23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample dee6c01a9e59… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dee6c01a9e59…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759"],"about":{"@type":"SoftwareApplication","name":"80.exe","applicationCategory":["peexe","executable"],"identifier":"dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":29},"behavioralIndicators":{"malicious":3,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T73b,"_ReCoVeRy_+dvxjk.html" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.png" has type "PNG image data, 1150 x 1000, 8-bit/color RGBA, non-interlaced" "_ReCoVeRy_+dvxjk.txt" has type "ASCII text, with CRLF line terminators" "_ReCoVeRy_+dvxjk.txt.165961512" has type "ASCII text, with CRLF line terminators" "_ReCoVeRy_+dvxjk.html.298368556" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.331922988" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.566804012" has type "HTML document, ASCII text, with very long lines" "ppcysdfhbfdq.exe.1502174418" has type "PE32 executable (GUI) Intel 80386, for MS Windows" "_ReCoVeRy_+dvxjk.html.1640545836" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.1682488876" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.1774763564" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.1791540780" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.1816706604" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.1925758508" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.1942535724" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.2076753452" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.2101919276" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.2143862316" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.2278080044" has type "HTML document, ASCII text, with very long lines" "_ReCoVeRy_+dvxjk.html.2294857260" has type "HTML document, ASCII text, with very long lines"25:T415,"OzCZo/A1TT9sXjcHPKbKF9/mJV/Zn5x5I99f+Ury9I2RIiJECcE1uJTBQHAHhoPsWktZzUF8iRd95cuTq7x1eSifXmFXQZnt/2QQrzXi9IUZ0Wzk6cnPFoQKh4r6Eg03dgLJtxziF5T72vu8/IzCAkhoHbLKYQhMYj/afNPxBxUyE4xawakx522QN7Vmsu/mZQZuwA4jCS5yAqSifbendd+m1bez0UioTqliBhWQv8ZKT6c/UrLC5h++vv8AKMY1Y7mrQGXlSOoEaFNVIVUozQzahQf6QGFjh17zufnPzrDjkldIJGQfaZBp0kkDexOpOkrHTA45uQbJsg7erBTPTr1uSytOyat75uSAHIwjbB08BoH12RB4YhxEzFYzRp39gE2QhXFDWJvW/Dwt7doJwarzS5nbsTkRbDqoaUfIe//SgYWdCaiwSB6bSNm2VjjqJxiUl8/miqIMpL33AZ7V1TiLABjVDq7rLruo7Pzpso3QWRPRR0cSclNtbSP9FmqVmJg+KcUS4e8b0ALvX7vHmcoSS6CUlnmZ/2DmUBwFxw9rb0ZC57qStofEiL9SII4cZDwO6T3HKr7qnsC9jmzU64r9PXdH9LZogOhsqimHbqWRlYLxSr9EeZkO9FhGdzYp6vwq3frzUiG+RIaqOl1tqf23GGJx5IumD/wQlui0AGpoCUJlCPYbSRerHASgrSJdyXnI2SC6N9ubpYCujeQvW8X/01qf1lKgzutUu0/mIrN1wENCmv9u/BdP+nPD+Z5dYRkthWJPlut0F6hEdF6kAbJN54HBlwDYn0VbAcJMpV12DWX61E5Lec91oLz+rIaQZ4eJaSwqbHVv0mbLMShjprfa/VQaz5dzwdYR8nSaDezQaixuwIx+MGPv8ioBGyaL23akty8Xi3tjWjxkvwqIn+n+0UD75J50QEMuzGAu/s2+nODx2+3DOpSK6N21XxxnYw8mxmjwdaVecHdi5Zr7uQbXpzCYZLcDL6MxixdtKEMQDlnZdY244W1VnzFZ8+M" (Indicator: "qemu")26:T5ef,"" opened "%WINDIR%\System32\" with delete access "" opened "%WINDIR%\System32\a.Config" with delete access "" opened "%WINDIR%\System32\a" with delete access "" opened "%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80" with delete access "" opened "%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll" with delete access "" opened "%WINDIR%\system32\MPR.dll" with delete access "" opened "%WINDIR%\system32\rpcss.dll" with delete access "" opened "%WINDIR%\system32\profapi.dll" with delete access "" opened "%WINDIR%\ppcysdfhbfdq.exe" with delete access "" opened "%WINDIR%\" with delete access "" opened "C:\" with delete access "" opened "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2" with delete access "" opened "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll" with delete access "" opened "%WINDIR%\system32\ntmarta.dll" with delete access "" opened "%WINDIR%\system32\CRYPTSP.dll" with delete access "" opened "%WINDIR%\system32\rsaenh.dll" with delete access "" opened "%WINDIR%\system32\" with delete access27:T4eb,Found malicious artifacts related to "178.162.214.146" (ASN: 16265, Owner: LeaseWeb B.V.): ... URL: http://tele-channel.com/wp-admin/maint/wcspng.php (AV positives: 1/67 scanned on 03/10/2016 12:37:40) URL: http://zardehtalaee.ir/news/new11/acct.php (AV positives: 7/68 scanned on 03/10/2016 10:19:01) URL: http://zardehtalaee.ir/news/new11/form.html (AV positives: 7/68 scanned on 03/10/2016 10:03:29) URL: http://www.zardehtalaee.ir/home/homme (AV positives: 1/67 scanned on 03/10/2016 09:49:47) URL: http://zardehtalaee.ir/news/new11/update.html (AV positives: 7/68 scanned on 03/10/2016 09:33:22) File SHA256: 08f6a22bf392badd261f0aefdcee817b6c39108a419d072a545d76f876719f99 (AV positives: 4/57 scanned on 03/10/2016 13:33:36) File SHA256: dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759 (AV positives: 4/56 scanned on 03/10/2016 13:32:38) File SHA256: 68017e5c4efe1221f417def5309e5b239adf8b20f9fe69f09eee25bbffb544f3 (AV positives: 4/57 scanned on 03/10/2016 12:54:47) File SHA256: d8bbda7d3a2a909750726f56fe2ee2e8eec4ee29dae87aae2602b04ef30545a3 (AV positives: 4/57 scanned on 03/10/2016 12:54:16) File SHA256: ccd0ed809fb4c56dcffe13f00ebe47e2fe671e711ed2f56fe45d40b72f159104 (AV positives: 5/57 scanned on 03/10/2016 12:38:15)28:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790265173503,"unified_at":"2026-09-24T15:52:53.503Z","metadata":{"hashes":{"sha256":"dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759","sha1":"8a0626ccfc989c4f0cd10d5b6e4661afa08f5198","md5":"12aea17b5450e3bfc872c9f6fe6603da","sha512":"ff19815b79e2d3c4e8c4e360eb591a1545093969299997e70399eeb9676fa3c682b25367ba1aecb358102142d1f74c1ae4e27b1a7a062c230b8c1a5bcc0ba4e4","ssdeep":"6144:tW9cdEA0i/brqSw9E+AyXkb/zlaMvZkG93:tW9gHqS7+Ay8z1x3","ssdeep_chunks":["6144:tW9cdEA","6144:W9cdEA0","6144:9cdEA0i","6144:cdEA0i/","6144:dEA0i/b","6144:EA0i/br","6144:A0i/brq","6144:0i/brqS","6144:i/brqSw","6144:/brqSw9","6144:brqSw9E","6144:rqSw9E+","6144:qSw9E+A","6144:Sw9E+Ay","6144:w9E+AyX","6144:9E+AyXk","6144:E+AyXkb","6144:+AyXkb/","6144:AyXkb/z","6144:yXkb/zl","6144:Xkb/zla","6144:kb/zlaM","6144:b/zlaMv","6144:/zlaMvZ","6144:zlaMvZk","6144:laMvZkG","6144:aMvZkG9","6144:MvZkG93","12288:tW9cdEA","12288:W9cdEA0","12288:9cdEA0i","12288:cdEA0i/","12288:dEA0i/b","12288:EA0i/br","12288:A0i/brq","12288:0i/brqS","12288:i/brqSw","12288:/brqSw9","12288:brqSw9E","12288:rqSw9E+","12288:qSw9E+A","12288:Sw9E+Ay","12288:w9E+AyX","12288:9E+AyXk","12288:E+AyXkb","12288:+AyXkb/","12288:AyXkb/z","12288:yXkb/zl","12288:Xkb/zla","12288:kb/zlaM","12288:b/zlaMv","12288:/zlaMvZ","12288:zlaMvZk","12288:laMvZkG","12288:aMvZkG9","12288:MvZkG93","6144:tW9gHqS","6144:W9gHqS7","6144:9gHqS7+","6144:gHqS7+A","6144:HqS7+Ay","6144:qS7+Ay8","6144:S7+Ay8z","6144:7+Ay8z1","6144:+Ay8z1x","6144:Ay8z1x3"],"imphash":"4aa03a6632770d730be36c12acdad8a6"},"file_info":{"file_name":"80.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":601600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287129000,"last_seen":1664555997000,"last_multi_scan":1664555997000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["alphacrypt","ransomware","teslacrypt"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":22,"malicious_count":3,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Teslacrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.A.40776","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt.KU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.FBEG-4468","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt.KU (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.TeslaCrypt.I trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004dbeae1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Bitman.rbe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.yk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.efhajv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Locky.S3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AQQC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.TeslaCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Crypt.601600","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.CE32BAD5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.CE32BAD5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt5.AOVI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.867587","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00013165-00002972-6100-228-00425D8D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013165-00002972-6100-325-0042BBA5\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013165-00002972-21776-228-00425D8D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"tele-channel.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"178.162.214.146:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WMIC.exe\" with commandline \"shadowcopy delete /nointeractive\" (UID: 00013806-00003828)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$24","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://rbg4hfbilrf7to452p89hrfq.boonmower.com/%S\"\n Pattern match: \"http://irhng84nfaslbv243ljtblwqjrb.pinnafaon.at/%S\"\n Pattern match: \"https://translate.google.com\"\n Pattern match: \"http://en.wikipedia.org/wiki/RSA_(cryptosystem)\"\n Pattern match: \"http://rbg4hfbilrf7to452p89hrfq.boonmower.com/EC36C8D455611F6B\"\n Pattern match: \"http://irhng84nfaslbv243ljtblwqjrb.pinnafaon.at/EC36C8D455611F6B\"\n