24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_.4BE7A3E4 Sample cbbb8b1b14b3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cbbb8b1b14b3…. Malware family: Ransom_.4BE7A3E4. Threat score 100/100. 19/28 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8","keywords":["Malicious","Ransom_.4BE7A3E4","malware analysis","sandbox report","threat intelligence","cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8"],"about":{"@type":"SoftwareApplication","name":"email.bin","applicationCategory":["peexe","executable"],"identifier":"cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_.4BE7A3E4","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T45e,Antivirus vendors marked dropped file "zlib1.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "libeay32.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libgcc_s_sjlj-1.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libevent_core-2-0-5.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libssp-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ssleay32.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libevent_extra-2-0-5.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libevent-2-0-5.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")26:T636,"zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "tor.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libgcc_s_sjlj-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor-gencert.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_core-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libssp-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_extra-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libevent-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "geoip6" has type "ASCII text" "cached-certs.tmp" has type "ASCII text with CRLF line terminators" "unverified-microdesc-consensus.tmp" has type "ASCII text with very long lines with CRLF line terminators" "cached-microdesc-consensus.tmp" has type "ASCII text with very long lines with CRLF line terminators" "geoip" has type "ASCII text" "System.zip" has type "Zip archive data at least v1.0 to extract" "cached-microdescs.new" has type "ASCII text with very long lines" "state.tmp" has type "ASCII text with CRLF line terminators" "2FR" has type "data"27:T428,"" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db" "" touched file "C:\Windows\SysWOW64\rsaenh.dll" "" touched file "C:\Windows\SysWOW64\ntdll.dll" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db" "svchost.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "svchost.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"28:Tcb0,Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "ZON{t'Sj5ZE@5.bs" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ec7a7d4f0695d738 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "www.microsoft.com" Pattern match: "http://genuine.microsoft.com/reporting/XmlEvent.ashx?v=3" Heuristic match: "GET /json HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0Accept-Language: en-us,en;q=0.5Accept-Encoding: gzi" Heuristic match: "archive.torproject.org" Pattern match: "http://ocsp.int-x3.letsencrypt.org0/" Pattern match: "http://cert.int-x3.letsencrypt.org/0" Pattern match: "http://cps.letsencrypt.org0" Pattern match: "https://letsencrypt.org/repository/0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/DSTROOTCAX3CRL.crl0" Pattern match: "www.kusz66nnj4r6mpn4.com" Pattern match: "www.oxpwvn.com" Pattern match: "www.izwd7hdaplvpt5kq.com0" Pattern match: "www.hzagqckwzhzf.net0" Pattern match: "www.sxufkw55pumsd.com0" Pattern match: "www.fk5l6fp7orhkk.net0" Pattern match: "www.dpvzt3ozxfyc4.com" Pattern match: "www.ol2ver244cyi35g.com0" Pattern match: "www.55oyf2myl3jb6irxpu.net0" Pattern match: "www.2wliwzqsz5rtyg6i6dp.com" Pattern match: "www.xpnbm6f22mm5nv.com" Pattern match: "www.t3u23hsladkaj2n6.com0" Pattern match: "www.uoqxgkxhhllqoimxmad.net0" Pattern match: "www.7dbwxvqtj6vycdf.com" Pattern match: "www.4wxfurtojb4ij346e.com0" Pattern match: "www.owbjxuhlmssowjppq.net0" Pattern match: "www.i7dqtzxaq75oeigocdc.com0" Pattern match: "www.dybmbapr3dqrlahhb73.net0" Pattern match: "www.ebrhxx.com" Pattern match: "www.3qkf4uytwg.com0" Pattern match: "www.2nsqncv2akvtdw2r62i.net0" Heuristic match: "nD_hgc.Us" Pattern match: "www.xlxono.com" Heuristic match: "ip-api.com" Pattern match: "https://www.torproject.org/download/download#warning" Pattern match: "https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s" Pattern match: "https://www.torproject.org/documentation.html" Heuristic match: ".onion" Pattern match: "www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org" Pattern match: "https://www.torproject.org/" Pattern match: "https://www.torproject.org/docs/faq.html#BestOSForRelay" Pattern match: "https://trac.torproject.org/8742" Pattern match: "http://freehaven.net/anonbib/#hs-attack06" Pattern match: "https://trac.torproject.org/projects/tor/ticket/14917" Pattern match: "https://blog.torproject.org/blog/lifecycle-of-a-new-relay" Pattern match: "http://%s" Heuristic match: "%s.onion" Pattern match: "http://%s:%d" Pattern match: "http://%s@%s:%d" Heuristic match: ".in-addr.arpa" Heuristic match: ".ip6.arpa" Heuristic match: "ip6.arpa" Heuristic match: "%d.