EHs","3072:fB7EHs/","3072:B7EHs/n","3072:7EHs/n+","3072:EHs/n+y","3072:Hs/n+yR","3072:s/n+yRK","3072:/n+yRKo","3072:n+yRKoe","3072:+yRKoeD","3072:yRKoeDM","3072:RKoeDMB","3072:KoeDMBg","3072:oeDMBgC","3072:eDMBgC+","3072:DMBgC+I","3072:MBgC+IG","3072:BgC+IGk","3072:gC+IGk8","3072:C+IGk87","3072:+IGk87H","3072:IGk87Hs","1536:F8ZL/dV","1536:8ZL/dVW","1536:ZL/dVWC","1536:L/dVWCB","1536:/dVWCB7","1536:dVWCB7E","1536:VWCB7EH","1536:WCB7EHs","1536:CB7EHsG","1536:B7EHsGy","1536:7EHsGyR","1536:EHsGyRW","1536:HsGyRWF","1536:sGyRWFk","1536:GyRWFk8","1536:yRWFk8s"],"imphash":"bfa6573e1da184a77772a586ec5ab4f8"},"file_info":{"file_name":"casma.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":116736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294188000,"last_seen":1677390783000,"last_multi_scan":1677390783000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":4,"suspicious_count":12,"malicious_count":6,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Drixed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm/Win32.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1211709","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.96692","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Dridex-24","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.QLRN-0869","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.96692 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.M trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004baddc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Downloader-FAQM!B5F9DE68D8DF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cridex.dqbobt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DwnLdr-MJK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2265660","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.JC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.JC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt4.HVA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Malware-Cryptor.Drixed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Cridex.Win32.466","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"H2R8bhGnI6dDUEfv.edu\"\n \"leUIMA37oqwzPpruwI.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.120.225.17:8080\"\n \"92.63.88.83:80\"\n \"121.50.43.175:8080\"\n \"95.163.121.33:80\"\n \"82.151.131.129:8080\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"S:\\Work\\_bin\\Release-Win32\\loader.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"H2R8bhGnI6dDUEfv.edu\"\n Heuristic match: \"leUIMA37oqwzPpruwI.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00019603-00002544-00000105-47870703","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"u@r~ps with unusual entropies 7.1672673976","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST / HTTP/1.1\nContent-Type: text/csv\nReferer: http://www.bing.com/\nHost: H2R8bhGnI6dDUEfv.edu\nUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:34.0) Gecko/20100101 Firefox/34.0\nAccept: audio/*\nConnection: Keep-Alive\nContent-Length: 2569\" with no payload\n \"POST / HTTP/1.1\nReferer: https://facebook.com/\nUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nConnection: Keep-Alive\nContent-Type: message/rfc822\nHost: leUIMA37oqwzPpruwI.net\nContent-Length: 2569\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 5.1; rv:34.0) Gecko/20100101 Firefox/34.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"'root\\cimv2'\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ExitThread","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"92e6047779a80977be720977d62d09771de2047705a20977bee30477616f0977684107770050077700000000ad37b5758b2db575b641b57500000000\" to virtual address \"0x746A1000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"4053077758580877186a0877653c09770000000000bfd5760000000056ccd576000000007ccad57600000000376833756a2c0977d62d097700000000206933750000000029a6d57600000000a48d337500000000f70ed57600000000\" to virtual address \"0x759A1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/56 Antivirus vendors marked sample as malicious (78% detection rate)\n 27/44 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/56 Antivirus vendors marked sample as malicious (78% detection rate)\n 27/44 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 5.1; rv:34.0) Gecko/20100101 Firefox/34.0\n Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$24","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 188.120.225.17 on port 8080\n TCP traffic to 121.50.43.175 on port 8080\n TCP traffic to 82.151.131.129 on port 8080","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"57414bbbaac2ed7471b2a91f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Kazy","contacted_countries":["JPN","LVA","RUS","TUR"],"submit_name":"c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254.bin","analysis_start_time":"2016-05-22T08:03:58+00:00","indicators_count":{"informative":4,"suspicious":18,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"551bd0848690b8c30f5e049b","environment_id":2,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":50,"malware_family":"QVM20.1.Malware","contacted_countries":["CAN","CHE","EU","FRA","RUS","TWN","USA"],"submit_name":"casma.exe","analysis_start_time":"2015-04-01T13:03:41+00:00","indicators_count":{"informative":6,"suspicious":7,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.120.225.17","port":8080,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"address":"92.63.88.83","port":80,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"address":"121.50.43.175","port":8080,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"address":"95.163.121.33","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"address":"82.151.131.129","port":8080,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]}],"dns_resolutions":[{"domain":"leUIMA37oqwzPpruwI.net","address":"92.63.88.83","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]},{"domain":"H2R8bhGnI6dDUEfv.edu","address":"92.63.88.83","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]}],"http_requests":[{"host":"H2R8bhGnI6dDUEfv.edu","host_ip":"92.63.88.83:80","url":"/","method":"POST","sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57414bbbaac2ed7471b2a91f"}],"processes":[{"pid":2544,"ppid":0,"name":"c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254.exe","command_line":"","normalized_path":"C:\\c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254.exe","uid":"00019603-00002544","icon":"$26"}],"all_imported_dlls":["msvcrt.dll","lpk.dll","shell32.dll","rsaenh.dll","user32.dll","devobj.dll","msctf.dll","usp10.dll","oleaut32.dll","ole32.dll","cryptbase.dll","setupapi.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","nsi.dll","WSHTCPIP.DLL","esent.dll","advapi32.dll","mswsock.dll","sechost.dll","gdi32.dll","psapi.dll","imm32.dll","cryptsp.dll","ws2_32.dll","KernelBase.dll","cfgmgr32.dll","shlwapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["57414bbbaac2ed7471b2a91f","551bd0848690b8c30f5e049b"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c6aa69524212… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c6aa69524212…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c6aa69524212… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c6aa69524212…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c6aa69524212e81a8c5e32287437c803d27b789abcf4d01da9b66f7826ed5254"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c6aa69524212… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c6aa69524212…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]