Pattern match: \"http://t54ndnku456ngkwsudqer.wallymac.com/EC36C8D455611F6B\"\n Pattern match: \"http://www.torproject.org/projects/torbrowser.html.en\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 27083-388-00407E16\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013165-00002972-6100-12-00425793\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013165-00002972-6100-33-00426B3A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013165-00002972-6100-1104-0042B683\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013165-00002972-21776-12-00425793\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013165-00002972-21776-33-00426B3A\n SetUnhandledExceptionFilter@KERNEL32.dll at 12500-388-00407E16","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 27083-1-00403E59\n GetVersionExW@KERNEL32.DLL at 00013165-00002972-6100-46-0041F2F0\n GetVersionExW@KERNEL32.DLL at 00013165-00002972-6100-589-0041CCB0\n GetVersionExW@KERNEL32.DLL at 00013165-00002972-21776-46-0041F2F0\n GetVersionExA@KERNEL32.dll at 12500-1-00403E59","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00013165-00002972-6100-142-0042F7A6\n GetProcessHeap@KERNEL32.DLL at 00013165-00002972-6100-692-00413F10\n GetProcessHeap@KERNEL32.DLL at 00013165-00002972-21776-142-0042F7A6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$25","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /wp-admin/maint/wcspng.php HTTP/1.1\nAccept: t\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Windows\\80.exe\"\n \"\" created file \"C:\\Windows\\ppcysdfhbfdq.exe\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\system32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"ppcysdfhbfdq.exe.1502174418\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server\" (Source: _ReCoVeRy_+dvxjk.txt, Indicator: \"private key and decrypt program\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WIMC)","description":"Process \"WMIC.exe\" with commandline \"shadowcopy delete /nointeractive\" (UID: 00013806-00003828)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"80.exe.bin\" claimed CRC 16797738 while the actual is CRC 607158","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleW\n GetCommandLineA\n GetVersionExA\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetTickCount\n TerminateProcess\n IsDebuggerPresent\n LoadLibraryA\n Sleep\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/55 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%WINDIR%\\ppcysdfhbfdq.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"level":"suspicious","category":"Installation/Persistance","name":"File system monitor detected changes at critical system location","description":"Found a system modification for file \"deqplgtrkxjc.exe.1457618232941\" (Context: \"%WINDIR%\\deqplgtrkxjc.exe\", Type: \"data\", Additional Info: New file)","origin":"Binary File","relevance":5,"id":"binary-13","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\80.exe\" marked \"%WINDIR%\\deqplgtrkxjc.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]}],"incidents":[{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WIMC)"}],"sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["alphacrypt","ransomware","teslacrypt"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"58f986b6aac2ed940625806a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Crypt","contacted_countries":["ARE","USA"],"submit_name":"12aea17b5450e3bfc872c9f6fe6603da.exe","analysis_start_time":"2017-04-21T05:15:02+00:00","indicators_count":{"informative":20,"suspicious":29,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"56e179f7aac2ed3f699a2760","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":79,"malware_family":"PE:Malware.Obscure","contacted_countries":["DEU"],"submit_name":"80.exe","analysis_start_time":"2016-03-10T07:43:55+00:00","indicators_count":{"informative":8,"suspicious":22,"malicious":3},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"56e179f7aac2ed3f699a275e","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"suspicious","threat_score":38,"malware_family":"PE:Malware.Obscure","submit_name":"80.exe","analysis_start_time":"2016-03-10T07:51:19+00:00","indicators_count":{"informative":3,"suspicious":11,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"178.162.214.146","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]}],"dns_resolutions":[{"domain":"tele-channel.com","address":"178.162.214.146","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]}],"http_requests":[{"host":"tele-channel.com","host_ip":"178.162.214.146:80","url":"/wp-admin/maint/wcspng.