24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.CoinMiner Sample d5db82cf829d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d5db82cf829d…. Malware family: Trojan.CoinMiner. Threat score 100/100. 9/26 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59","keywords":["Malicious","Trojan.CoinMiner","malware analysis","sandbox report","threat intelligence","d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59"],"about":{"@type":"SoftwareApplication","name":"GPURiseAgent.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.CoinMiner","antivirusDetections":{"malicious":9,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T47e,Antivirus vendors marked dropped file "libssp-0.dll.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libevent_extra-2-0-5.dll.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "zlib1.dll.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "libevent_core-2-0-5.dll.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libgcc_s_sjlj-1.dll.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libevent-2-0-5.dll.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libeay32.dll.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ssleay32.dll.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows")26:T5eb,"desktop.ini" has type "empty " "libssp-0.dll.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_extra-2-0-5.dll.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "zlib1.dll.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_core-2-0-5.dll.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "cached-certs.tmp" has type "ASCII text with CRLF line terminators" "tor-gencert.exe.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "tor.exe.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "unverified-microdesc-consensus.tmp" has type "ASCII text with very long lines with CRLF line terminators" "libgcc_s_sjlj-1.dll.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "cached-microdesc-consensus.tmp" has type "ASCII text with very long lines with CRLF line terminators" "libevent-2-0-5.dll.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "cached-microdescs.new" has type "ASCII text with very long lines" "libeay32.dll.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor.zip" has type "Zip archive data at least v2.0 to extract" "state.tmp" has type "ASCII text with very long lines with CRLF line terminators" "ssleay32.dll.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"27:T6c4,"" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\5d0c037297cc1a64b52ce43b45c2ac2e\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\43d86904e41b891e07c2ce8a20996e2c\System.Windows.Forms.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\47e0be927382f169f5de470fab0ceb7d\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\617299d2bd5dcfe094cedface0c39d1c\System.Drawing.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\38470d5ed01fd95e48dcf4e1b0b4774e\System.Configuration.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\f5db2f7c181e6f1344c9bc8dbcffce3b\System.Core.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sortdefault.nlp" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\8089ab42d28c269586b8d72c8e01701c\System.Xml.ni.dll.aux" "" touched file "C:\Windows\Fonts\tahoma.ttf" "" touched file "C:\Windows\Fonts\msjh.ttf"28:Tff5,Pattern match: "http://www.codeplex.com/DotNetZip" Heuristic match: "OpKx.Hu" Heuristic match: "mjo7mw3q4mtgsikz.onion" Pattern match: "https://openapi.baidu.com/rest/2.0/passport/users/getLoggedInUser?access_token={0" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=copy&access_token={0" Pattern match: "http://127.0.0.1:36728/Download/" Pattern match: "http://www.mrs4s.top/2016/10/06/%E3%80%90c%E5%B0%8F%E5%B7%A5%E5%85%B7%E3%80%91%E7%99%BE%E5%BA%A6%E7%BD%91%E7%9B%98%E4%B8%8D%E9%99%90%E9%80%9F%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=download&access_token={0}&path=" Pattern match: "http://www.139.sh" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=list&access_token={0}&path=" Pattern match: "http://www.mrs4s.top" Pattern match: "http://www.mrs4s.top/api/update.json" Pattern match: "https://www.baidupcs.com/rest/2.0/pcs/stream?method=download&access_token={0}&path=" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b26ae6db567b9c54 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "www.microsoft.com" Pattern match: "www.t2wpzdmadarc6ewhlyo.com" Pattern match: "www.mped6.com" Pattern match: "www.jlenp4bnxxwn3nfplk.com0" Pattern match: "www.ppikfvsi7uipqov.net0" Pattern match: "www.mvu2z7vln4vxalk5.com0" Pattern match: "www.g2gl7yzbmm.net0" Pattern match: "www.gcoe3xcyj7rlnsxj3.com" Pattern match: "www.6i2xzz6w5.com0" Pattern match: "www.2vmlwqoy2jjwubhpvpo.net0" Pattern match: "www.h5ofr5nfm6lmdhvkgmwd.com" Pattern match: "www.vlrl344ga2bafhg3dt2zor77k.com" Pattern match: "www.j3d4l.com" Pattern match: "www.o6f32es3e5b.com0" Pattern match: "www.2q7vmygvtz.net0" Pattern match: "www.hxlvbxtlcua2kum.com0" Pattern match: "www.yobrnrfvyrst4gwyf3vm.net0" Pattern match: "www.gqc2wlzhs2qqyi7fdic.com0" Pattern match: "www.mh2urnoke.net0" Pattern match: "www.gckuu6teaqznt4lgrg5t.com" Pattern match: "www.v32vlek4vf.com0" Pattern match: "www.l6fhbatoynttf.net0" Pattern match: "www.6w3j3k5z47rcnduutbrb.com" Pattern match: "www.mrs4s.top" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a4f569388123d930 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "http://genuine.microsoft.com/reporting/XmlEvent.ashx?v=3" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/quota?method=info&access_token={0" Pattern match: "http://pan.baidu.com/disk/home" Heuristic match: ".baidu.com" Heuristic match: "关于作者:\r\nQQ: 1844812067\r\nMail: mrs4sxiaoshi@gmail.com\r\nBlog: Mrs4s.top" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/quota?method=info&access_token=" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=delete&access_token={0}&path={1" Pattern match: "https://pcs.baidu.com/rest/2.0/pcs/file?method=mkdir&access_token={0}&path={1" Pattern match: "https://github.com/Mrs4s/BaiduExporter/releases" Pattern match: "https://www.torproject.org/download/download#warning" Pattern match: "https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s" Pattern match: "https://www.torproject.org/documentation.html" Heuristic match: ".onion" Pattern match: "www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org" Pattern match: "https://www.torproject.org/" Pattern match: "https://www.torproject.org/docs/faq.html#BestOSForRelay" Pattern match: "https://trac.torproject.org/8742" Pattern match: "http://freehaven.net/anonbib/#hs-attack06" Pattern match: "https://trac.torproject.org/projects/tor/ticket/14917" Pattern match: "https://blog.torproject.org/blog/lifecycle-of-a-new-relay" Pattern match: "http://%s" Heuristic match: "%s.onion" Pattern match: "http://%s:%d" Pattern match: "http://%s@%s:%d" Heuristic match: ".in-addr.arpa" Heuristic match: ".ip6.arpa" Heuristic match: "ip6.arpa" Heuristic match: "%d.%d.%d.%d.in-addr.arpa" Pattern match: "http://www.zlib.net/"29:T522,"" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\libeay32.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\libevent-2-0-5.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\libevent_core-2-0-5.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\libevent_extra-2-0-5.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\libgcc_s_sjlj-1.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\libssp-0.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\ssleay32.dll.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\tor-gencert.exe.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\tor.exe.tmp" with delete access "" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\zlib1.dll.tmp" with delete access "tor.exe" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\key-pinning-entries" with delete access "tor.exe" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\unverified-microdesc-consensus" with delete access "tor.exe" opened "C:\Users\AVZvBeo\AppData\Roaming\tor\state" with delete access2a:T6dc,"" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB025DB" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB0296C" (part of module "CLR.DLL") "" wrote bytes "65488b0425c8140000" to virtual address "0xEDB02B00" (part of module "CLR.DLL") "" wrote