%d.%d.%d.in-addr.arpa" Pattern match: "http://www.zlib.net/" Pattern match: "https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz"29:T402,"zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "tor.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libgcc_s_sjlj-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor-gencert.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_core-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libssp-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_extra-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libevent-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2a:T6f8,"C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsr47D3.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsm4803.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\2FR" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ccversion.tag" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\CVR2BB5.tmp.cvr" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\CVR60C9.tmp.cvr" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\CVRDB3A.tmp.cvr" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat05S5.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat09nN.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0Arb.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0CwJ.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0fQL.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0jcy.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0myC.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0qiR.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0QRH.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0qZH.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0RxM.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat0TnB.tmp" for deletion "C:\taskwgr.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\dat1236.tmp" for deletion2b:T77c,"" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr47D3.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsm4803.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\2FR" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\acrord32_sbx\lilo.1136\" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ccversion.tag" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\CVR2BB5.tmp.cvr" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\CVR60C9.tmp.cvr" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\CVRDB3A.tmp.cvr" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat05S5.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat09nN.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0Arb.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0CwJ.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0fQL.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0jcy.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0myC.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0qiR.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0QRH.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0qZH.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0RxM.tmp" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\dat0TnB.tmp" with delete access2c:T85f,"" wrote bytes "fe182976f854297657d12a76f2182a76852a2b76221229763e18297668342976eb59297677492976451229762e582976dd16297626182976ff422976c011297600000000d89448750000000008223e76d1e43b7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "" wrote bytes "d0556875647371750000000051c1627694986276ee9c627675dc6476273e64760fb368760000000085482976698729760f772b76d9172976ead72a76a9342976f8112976201429760c112976f516297654142976ff1029763214297600000000" to virtual address "0x74661000" (part of module "SHFOLDER.DLL") "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "" wrote bytes "7d07677781ed6577ae866477c6e06377effd66772d16657760146777478d6477a8e263776089647700000000ad3776768b2d7676b641767600000000" to virtual address "0x746B1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "0efc667781ed6577ae866477c6e06377effd66772d166577c0fc6277da8f6d7760146777478d6477a8e263776089647700000000ad3776768b2d7676b641767600000000" to virtual address "0x74581000" (part of module "WSHIP6.DLL") "cmd.