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}],"processes":[{"pid":2972,"ppid":0,"name":"80.exe","command_line":"","normalized_path":"","uid":"00013165-00002972","icon":"$28"},{"pid":1972,"ppid":0,"name":"ppcysdfhbfdq.exe","command_line":"","normalized_path":"","uid":"00013649-00001972"},{"pid":3828,"ppid":0,"name":"WMIC.exe","command_line":"shadowcopy delete /nointeractive","normalized_path":"","uid":"00013806-00003828"}],"all_imported_dlls":["setupapi.dll","cfgmgr32.dll","GdiPlus.dll","mpr.dll","Wldap32.dll","usp10.dll","iertutil.dll","cryptbase.dll","comctl32.dll","ntmarta.dll","devobj.dll","lpk.dll","msctf.dll","msasn1.dll","apphelp.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","shell32.dll","oleaut32.dll","uxtheme.dll","user32.dll","dbghelp.dll","imm32.dll","shlwapi.dll","wininet.dll","clbcatq.dll","RpcRtRemote.dll","sspicli.dll","gdi32.dll","ole32.dll","psapi.dll","advapi32.dll","sechost.dll","profapi.dll","propsys.dll","cryptsp.dll","KernelBase.dll","msvcrt.dll","urlmon.dll","crypt32.dll","rsaenh.dll","SHLWAPI.dll","LPK.dll","SETUPAPI.dll","MPR.dll","USER32.dll","KERNELBASE.dll","gdiplus.dll","WININET.dll","CRYPTBASE.dll","GDI32.dll","MSCTF.dll","SHELL32.dll","CFGMGR32.dll","PSAPI.DLL","USP10.dll","IMM32.DLL","SspiCli.dll","ADVAPI32.dll","VERSION.dll","OLEAUT32.dll","RPCRT4.dll","DEVOBJ.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ppcysdfhbfdq.exe","sha256":"dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"_ReCoVeRy_+dvxjk.html","sha256":"ae09bef3ef4cf6c91851a69a1ba40f550d38bef7d83030b8c6bc0a09399e6e15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"_ReCoVeRy_+dvxjk.png","sha256":"770b3a5476c13dc19a99e4c2a7c7c782b4faed82272424ebabe5206baf99ab9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"_ReCoVeRy_+dvxjk.txt","sha256":"2df45eb057f24f70eaa17e9b5481d4b7f389a6bdfd390244b214e10af8f8715e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"deqplgtrkxjc.exe","sha256":"1dc8fa5ff970204a22f65a35a7167135f9492163e49f6d79237176696b8e4341","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"path":"%WINDIR%\\80.exe","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"},{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"path":"C:\\80.exe","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%WINDIR%\\ppcysdfhbfdq.exe","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%USERPROFILE%\\Documents\\recover_file_oohaqguje.txt","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%SAMPLEDIR%\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\_ReCoVeRy_+dvxjk.txt","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%SAMPLEDIR%\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\_ReCoVeRy_+dvxjk.html","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\$Recycle.Bin\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%SAMPLEDIR%\\$Recycle.Bin\\_ReCoVeRy_+dvxjk.txt","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%SAMPLEDIR%\\$Recycle.Bin\\_ReCoVeRy_+dvxjk.html","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\api\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\bin\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\ctx\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\dmp\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\scr\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\shc\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\smp\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\0\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\1\\api\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\1\\bin\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\1\\ctx\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\1\\dmp\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"C:\\analysis\\1\\scr\\_ReCoVeRy_+dvxjk.png","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"path":"%WINDIR%\\deqplgtrkxjc.exe","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]},{"path":"%SAMPLEDIR%\\80.exe","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a275e"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e179f7aac2ed3f699a2760"}]}]}},"report_ids":{"sandbox_job_ids":["58f986b6aac2ed940625806a","56e179f7aac2ed3f699a2760","56e179f7aac2ed3f699a275e"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample dee6c01a9e59… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dee6c01a9e59…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample dee6c01a9e59… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dee6c01a9e59…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dee6c01a9e597def1462e1b80b3f35e94b56a1f947aa8edde4012e4a2aac8759"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample dee6c01a9e59… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dee6c01a9e59…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]