bytes "65488b0425c8140000" to virtual address "0xEDB02B20" (part of module "CLR.DLL") "" wrote bytes "65488b0425d0140000" to virtual address "0xEDB02BEB" (part of module "CLR.DLL") "" wrote bytes "7757ab3d0c200000" to virtual address "0xEE2169B8" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB026DD" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB02560" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB0286A" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB02523" (part of module "CLR.DLL") "" wrote bytes "65488b0425d0140000" to virtual address "0xEDB02B7B" (part of module "CLR.DLL") "" wrote bytes "65488b0425c8140000" to virtual address "0xEDB02AE3" (part of module "CLR.DLL") "" wrote bytes "65488b0425d0140000" to virtual address "0xEDB02BBB" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB02693" (part of module "CLR.DLL") "" wrote bytes "65488b0425d0140000" to virtual address "0xEDB02C2B" (part of module "CLR.DLL") "" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDB0263E" (part of module "CLR.DLL")2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A////////////////////////////////////////////////////////////////////////////////////////////////////////////8A////////////////////AAAAAAAAAADwAAAAD////wAAAAAAAAAAAAAAAA////8AAAAAAAAAAAAAAAAAD///AAAAAAAAAAAAAAAAAA///wAAAAAAAAAAAAAAAAAA//8AAAAAAAAAAAAAAAAAAP//AAAAAAAAAAAA//AAAAD//wAAAAAAAAAAAA8AAAAA//8AAAAAAAAAAAAAAAAAAP//AAAAAAAAAAD/AA/wAAD//wAAAAAAAAAA8AAA8AAA//8AAAAAAAAAAAAPAAAAAP//AAAAAAAAAAAADwAAAAD//wAAAAAAAAAAAP/wAAAA//8AAAAAAAAAAAAAAAAAAP//AAAAAAAAAAAAAAAAAAD//wAAAAAAAAAAAAAAAAAP//8AAAAAAAAAAAAAAAAA////AP//////////////////AAD//////////////////wAA////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792086017139,"unified_at":"2026-10-15T17:40:17.139Z","metadata":{"hashes":{"sha256":"d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59","sha1":"d61e119a88369b342f4f84d14b37ae42ffd5eb3f","md5":"13df67f01bb3ee1fe62112e134c386f2","sha512":"5d9f393b13eaabb369ec0fd92bf8658e11ee64e16a082cf71aae2d582115496c63ca10c118936bad12f9a2892135154aa93f2e2c7e12a0283175360355f231ba","ssdeep":"98304:fB0kl9tolf3ZRjcQzhraiQ2eeprZ0+OD22FYPQJd+lmILU11lw:p0MwjCiQ+rZ0+UYP0IwXl","ssdeep_chunks":["98304:fB0kl9t","98304:B0kl9to","98304:0kl9tol","98304:kl9tolf","98304:l9tolf3","98304:9tolf3Z","98304:tolf3ZR","98304:olf3ZRj","98304:lf3ZRjc","98304:f3ZRjcQ","98304:3ZRjcQz","98304:ZRjcQzh","98304:RjcQzhr","98304:jcQzhra","98304:cQzhrai","98304:QzhraiQ","98304:zhraiQ2","98304:hraiQ2e","98304:raiQ2ee","98304:aiQ2eep","98304:iQ2eepr","98304:Q2eeprZ","98304:2eeprZ0","98304:eeprZ0+","98304:eprZ0+O","98304:prZ0+OD","98304:rZ0+OD2","98304:Z0+OD22","98304:0+OD22F","98304:+OD22FY","98304:OD22FYP","98304:D22FYPQ","98304:22FYPQJ","98304:2FYPQJd","98304:FYPQJd+","98304:YPQJd+l","98304:PQJd+lm","98304:QJd+lmI","98304:Jd+lmIL","98304:d+lmILU","98304:+lmILU1","98304:lmILU11","98304:mILU11l","98304:ILU11lw","196608:fB0kl9t","196608:B0kl9to","196608:0kl9tol","196608:kl9tolf","196608:l9tolf3","196608:9tolf3Z","196608:tolf3ZR","196608:olf3ZRj","196608:lf3ZRjc","196608:f3ZRjcQ","196608:3ZRjcQz","196608:ZRjcQzh","196608:RjcQzhr","196608:jcQzhra","196608:cQzhrai","196608:QzhraiQ","196608:zhraiQ2","196608:hraiQ2e","196608:raiQ2ee","196608:aiQ2eep","196608:iQ2eepr","196608:Q2eeprZ","196608:2eeprZ0","196608:eeprZ0+","196608:eprZ0+O","196608:prZ0+OD","196608:rZ0+OD2","196608:Z0+OD22","196608:0+OD22F","196608:+OD22FY","196608:OD22FYP","196608:D22FYPQ","196608:22FYPQJ","196608:2FYPQJd","196608:FYPQJd+","196608:YPQJd+l","196608:PQJd+lm","196608:QJd+lmI","196608:Jd+lmIL","196608:d+lmILU","196608:+lmILU1","196608:lmILU11","196608:mILU11l","196608:ILU11lw","98304:p0MwjCi","98304:0MwjCiQ","98304:MwjCiQ+","98304:wjCiQ+r","98304:jCiQ+rZ","98304:CiQ+rZ0","98304:iQ+rZ0+","98304:Q+rZ0+U","98304:+rZ0+UY","98304:rZ0+UYP","98304:Z0+UYP0","98304:0+UYP0I","98304:+UYP0Iw","98304:UYP0IwX","98304:YP0IwXl"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"GPURiseAgent.