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "PING.EXE" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "PING.EXE" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")2d:T20cd,Found malicious artifacts related to "185.194.141.58": ... File SHA256: fa2c8236f71dd2015409b226e514b6cad08e1d2023d32feda4e97c1dbdd6af45 (AV positives: 14/70 scanned on 04/03/2018 00:56:18) File SHA256: cae93d84de17f606d62d8f305ef3b287b0c4402c953a5b688494945de5e2002c (AV positives: 23/66 scanned on 04/02/2018 22:59:32) File SHA256: 685ed100fc864fc0c88edd7aa45f4887d48f5717b02a6610fb6fc4de1401df27 (AV positives: 1/69 scanned on 04/02/2018 13:44:43) File SHA256: 032b6407d70ffecbb29a813e2e2b7bbc051553ff232229c47c4a2ba41d07c003 (AV positives: 1/69 scanned on 04/02/2018 10:17:54) File SHA256: 64ee286a280284814c8806592a001ad1fb6aa08d75a651643368531fe959f974 (AV positives: 3/69 scanned on 04/02/2018 02:00:25) File SHA256: d00fbe8a309dbbc5e079e18e25806cda597e4167e5e49c75f660ae370124ff5a (Date: 04/01/2018 22:36:59) File SHA256: ec4b6f5172083d6007ed1c667fd6607fa669e05c0a6a4c610609bc14ae6843dd (Date: 03/30/2018 21:50:16) File SHA256: d3fc8dff6e64a2e163b83bc5c91d2d6edc5832d337c55406c0a913fad6077314 (Date: 03/30/2018 21:49:57) File SHA256: 86158c1d6837481a472f5b2dbc48a19b2fecc27b9d0a358efb4a0b4ca8d29611 (Date: 03/30/2018 18:13:22) File SHA256: 96f914b853012e270aa75cbe93b32480dea47132b86c74d45804b597d7dc19d7 (Date: 03/30/2018 18:13:10) Found malicious artifacts related to "163.172.139.104": ... URL: https://163.172.139.104/ (AV positives: 1/68 scanned on 07/19/2016 17:53:18) File SHA256: e9cbdca1805b070d42de3d56ed73d997a746f99c659f88b41e593c952470d055 (AV positives: 55/68 scanned on 12/14/2017 10:13:30) File SHA256: 9e0aa642f7c6a8348693e9e1601d6c5b135799549da23bc2b507fc13aeb4d8e3 (AV positives: 41/68 scanned on 11/30/2017 02:59:18) File SHA256: a1a7ec6fa551f3a0a2bd830de4775f365a90281d81d4717b635a79cd03d1fbee (AV positives: 50/68 scanned on 11/30/2017 01:30:20) File SHA256: 846957e0dda3884c6f4d980866f320e7eb0ba0b5fa720f50f8e04b663ad19b09 (AV positives: 49/66 scanned on 11/30/2017 00:27:40) File SHA256: f71d3bbbbd2288950b518a30bbed44174904594698c4c57f44cdcf6a458f368c (AV positives: 48/68 scanned on 11/29/2017 20:15:47) File SHA256: 8bd15fb3265b7b693c8a53fdc8438695cb8836c84f5131c899f03fae2471bc95 (Date: 11/29/2017 22:28:46) File SHA256: 9966bba5f3d5fe0dd095d6bab6351f2eb012ba65a73d1078d813a600755f1ee6 (Date: 11/29/2017 19:36:39) File SHA256: b7da5e9ff064b96bb466a9abaf334908e7b802b0cb0d76312cfeaa109107dc0a (Date: 11/29/2017 12:02:09) File SHA256: 00da2c7c7a39e0c313e14d08b2ab23fe557c931cfaf5d8b3ab31c2520b2fc038 (Date: 11/29/2017 11:11:20) File SHA256: aed5a371a529818d89c23c564e1458967de7b450892002fce660d9adb6b6408a (Date: 11/29/2017 11:10:53) Found malicious artifacts related to "193.23.244.244": ... URL: http://dannenberg.torauth.de/ (AV positives: 1/67 scanned on 04/02/2018 20:53:11) URL: http://193.23.244.244/ (AV positives: 3/67 scanned on 03/30/2018 17:05:13) URL: http://193.23.244.244/tor/server/d/F6CF8EF50916C724AEAA23D095312E99EA93EC2E+F6D35C78957A5779E4B600B9094017FD66363796+F6EB7B13693422DC4A173FB51E812ADD1898D08E+FF7268F7A909E325BFB0242DA080BF051ADACE55.z (AV positives: 2/67 scanned on 03/22/2018 19:47:52) URL: http://193.23.244.244/tor/status-vote/current/consensus/14C131+27B6B5+49015F+585769+805509+D586D1+E8A9C4+ED03BB+EFCBE7.z (AV positives: 3/67 scanned on 03/12/2018 04:57:23) URL: http://193.23.244.244/tor/status-vote/current/consensus/14C131+27B6B5+49015F+585769+805509+D586D1+E8A9C4+ED03BB+EFCBE7.z/ (AV positives: 3/67 scanned on 03/11/2018 00:29:24) File SHA256: 643fbfbd960fd5e02b9eae380dbdfe2060e2cc7303043116c699963e5f56b4d1 (AV positives: 36/70 scanned on 04/01/2018 02:14:13) File SHA256: 3e7aa7381ebdae278bbda81619830ede55793a68b316b5b042781aa88a161af0 (AV positives: 35/70 scanned on 04/01/2018 02:13:41) File SHA256: aaf5bfa37abbc720109d7fdd17687f75cb79536586b481083fa1a70d899c07d0 (AV positives: 23/65 scanned on 04/01/2018 01:46:04) File SHA256: d33b48e805ba8aed74998cdcb66d5b4af23cbade5214e2cb03382e1b9d8e0044 (AV positives: 24/69 scanned on 03/31/2018 01:44:40) File SHA256: 7a63637349fa79d9bc77f1e872d25f4ee16a3261a55520f5c01e07c1ade6bc6d (AV positives: 18/66 scanned on 03/31/2018 18:34:07) File SHA256: 85449737b86749d2eb868916ce25c3eb3c43238395ab823e0604cc4a6ffea8ad (Date: 03/04/2018 20:02:57) File SHA256: e2a6e93f2956c25c0ba237fb168b7d5d40e845d8335c0975a9f576883dd0e36a (Date: 02/20/2018 09:00:04) File SHA256: e4ae195a7026b405c3b6ac9d68f9a5c285a042cbadb3f2e1f69ed9fc9825459b (Date: 02/20/2018 05:26:33) File SHA256: fe4391c702028b0afb2c063c17178db8faeb6ae51590f100c4da420326680e95 (Date: 02/17/2018 17:56:39) File SHA256: d1eb87093ca4edee3225ea38d495b2ec7145bddba21e672b52b2f8d45de91351 (Date: 02/16/2018 04:45:12) Found malicious artifacts related to "46.101.6.132": ... File SHA256: b0a8e6a2a51c4f146b8d92763b2391c8197a3d1a787cddbc21c8f4d62e9890ae (AV positives: 13/68 scanned on 11/14/2017 22:52:53) File SHA256: 31714cfc5f1f20161afb2115bfcd66019a34dec8c6579536e41d68d008ad98f3 (AV positives: 36/66 scanned on 10/03/2017 16:14:27) File SHA256: a77ab8771a4f9d56d3c536aeb36fda71f2e71454bf2c7f600829e945f416915e (Date: 08/31/2017 18:12:09) File SHA256: 953fec239651bd73633f558954592768cab43cafe07e9caa240097dac0286ccd (Date: 08/31/2017 18:10:31) File SHA256: f666ac12930b438b99e1b379a320ce5c260df2dc79605617e07e297983ba214b (Date: 08/31/2017 04:40:18) File SHA256: f3f648ed4f1188685f7afda176d16913b77d5722f21647820d275b47d72a9acf (Date: 08/31/2017 04:38:36) File SHA256: 11c4dd7d3049375105973595ba0ecc05263ace33b64ae894cbdd9e03e1d1acef (Date: 08/27/2017 19:37:40) File SHA256: a9dfa1c45a06a6b3462e3f2afddf975053ebb962680d0c503ba5482f325b633d (AV positives: 39/65 scanned on 08/06/2017 21:05:39) Found malicious artifacts related to "23.81.66.90": ... File SHA256: 59cf920424c4bee18df5af0dc0d3ac9c676eb2be590b1a2c9f3240aacccf86b2 (AV positives: 25/65 scanned on 03/25/2018 05:01:14) File SHA256: 7b80efed0dfce5bbdebeac5912458c671be157aec63b4d972dd78c6d57a8aa88 (AV positives: 40/62 scanned on 03/17/2018 14:03:21) File SHA256: 0dea5f7b0373b8a1491a44101fdb136555ffdefa35b52b3baee66a3180125259 (AV positives: 12/67 scanned on 02/22/2018 06:53:31) File SHA256: 533be63b67bfb4270d6b308ee7b79e064624dbd1e5677db33b8810b180d7e7f4 (AV positives: 49/68 scanned on 02/19/2018 10:44:29) File SHA256: 505ecc4c061f0e47eca3ce9457ee0c03909656c4d9de7e62622a361aa1317bb3 (AV positives: 12/67 scanned on 02/19/2018 06:13:57) File SHA256: 60f2ab502f2809fa7e33e43905c5b9e77080d4cf5d1f2895488d464c7bb9116c (Date: 11/05/2017 12:07:09) File SHA256: 27c4c40c05abbdc38ab260298286d7935f03a0d0d6dd69232bbb13133f03090a (Date: 11/05/2017 12:04:31) File SHA256: 2318dc9e72c9595878e1f08cd438ebfaaa5a984701335e0b7bcef169ef45f835 (Date: 08/31/2017 18:11:51) File SHA256: 4bee89e4517ee3e7c9e101c1ab0d97f0df880089bfe5dd9b967cd6140c91b9de (Date: 08/31/2017 18:10:50) File SHA256: c7c68877d2c16a5443ef83dd53aefaf431f82a1399aca03a8864d0d46606a61e (Date: 08/31/2017 14:53:36) Found malicious artifacts related to "46.28.207.107": ... URL: https://46.28.207.107/ (AV positives: 1/68 scanned on 07/21/2016 16:29:11) File SHA256: 75c88d138738cfe18e795b3235b3778acf6950e9b5744c910d265d69f08b43da (AV positives: 21/67 scanned on 01/31/2018 04:58:08) File SHA256: 9bf1be05810dc4bd1f5133682672b0efb19ae3ec59da6931c34e90934cae03fd (AV positives: 15/66 scanned on 01/30/2018 04:13:40) File SHA256: d4a612291f0073eba78fa1818a3affa203fe49f8856e7a540c34219060f51fb7 (AV positives: 35/65 scanned on 01/26/2018 06:13:56) File SHA256: d6b2868c030a1ba1bab6ec3834c22023f89ea71d78ebfb9beb8878d4857d436b (AV positives: 14/66 scanned on 01/19/2018 10:05:56) File SHA256: f8d3384ce8bb661af6a9b27019dde10dbb3a865c1a48f0b6ba2a8fb805f7236c (AV positives: 40/67 scanned on 12/24/2017 16:58:23) File SHA256: 37435a302d782abf4969d817c984ac7614e4fb604565041dafb81509867808a2 (Date: 12/08/2017 11:31:39) File SHA256: 2318dc9e72c9595878e1f08cd438ebfaaa5a984701335e0b7bcef169ef45f835 (Date: 08/31/2017 18:11:51) File SHA256: 4bee89e4517ee3e7c9e101c1ab0d97f0df880089bfe5dd9b967cd6140c91b9de (Date: 08/31/2017 18:10:50) File SHA256: 8845c36dfa550ad5146026fcb9518a60018c33cb6cc300e7828d4b8a9c248bf7 (Date: 08/27/2017 02:34:39) File SHA256: 3fbf3c888d232e48c8dfd98011df1f420f711c6f7a0fbfee935379096939d7cd (Date: 08/27/2017 02:31:20) Found malicious artifacts related to "37.187.104.6": ... File SHA256: 1db1899279e6327c38384997266675263291410515b6271880704f47f8e5b3bc (AV positives: 44/68 scanned on 12/03/2017 10:16:36)2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444279008,"unified_at":"2026-09-26T17:37:59.008Z","metadata":{"hashes":{"sha256":"cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8","sha1":"fa445c94fb65b498b7f9864b53e3804162b9e306","md5":"a4eacabdf3d7b9f994074730795baa23","sha512":"e2f32ed795767a0174a121108dd283cf89cfaade37821aaae2125172e6d3f06be597732a0482564ff832096921f0a51348c47adea447cab598837bc12fced268","ssdeep":"98304:qr8wCw2AbuwjBwB8M/B1qwv6MStERM0h51g6Fim:qQBYucwBJ5DEERMq1g6F1","ssdeep_chunks":["98304:qr8wCw2","98304:r8wCw2A","98304:8wCw2Ab","98304:wCw2Abu","98304:Cw2Abuw","98304:w2Abuwj","98304:2AbuwjB","98304:AbuwjBw","98304:buwjBwB","98304:uwjBwB8","98304:wjBwB8M","98304:jBwB8M/","98304:BwB8M/B","98304:wB8M/B1","98304:B8M/B1q","98304:8M/B1qw","98304:M/B1qwv","98304:/B1qwv6","98304:B1qwv6M","98304:1qwv6MS","98304:qwv6MSt","98304:wv6MStE","98304:v6MStER","98304:6MStERM","98304:MStERM0","98304:StERM0h","98304:tERM0h5","98304:ERM0h51","98304:RM0h51g","98304:M0h51g6","98304:0h51g6F","98304:h51g6Fi","98304:51g6Fim","196608:qr8wCw2","196608:r8wCw2A","196608:8wCw2Ab","196608:wCw2Abu","196608:Cw2Abuw","196608:w2Abuwj","196608:2AbuwjB","196608:AbuwjBw","196608:buwjBwB","196608:uwjBwB8","196608:wjBwB8M","196608:jBwB8M/","196608:BwB8M/B","196608:wB8M/B1","196608:B8M/B1q","196608:8M/B1qw","196608:M/B1qwv","196608:/B1qwv6","196608:B1qwv6M","196608:1qwv6MS","196608:qwv6MSt","196608:wv6MStE","196608:v6MStER","196608:6MStERM","196608:MStERM0","196608:StERM0h","196608:tERM0h5","196608:ERM0h51","196608:RM0h51g","196608:M0h51g6","196608:0h51g6F","196608:h51g6Fi","196608:51g6Fim","98304:qQBYucw","98304:QBYucwB","98304:BYucwBJ","98304:YucwBJ5","98304:ucwBJ5D","98304:cwBJ5DE","98304:wBJ5DEE","98304:BJ5DEER","98304:J5DEERM","98304:5DEERMq","98304:DEERMq1","98304:EERMq1g","98304:ERMq1g6","98304:RMq1g6F","98304:Mq1g6F1"],"imphash":"b78ecf47c0a3e24a6f4af114e2d1f5de"},"file_info":{"file_name":"email.