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":4928000,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1522095248000,"last_seen":1660753357000,"last_multi_scan":1660753357000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","evasive","ransomware"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":20,"malicious_count":3,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Unwanted/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Generic.3034307","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/CoinMiner.ASI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"not-a-virus:NetTool.Win32.TorJok.agd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CoinMiner.ftrvzc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_MA.2CEFFAA6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_MA.2CEFFAA6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.CoinMiner","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00013380-00004076-54579-1-003814E0\n SetUnhandledExceptionFilter@KERNEL32.dll at 37936-898-62126270\n SetUnhandledExceptionFilter@KERNEL32.dll at 48258-134-62E92C70","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\GPURiseAgent.exe\" at 00012581-00002232-00000046-48013927","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.mrs4s.top\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"163.172.157.213:443\"\n \"86.59.21.38:443\"\n \"5.34.183.205:443\"\n \"86.59.119.83:443\"\n \"100.16.220.246:9001\"\n \"51.15.89.218:443\"\n \"213.163.70.234:443\"\n \"5.135.185.145:9001\"\n \"72.52.179.175:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\DotNetZip\\Zip\\obj\\Release\\Ionic.Zip.pdb\"\n \"%USERPROFILE%\\Desktop\\shared\\BaiduPanDownloadWinform\\BaiduPanDownload\\obj\\Release\\GPURiseAgent.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$25","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /api/update.json HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; QQWubi 133; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CIBA; InfoPath.2)Host: www.mrs4s.topConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll\" at EC560000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"tor.exe\" (UID: 00013380-00004076) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"tor.exe\" (UID: 00013380-00004076) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"tor.exe\" (UID: 00013380-00004076)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"GPURiseAgent.exe.bin\" (Offset: 1598167)","origin":"Binary File","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"tor.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"GPURiseAgent.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.82524701493","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"ECDSA\" (Indicator: \"ecdsa\"; File: \"00013380-00004076.00000002.17540.005EE000.00000002.mdmp\")\n \"RC4\" (Indicator: \"rc4\"; File: \"ssleay32.dll.tmp.4201607016\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"m 83TP9g/PYzOQdtYBJk6hLzbsayfoUtKG/6SHALvboXI\" (Indicator: \"vbox\")\n \"ntor-onion-key epBzC1Im1czKmROQWFJJvBOx6IxGOWGE911NxhIhIwQ=\" (Indicator: \"vbox\")\n \"ntor-onion-key 5bS2xVqeMuqW5cqw9OSiav/kWSNUELJSZ85qfK0O/WI=\" (Indicator: \"qemu\")\n \"id ed25519 jQT6rLV4vbOXahQwHI2E1Ft1G3dVvP5iOe+O2D3IicQ\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tor.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"tor.exe\" read file \"C:\\Users\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"libssp-0.dll.tmp\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"libevent_extra-2-0-5.dll.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"zlib1.dll.tmp\" has type \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"libevent_core-2-0-5.dll.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"tor-gencert.exe.tmp\" has type \"PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"tor.exe.tmp\" has type \"PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"libgcc_s_sjlj-1.dll.tmp\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"libevent-2-0-5.dll.