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3207168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520880969000,"last_seen":1677134568000,"last_multi_scan":1677134568000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","banker","ramnit"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":23,"malicious_count":12,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Occamy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224575","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Mint.Zamg.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Zamg-7641584-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.KA.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Mint.Zamg.E (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052a7141 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.NSIS.Agent.gb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject3.ffkrrt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/SigmaRsm-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.4BE7A3E4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.4BE7A3E4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptSigma.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Agent.Win32.285535","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_.4BE7A3E4","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00027435-00002168-12396-1-011614E0\n SetUnhandledExceptionFilter@KERNEL32.dll at 39650-898-62126270\n SetUnhandledExceptionFilter@KERNEL32.dll at 50609-134-62E92C70","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00017349-00002580-59482-7-00405DE5\n GetVersion@KERNEL32.DLL at 00017349-00002580-59482-1-004031A3","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00017349-00002580-59482-77-004043E6","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL (Target: \"taskwgr.exe\"; Stream UID: \"00017349-00002580-59482-1-004031A3\")\n which is directly followed by \"cmp ax, 00000006h\" and \"je 004031EBh\". See related instructions: \"...+43 call dword ptr [004080A4h] ;GetVersion+49 cmp ax, 00000006h+53 je 004031EBh\" ... at 00017349-00002580-59482-1-004031A3","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"\n \"archive.torproject.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.194.141.58:80\"\n \"94.130.28.200:443\"\n \"163.172.139.104:443\"\n \"193.23.244.244:443\"\n \"146.185.177.103:9030\"\n \"46.101.6.132:443\"\n \"23.81.66.90:443\"\n \"46.28.207.107:443\"\n \"37.187.104.6:9001\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsm4803.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\2FR\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$25","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0Accept-Language: en-us,en;q=0.5Accept-Encoding: gzipHost: ip-api.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\taskwgr.exe\"\" on 2018-4-3.04:14:17.815","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00021122-00003480)\n Spawned process \"svchost.exe\" (UID: 00027435-00002168)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\taskwgr.exe\"\" (UID: 00032762-00004896)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00032773-00004972)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00032773-00004972)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"svchost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00017349-00002580-00000033-74737770\n \"\" at 00021122-00003480-00000033-76864203\n \"svchost.exe\" at 00027435-00002168-00000033-100578846","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"svchost.exe\" queried SystemProcessInformation at 00027435-00002168-00000033-100620204\n \"svchost.exe\" queried SystemProcessInformation at 00027435-00002168-00000033-100842192\n \"svchost.exe\" queried SystemProcessInformation at 00027435-00002168-00000033-101738068","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.08290294622","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"ECDSA\" (Indicator: \"ecdsa\"; File: \"00027435-00002168.00000002.31595.013CE000.00000002.mdmp\")\n \"RC4\" (Indicator: \"rc4\"; File: \"ssleay32.dll.3643648792\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"wgGdOPFeH8OgNMPBMH56DMIyKiw26b0rxkza81V+kw8JQemugctZAgMBAAE=\" (Indicator: \"qemu\")\n \"5+/qf7+5yE5Db8VmNet76zNWcZsIp8sgIqGXq/oJXbVcU3/JKom3AgMBAAE=\" (Indicator: \"vmnet\")\n \"j3dRAloYUoCHKoni4zVDgA2t+4/dhP/lw/U4bM9tEU1jxQJk3aDZRlVbOxa9o7y5\" (Indicator: \"vbox\")\n \"9/5I+RSW7oYgqjndcv26QtugBzCQeMUBPKqDoTxQlqFeCNoXw0bBAgMBAAE=\" (Indicator: \"qemu\")\n \"id ed25519 jQT6rLV4vbOXahQwHI2E1Ft1G3dVvP5iOe+O2D3IicQ\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"svchost.exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$29","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CHROME\"; Value: \"Rundll32.exe SHELL32.DLL,ShellExec_RunDLL %APPDATA%\\Microsoft\\1227D9B0286FCE94AACDA3D27036A268\\taskwgr.exe \")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"details too long to display","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"m +22eJFYJMCcLOyqkfWYR2maFiYZzBtMBvncFhMAgmkw\" (Indicator for product: Generic VNC)\n \"T/7vbOB4QuJvwlt/3Yn6MkvncZRxw2iECmtGaD+CCdJCQ5com72yNTtDScrwVN4t\" (Indicator for product: Generic VNC)\n \"ntor-onion-key 8Jyk2oOO3dGso1HAgyij7z4JH1FdjuxmpBsFoJvncl0=\" (Indicator for product: Generic VNC)\n \"ZgJzwPiC102H/YJsfz2nO86Of4PIXbAHwVEdWAXvzf1WN/Y2+Kf1vncJfWnHe6z8\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"cmd=\" (Indicator: \"cmd=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00017349-00002580-59482-87-0040511A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"zlib1.dll\" claimed CRC 145013 while the actual is CRC 3248350\n \"libgcc_s_sjlj-1.dll\" claimed CRC 540122 while the actual is CRC 145013\n \"tor-gencert.exe\" claimed CRC 1040324 while the actual is CRC 540122\n \"libevent_core-2-0-5.dll\" claimed CRC 467440 while the actual is CRC 1040324\n \"libssp-0.dll\" claimed CRC 107654 while the actual is CRC 26737\n \"ssleay32.dll\" claimed CRC 764532 while the actual is CRC 107654\n \"libevent_extra-2-0-5.dll\" claimed CRC 451113 while the actual is CRC 764532\n \"libevent-2-0-5.dll\" claimed CRC 781000 while the actual is CRC 451113","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n TerminateProcess\n UnhandledExceptionFilter\n VirtualProtect\n GetModuleFileNameW\n GetVersionExA\n LoadLibraryA\n MapViewOfFile\n GetStartupInfoA\n CreateFileMappingA\n recv\n bind\n send\n accept\n WSAStartup\n connect\n socket\n closesocket\n listen\n WSASend\n VirtualAlloc\n recvfrom\n sendto","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00017349-00002580)\n Spawned process \"\" (UID: 00021122-00003480)\n Spawned process \"svchost.exe\" (UID: 00027435-00002168)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\taskwgr.exe\"\" (UID: 00032762-00004896)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00032773-00004972)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"zlib1.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libgcc_s_sjlj-1.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_core-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libssp-0.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"ssleay32.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_extra-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"svchost.exe\" at non-system pathway \"%APPDATA%\\Microsoft\\1227D9B0286FCE94AACDA3D27036A268\\Tor\\svchost.exe\" (UID: 00027435-00002168)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system module process name at an unusual pathway","description":"Process \"svchost.exe\" has a system module name \"svchost.exe\"\n but is not located in a Windows (sub-)directory (UID: 00027435-00002168)","origin":"Monitored Target","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/66 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/66 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/75 Antivirus vendors marked dropped file \"tor.exe\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/74 Antivirus vendors marked dropped file \"tor-gencert.exe\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/75 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"W32.Ramnit.CF\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"45/66 Antivirus vendors marked spawned process \"\" (PID: 3480) as malicious (classified as \"Injector.fxkfn\" with 68% detection rate)\n 1/75 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 2168) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\taskwgr.exe\" (Handle: 396)\n \"\" wrote 52 bytes to a remote process \"C:\\taskwgr.exe\" (Handle: 396)\n \"\" wrote 4 bytes to a remote process \"C:\\taskwgr.exe\" (Handle: 396)\n \"\" wrote 8 bytes to a remote process \"C:\\taskwgr.exe\" (Handle: 396)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\SysWOW64\\PING.EXE\" (Handle: 128)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\SysWOW64\\PING.EXE\" (Handle: 128)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\PING.EXE\" (Handle: 128)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\PING.EXE\" (Handle: 128)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00017349-00002580-59482-1-004031A3","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00017349-00002580-59482-66-00401000","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"\" set thread context in remote process \"C:\\email.bin.exe\" (PID 000006dc)","origin":"API Call","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}],"incidents":[{"name":"Remote Access","details_count":4,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"},{"detail":"Contains a remote desktop related string"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":88,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":53,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":17,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["suspicious","banker","ramnit"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5ac2e12e7ca3e173993004e4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Injector.fxkfn","contacted_countries":["CHE","DEU","FRA","GBR","NLD","USA"],"submit_name":"taskwgr.exe","analysis_start_time":"2018-04-03T04:05:18+00:00","indicators_count":{"informative":19,"suspicious":30,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5aa6c76c7ca3e178b0380cf6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["AUS","CHE","DEU","DNK","FRA","JPN","NLD","USA"],"submit_name":"email.bin","analysis_start_time":"2018-03-12T19:31:49+00:00","indicators_count":{"informative":20,"suspicious":31,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.194.141.58","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"94.130.28.200","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"163.172.139.104","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"193.23.244.244","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"146.185.177.103","port":9030,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"46.101.6.132","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"23.81.66.90","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"46.28.207.107","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"37.187.104.6","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"address":"95.183.48.12","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"128.31.0.39","port":9101,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"85.235.250.88","port":443,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"150.95.178.217","port":2443,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"78.46.217.214","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"188.166.67.231","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"37.187.22.87","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"address":"1.1.1.1","port":0,"protocol":"ICMP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"185.194.141.58","ttl":179,"country":"Germany","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"domain":"archive.torproject.org","address":"94.130.28.200","ttl":3599,"country":"Germany","registrar_name":"CSL Computer Service Langenbach GmbH d/b/a joker.com a German GmbH","registrar_organization":"The Tor Project, Inc","registrar_name_servers":"NS1.TORPROJECT.ORG","registrar_creation_date":"2006-10-17T22:02:50+00:00","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"185.194.141.58:80","url":"/json","method":"GET","header":"GET /json HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip\nHost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}],"processes":[{"pid":2580,"ppid":0,"name":"taskwgr.exe","command_line":"","sha256":"cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8","normalized_path":"C:\\taskwgr.exe","uid":"00017349-00002580","icon":"$2e"},{"pid":3480,"ppid":2580,"name":"taskwgr.exe","command_line":"","sha256":"cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8","normalized_path":"C:\\taskwgr.exe","parent_uid":"00017349-00002580","uid":"00021122-00003480"},{"pid":2168,"ppid":3480,"name":"svchost.exe","command_line":"","sha256":"bfea9e5a4cb7b012454b24c5d76b4bbfdd92fd3a367c438ddf47ed81f618f8f1","normalized_path":"%APPDATA%\\Microsoft\\1227D9B0286FCE94AACDA3D27036A268\\Tor\\svchost.exe","parent_uid":"00021122-00003480","uid":"00027435-00002168"},{"pid":4896,"ppid":3480,"name":"cmd.exe","command_line":"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\taskwgr.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00021122-00003480","uid":"00032762-00004896"},{"pid":4972,"ppid":4896,"name":"PING.EXE","command_line":"ping 1.1.1.1 -n 1 -w 3000","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00032762-00004896","uid":"00032773-00004972"}],"all_imported_dlls":["ntdll.dll","rpcrt4.dll","devobj.dll","dhcpcsvc.dll","tzres.dll","wow64.dll","msctf.dll","version.dll","srvcli.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","lpk.dll","dwmapi.dll","shfolder.dll","ssleay32.dll","user32.dll","sspicli.dll","ole32.dll","Wldap32.dll","netapi32.dll","winnsi.dll","wininet.dll","libevent-2-0-5.dll","System.dll","cryptsp.dll","dhcpcsvc6.dll","wow64cpu.dll","crypt32.dll","cscapi.dll","wship6.dll","zlib1.dll","sechost.dll","uxtheme.dll","setupapi.dll","ntmarta.dll","rasadhlp.dll","secur32.dll","libgcc_s_sjlj-1.dll","oleacc.dll","api-ms-win-downlevel-version-l1-1-0.dll","libssp-0.dll","wow64win.dll","cryptbase.dll","userenv.dll","propsys.dll","oleaccrc.dll","dnsapi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","nsi.dll","IPHLPAPI.DLL","WSHTCPIP.DLL","FWPUCLNT.DLL","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","oleaut32.dll","msvcrt.dll","imm32.dll","ws2_32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","shlwapi.dll","apphelp.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","normaliz.dll","shdocvw.dll","KernelBase.dll","usp10.dll","advapi32.dll","comctl32.dll","ieframe.dll","libeay32.dll","gdi32.dll","shell32.dll","cfgmgr32.dll","wkscli.dll","iertutil.dll","urlmon.dll","winbrand.dll","kernel32.dll","profapi.dll","clbcatq.dll","rsaenh.dll","msasn1.dll","netutils.dll","mswsock.dll","psapi.dll","rpcss.dll","wshqos.