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"libeay32.dll.tmp\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"ssleay32.dll.tmp\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"details too long to display","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; QQWubi 133; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CIBA; InfoPath.2)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"m YdmqQFs7eX+7/4kOsahpRvnclZMakk5G3H0L9hmySL8\" (Indicator for product: Generic VNC)\n \"m +22eJFYJMCcLOyqkfWYR2maFiYZzBtMBvncFhMAgmkw\" (Indicator for product: Generic VNC)\n \"m 0Y6IyLCgvncKTbQKqnjRAKXynNWH3kUxKd0ThmTypt0\" (Indicator for product: Generic VNC)\n \"T/7vbOB4QuJvwlt/3Yn6MkvncZRxw2iECmtGaD+CCdJCQ5com72yNTtDScrwVN4t\" (Indicator for product: Generic VNC)\n \"MIGJAoGBALlg4OYbbw8IO8/6Kvncdr/5szHkIi2bQpTMYsFO+jleOam7+iiIZPlV\" (Indicator for product: Generic VNC)\n \"ntor-onion-key 8Jyk2oOO3dGso1HAgyij7z4JH1FdjuxmpBsFoJvncl0=\" (Indicator for product: Generic VNC)\n \"5OjCtWBnypzSBNDvncnc70mmLgmUraDhMCFdVeuZCiIkfOLvERs1AgMBAAE=\" (Indicator for product: Generic VNC)\n \"MIGJAoGBAKpzF/SSOUxOw+vd285JnCfvncS6ET3tIujdxSlS8jeD1SCCehfGMw19\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"cmd=\" (Indicator: \"cmd=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"tor.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\tor\\tor.exe\" marked \"%APPDATA%\\tor\\unverified-microdesc-consensus\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"libssp-0.dll.tmp\" claimed CRC 107654 while the actual is CRC 4928296\n \"libevent_extra-2-0-5.dll.tmp\" claimed CRC 451113 while the actual is CRC 107654\n \"zlib1.dll.tmp\" claimed CRC 145013 while the actual is CRC 451113\n \"libevent_core-2-0-5.dll.tmp\" claimed CRC 467440 while the actual is CRC 145013\n \"tor-gencert.exe.tmp\" claimed CRC 1065703 while the actual is CRC 467440\n \"libgcc_s_sjlj-1.dll.tmp\" claimed CRC 540122 while the actual is CRC 1065703\n \"libevent-2-0-5.dll.tmp\" claimed CRC 781000 while the actual is CRC 540122\n \"ssleay32.dll.tmp\" claimed CRC 764532 while the actual is CRC 781000","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"TerminateProcess\n GetModuleHandleA\n UnhandledExceptionFilter\n GetTickCount\n VirtualProtect\n Sleep\n GetProcAddress\n RegOpenKeyExA\n RegCloseKey\n bind\n socket\n recvfrom\n sendto\n listen\n LoadLibraryA\n accept\n connect\n closesocket\n send\n WSASend\n recv\n GetModuleFileNameW\n GetVersionExA\n MapViewOfFile\n FindFirstFileA\n GetStartupInfoA\n CreateFileMappingA\n FindNextFileA\n CreateProcessA\n CreateFileA\n GetFileSize\n WSAStartup","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"libssp-0.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_extra-2-0-5.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"zlib1.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_core-2-0-5.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"libgcc_s_sjlj-1.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent-2-0-5.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"ssleay32.dll.tmp\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/12 Antivirus vendors marked dropped file \"tor-gencert.exe.tmp\" as malicious (classified as \"Trojan.Heur\" with 8% detection rate)\n 1/12 Antivirus vendors marked dropped file \"tor.exe.tmp\" as malicious (classified as \"Trojan.Heur\" with 8% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/12 Antivirus vendors marked spawned process \"tor.exe\" (PID: 4076) as malicious (classified as \"Trojan.Heur\" with 8% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 100.16.220.246 on port 9001\n TCP traffic to 5.135.185.145 on port 9001","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}],"incidents":[{"name":"Remote Access","details_count":4,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Contains ability to listen for incoming connections"},{"detail":"Contains a remote desktop related