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"tor.exe","sha256":"bfea9e5a4cb7b012454b24c5d76b4bbfdd92fd3a367c438ddf47ed81f618f8f1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"tor-gencert.exe","sha256":"0dde189b6b3a19cef666bc6454964b601699a64d9fda3b3c895f4171455cbc42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"libevent-2-0-5.dll","sha256":"d1ee97282a2ddfcbd7cc6f45f8278c56bfcc3896b05c4f5ebbc5e5d7d4a897b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"libgcc_s_sjlj-1.dll","sha256":"4438b384066ae07fb9537ba948c020323d03d53e197ac6c3629a135f3a44cd27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"libssp-0.dll","sha256":"f5489fb8b5229424ddbd8f38bb93d9a950d029d9d3f36fc1e531086819061cd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"zlib1.dll","sha256":"dbf9926c56f4fd53418e7e078cc6fb0e23f056e2035c09ae9b1ba236306de44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"libeay32.dll","sha256":"fe5d316c59ac5b663741d70a922818129275071d1f2b83339059e488e6d9a7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"libevent_core-2-0-5.dll","sha256":"5f057c50bdd22e4d481cf033984d66b9ab7b79e7388a8a928d8a048e08f40386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"ssleay32.dll","sha256":"aa7db86c6995ab0c38d88b910484c1cda6f318bc9b82f3123cd65743ab3efd55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"libevent_extra-2-0-5.dll","sha256":"dbc8a9a2cb33940283078e6d7b767499743e1988479482c7d54d435e943de158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"cached-microdesc-consensus.tmp","sha256":"8f59a4cf0c0669f3a9860894a27c63c4a8247b702b781f022fe7e8a4be3d1e85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"cached-certs.tmp","sha256":"3a8f0d4eecfcc844e48d39f01a3cc19ca477adfe7d27ac1f8d7f05ce6a249920","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"cached-microdescs.new","sha256":"6c70927cde6d502ac9045518659fa8e27139b8705203537108cf4a957258bc55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"geoip","sha256":"7089d533bb1ffc3066e11f14e39e88bd5dec48cb17edfdb0d96a943bdb88e076","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"geoip6","sha256":"62aa48f57397902b2ee8e0e9abcc98237c70699a956cf0436cc187a4a8ce4618","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"state.tmp","sha256":"f9b7e64c03bec8275fe2801a90903ea55e74941c2c0218ca4365ca102a0818c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"unverified-microdesc-consensus.tmp","sha256":"8f59a4cf0c0669f3a9860894a27c63c4a8247b702b781f022fe7e8a4be3d1e85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"2FR","sha256":"fb5315d2ed01c05819a9ae06e329ff55a2efbf6663af55067afa50722dd697f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"System.zip","sha256":"a8fd270295e7fd433693d638c69160aa7ed6810b1a4253039bad0ba68dbacee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"C:\\taskwgr.exe","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\SysWOW64\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%APPDATA%\\taskwgr.exe","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\lock","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\state.tmp","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\router-stability","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\geoip","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\geoip6","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-certs","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%APPDATA%\\tor\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%APPDATA%\\tor\\unverified-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-certs.tmp","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\SysWOW64\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"C:\\email.bin.exe","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"C:\\Users\\hPULojz","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ac2e12e7ca3e173993004e4"},{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa6c76c7ca3e178b0380cf6"}]}]}},"report_ids":{"sandbox_job_ids":["5ac2e12e7ca3e173993004e4","5aa6c76c7ca3e178b0380cf6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom_.4BE7A3E4 Sample cbbb8b1b14b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cbbb8b1b14b3…. Malware family: Ransom_.4BE7A3E4. Threat score 100/100. 19/28 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_.4BE7A3E4 Sample cbbb8b1b14b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cbbb8b1b14b3…. Malware family: Ransom_.4BE7A3E4. Threat score 100/100. 19/28 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cbbb8b1b14b3df9d331ece7167ca9ab2b7da61839742a107142016d8d9c6f8e8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_.4BE7A3E4 Sample cbbb8b1b14b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cbbb8b1b14b3…. Malware family: Ransom_.4BE7A3E4. Threat score 100/100. 19/28 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]