string"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":84,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":77,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":9,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["suspicious","evasive","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5ab9548f7ca3e125c64216b4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["AUT","FRA","GBR","NLD","UKR","USA"],"submit_name":"GPURiseAgent.exe","analysis_start_time":"2018-03-26T22:54:39+00:00","indicators_count":{"informative":21,"suspicious":35,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"163.172.157.213","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"86.59.21.38","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"5.34.183.205","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"86.59.119.83","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"100.16.220.246","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"51.15.89.218","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"213.163.70.234","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"5.135.185.145","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"address":"72.52.179.175","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}],"dns_resolutions":[{"domain":"www.mrs4s.top","address":"72.52.179.175","ttl":3599,"country":"United States","registrar_name":"West263 International Limited","registrar_organization":"Temporary template","registrar_name_servers":"ns1.parklogic.com","registrar_creation_date":"2017-10-14T18:00:47+00:00","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}],"http_requests":[{"host":"www.mrs4s.top","host_ip":"72.52.179.175:80","url":"/api/update.json","method":"GET","header":"GET /api/update.json HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; QQWubi 133; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CIBA; InfoPath.2)\nHost: www.mrs4s.top\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}],"processes":[{"pid":2232,"ppid":0,"name":"GPURiseAgent.exe","command_line":"","sha256":"d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59","normalized_path":"C:\\GPURiseAgent.exe","uid":"00012581-00002232","icon":"$2b"},{"pid":4076,"ppid":2232,"name":"tor.exe","command_line":"","sha256":"b69cbf7ece1f0c6115d36b012b2a611cc12ec8c8503dd1cbeb9561b88af6983b","normalized_path":"%APPDATA%\\tor\\tor.exe","parent_uid":"00012581-00002232","uid":"00013380-00004076"}],"all_imported_dlls":["winhttp.dll","wow64win.dll","KernelBase.dll","usp10.dll","rtutils.dll","libssp-0.dll","sechost.dll","mscoreei.dll","imm32.dll","FWPUCLNT.DLL","zlib1.dll","devobj.dll","System.Drawing.ni.dll","credssp.dll","winnsi.dll","ntmarta.dll","kernel32.dll","advapi32.dll","ws2_32.dll","WSHTCPIP.DLL","IPHLPAPI.DLL","shlwapi.dll","rsaenh.dll","System.Numerics.ni.dll","rasapi32.dll","dhcpcsvc.dll","dnsapi.dll","oleaut32.dll","libeay32.dll","msctf.dll","clr.dll","System.Xml.ni.dll","mscorrc.dll","cryptsp.dll","mswsock.dll","dhcpcsvc6.dll","clbcatq.dll","ole32.dll","cryptbase.dll","System.Windows.Forms.ni.dll","libgcc_s_sjlj-1.dll","ssleay32.dll","wkscli.dll","ntdll.dll","uxtheme.dll","System.Core.ni.dll","wship6.dll","webio.dll","srvcli.dll","user32.dll","rasadhlp.dll","netapi32.dll","propsys.dll","netutils.dll","System.ni.dll","cfgmgr32.dll","wow64.dll","setupapi.dll","msvcr120_clr0400.dll","nlssorting.dll","apphelp.dll","rpcrt4.dll","lpk.dll","System.Configuration.ni.dll","GdiPlus.dll","libevent-2-0-5.dll","mscorlib.ni.dll","dwmapi.dll","sspicli.dll","wow64cpu.dll","mscoree.dll","version.dll","api-ms-win-core-xstate-l2-1-0.dll","nsi.dll","msvcrt.dll","gdi32.dll","shell32.dll","WindowsCodecs.dll","diasymreader.dll","tzres.dll","Wldap32.dll","clrjit.dll","comctl32.dll","rasman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"tor-gencert.exe.tmp","sha256":"59b6b92c1e23cf6f99b0e0fb9e6c41debcd46578dd2f5970448420ba1035bbd5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"tor.exe.tmp","sha256":"b69cbf7ece1f0c6115d36b012b2a611cc12ec8c8503dd1cbeb9561b88af6983b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"libeay32.dll.tmp","sha256":"fe5d316c59ac5b663741d70a922818129275071d1f2b83339059e488e6d9a7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"libevent-2-0-5.dll.tmp","sha256":"d1ee97282a2ddfcbd7cc6f45f8278c56bfcc3896b05c4f5ebbc5e5d7d4a897b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"libevent_core-2-0-5.dll.tmp","sha256":"5f057c50bdd22e4d481cf033984d66b9ab7b79e7388a8a928d8a048e08f40386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"libevent_extra-2-0-5.dll.tmp","sha256":"dbc8a9a2cb33940283078e6d7b767499743e1988479482c7d54d435e943de158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"libgcc_s_sjlj-1.dll.tmp","sha256":"4438b384066ae07fb9537ba948c020323d03d53e197ac6c3629a135f3a44cd27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"libssp-0.dll.tmp","sha256":"f5489fb8b5229424ddbd8f38bb93d9a950d029d9d3f36fc1e531086819061cd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"ssleay32.dll.tmp","sha256":"aa7db86c6995ab0c38d88b910484c1cda6f318bc9b82f3123cd65743ab3efd55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"zlib1.dll.tmp","sha256":"dbf9926c56f4fd53418e7e078cc6fb0e23f056e2035c09ae9b1ba236306de44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"cached-microdesc-consensus.tmp","sha256":"d710c34b3056d7ddfd034ab0b67b6c464c578d0daf2ff69cbbba334cbfce8c08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"cached-certs.tmp","sha256":"94112bac06481bc5e826b71135a10e4cdd58738e311f47536c36485e03098fe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"cached-microdescs.new","sha256":"0b1264b0bed87ee5b87d8d40426718cad86379d088f49c6e11c4403b62bf6d0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"state.tmp","sha256":"4cb98de2d0654473c164d3153dad0aafaee0b44df7564cdd0213a5b75a8c98f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"tor.zip","sha256":"195905bd2e93a5a321119a294426da3dfed9eb6a387c1a81ce466008771e8bae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"unverified-microdesc-consensus.tmp","sha256":"d710c34b3056d7ddfd034ab0b67b6c464c578d0daf2ff69cbbba334cbfce8c08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\GPURiseAgent.exe.config","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\GPURiseAgent.exe","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\43d86904e41b891e07c2ce8a20996e2c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\47e0be927382f169f5de470fab0ceb7d\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\617299d2bd5dcfe094cedface0c39d1c\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\38470d5ed01fd95e48dcf4e1b0b4774e\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\f5db2f7c181e6f1344c9bc8dbcffce3b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Fonts\\msyhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\tor.zip","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\lock","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\state.tmp","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\router-stability","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\geoip","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\geoip6","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-certs","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\unverified-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-certs.tmp","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\7e67677628b6244d9195c4fdb3378691\\System.Numerics.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\dll\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\System.Windows.Forms.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"C:\\GPURiseAgent.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\symbols\\exe\\GPURiseAgent.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\exe\\GPURiseAgent.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"path":"%WINDIR%\\GPURiseAgent.pdb","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\GPURISEAGENT_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\GPURISEAGENT_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ab9548f7ca3e125c64216b4"}]}]}},"report_ids":{"sandbox_job_ids":["5ab9548f7ca3e125c64216b4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.CoinMiner Sample d5db82cf829d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d5db82cf829d…. Malware family: Trojan.CoinMiner. Threat score 100/100. 9/26 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.CoinMiner Sample d5db82cf829d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d5db82cf829d…. Malware family: Trojan.CoinMiner. Threat score 100/100. 9/26 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d5db82cf829d8ddc15a7bb06fa3cfffe9798b2440e61ad0fde0c7d530a594c59"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.CoinMiner Sample d5db82cf829d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d5db82cf829d…. Malware family: Trojan.CoinMiner. Threat score 100/100. 9/26 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]