24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e25230c9df9c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e25230c9df9c…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4"],"about":{"@type":"SoftwareApplication","name":"DataKeeper.exe.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6c8,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\8990487b8c05ada1e1febe7dcb6c0410\System.Windows.Forms.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\24db7e31c7ba5b0e824e2f521c0914bc\System.Drawing.ni.dll.aux"26:T5ca,"" queried SystemProcessInformation at 00039194-00002780-00000105-15098723444 "" queried SystemProcessInformation at 00039194-00002780-00000105-15113125991 "" queried SystemProcessInformation at 00039194-00002780-00000105-16298870914 "" queried SystemProcessInformation at 00039194-00002780-00000105-16543176370 "" queried SystemProcessInformation at 00039194-00002780-00000105-16544587429 "" queried SystemProcessInformation at 00039194-00002780-00000105-16806840753 "" queried SystemProcessInformation at 00039194-00002780-00000105-16807844747 "" queried SystemProcessInformation at 00039194-00002780-00000105-16812298387 "" queried SystemProcessInformation at 00039194-00002780-00000105-16813164056 "" queried SystemProcessInformation at 00039194-00002780-00000105-17563034177 "" queried SystemProcessInformation at 00039194-00002780-00000105-17564022974 "" queried SystemProcessInformation at 00039194-00002780-00000105-19032419163 "" queried SystemProcessInformation at 00039194-00002780-00000105-19033535955 "" queried SystemProcessInformation at 00039194-00002780-00000105-19853526519 "Icortroc.bin" queried SystemProcessInformation at 00040266-00004028-00000105-42366464827 "Icortroc.bin" queried SystemProcessInformation at 00040266-00004028-00000105-4237019669427:T88d,"" wrote bytes "2220b1f7" to virtual address "0x6E842024" (part of module "CLR.DLL") "" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x00AC296E" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "0000000000000000" to virtual address "0x00A601A0" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29A4" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29C4" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29E4" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "0000000000000000000000000000000001000000d6000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x00AC2000" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29E0" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "db4d736f00000000" to virtual address "0x00AD6000" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "4e74436f6e74696e756500" to virtual address "0x00AC2962" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "0000000000000000" to virtual address "0x00A601C8" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC297C" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "0000000000000000" to virtual address "0x00A601F0" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29B4" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29D4" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29B0" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "00000000" to virtual address "0x00AC29D0" (part of module "DATAKEEPER.EXE.EXE") "" wrote bytes "0000000000000000" to virtual address "0x00A60178" (part of module "DATAKEEPER.EXE.EXE")28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8Ad3d3d3d3d3d3d3d3dwD/B/////////////////9w/weIiIiIiIiIiIiIiIiId/93iIiIiIiIiIiIiIiIiHf/d/iIiIiIiIiIiIiIiIh3/3f4iIiIiIiIiIiIiIiId/93+IiIiIiIiIiIiIiIj3f/d/iIiIiIiIiIiIiIiI93/3f/////////////////d/93/////////////////3f/d/////////////////93/3f/////////////////d/93/////////////////3f/d/////////////////93/3f/////////////////d/93/////////////////3f/d/////////////////93/3f/////////////////d/93/////////////////3f/d/////////////////93/3eIiIiIiIiIiIiIiIiId/9mh3d3d3d3d3d3d3d3eGf/Znd3d3d3d3d3d3d3d3dn/2Z3d3d3d3d3d3d3d3d3Zv9miIiIiIiIiIiIiIiIiGb/ZmZmZmZmZmZmZmZmZmZm//////////////////////////////////////////////////////////////////////4AAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAA////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790497235421,"unified_at":"2026-09-27T08:20:35.421Z","metadata":{"hashes":{"sha256":"e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4","sha1":"832663ed778a895012d01497ffc16c48b10579c3","md5":"d7091f77305f4dfd8471e6302c7f4e77","sha512":"cb8775a65f74ca982fd7e17e1654e6de30b94542eed768e162da316fc52660c547280eb296f65fd67e33ba1e5c89e999877a1a9175c0d6052508e0eab5033130","ssdeep":"12288:xeVtglz0xIOsgiGtsjCkeT+2DtIaSzpih65tm96gWaUZQMe:x2glY+dAtsWkeq6tWzpi","ssdeep_chunks":["12288:xeVtglz","12288:eVtglz0","12288:Vtglz0x","12288:tglz0xI","12288:glz0xIO","12288:lz0xIOs","12288:z0xIOsg","12288:0xIOsgi","12288:xIOsgiG","12288:IOsgiGt","12288:OsgiGts","12288:sgiGtsj","12288:giGtsjC","12288:iGtsjCk","12288:GtsjCke","12288:tsjCkeT","12288:sjCkeT+","12288:jCkeT+2","12288:CkeT+2D","12288:keT+2Dt","12288:eT+2DtI","12288:T+2DtIa","12288:+2DtIaS","12288:2DtIaSz","12288:DtIaSzp","12288:tIaSzpi","12288:IaSzpih","12288:aSzpih6","12288:Szpih65","12288:zpih65t","12288:pih65tm","12288:ih65tm9","12288:h65tm96","12288:65tm96g","12288:5tm96gW","12288:tm96gWa","12288:m96gWaU","12288:96gWaUZ","12288:6gWaUZQ","12288:gWaUZQM","12288:WaUZQMe","24576:xeVtglz","24576:eVtglz0","24576:Vtglz0x","24576:tglz0xI","24576:glz0xIO","24576:lz0xIOs","24576:z0xIOsg","24576:0xIOsgi","24576:xIOsgiG","24576:IOsgiGt","24576:OsgiGts","24576:sgiGtsj","24576:giGtsjC","24576:iGtsjCk","24576:GtsjCke","24576:tsjCkeT","24576:sjCkeT+","24576:jCkeT+2","24576:CkeT+2D","24576:keT+2Dt","24576:eT+2DtI","24576:T+2DtIa","24576:+2DtIaS","24576:2DtIaSz","24576:DtIaSzp","24576:tIaSzpi","24576:IaSzpih","24576:aSzpih6","24576:Szpih65","24576:zpih65t","24576:pih65tm","24576:ih65tm9","24576:h65tm96","24576:65tm96g","24576:5tm96gW","24576:tm96gWa","24576:m96gWaU","24576:96gWaUZ","24576:6gWaUZQ","24576:gWaUZQM","24576:WaUZQMe","12288:x2glY+d","12288:2glY+dA","12288:glY+dAt","12288:lY+dAts","12288:Y+dAtsW","12288:+dAtsWk","12288:dAtsWke","12288:AtsWkeq","12288:tsWkeq6","12288:sWkeq6t","12288:Wkeq6tW","12288:keq6tWz","12288:eq6tWzp","12288:q6tWzpi"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"DataKeeper.exe.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":459776,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1541626772000,"last_seen":1623434482000,"last_multi_scan":1623434482000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["genasom","ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":10,"suspicious_count":12,"malicious_count":6,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Hyldacrypt.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_80% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.DataKeeper (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005280ca1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Ransom.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fahqgp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/DataKeep-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.E2CB801D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.E2CB801D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Generic.Win32.10785","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00039194-00002780-0000010C-12244887151\n \"\" queries volume information of \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" at 00039194-00002780-0000010C-12709690167\n \"Icortroc.bin\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00040266-00004028-0000010C-32320091250\n \"Icortroc.bin\" queries volume information of \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" at 00040266-00004028-0000010C-32378461141","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A390000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69830000\n \"Icortroc.bin\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6E9D0000\n \"Icortroc.bin\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69190000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Icortroc.bin\" (UID: 00040266-00004028)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Icortroc.bin\" (UID: 00040266-00004028)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Icortroc.bin\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"!!! ##### _ ReadMe _ ##### !!!.htm\" has type \"HTML document ASCII text with very long lines with CRLF LF line terminators\"\n \"Exception.5\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"cD.TF\"\n Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://www.torproject.org/projects/torbrowser.html\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Icortroc.bin\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DataKeeper.exe.exe.bin\" was detected as \"Morphine v1.2 (DLL)\"\n \"Icortroc.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00039194-00002780-00000105-16256427933\n \"Icortroc.bin\" at 00040266-00004028-00000105-36052009678","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"Icortroc.bin\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"K#v'dm\n jO\"; with unusual entropies 7.99956484243\n 7.99953398728","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"C:\\UsersmscorlibCould not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vbox\")\n \"C:\\UsersmscorlibCould not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguest\")\n \"C:\\UsersmscorlibCould not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguestadditions\")\n \"Could not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vbox\")\n \"Could not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguest\")\n \"Could not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguestadditions\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Icortroc.bin\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"https://www.torproject.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%LOCALAPPDATA%\\Icortroc.bin\", Handle: 636)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Icortroc.bin\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Icortroc.bin\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/67 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"47/67 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"52/77 Antivirus vendors marked dropped file \"Icortroc.bin\" as malicious (classified as \"Gen:Variant.Razy\" with 67% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"52/77 Antivirus vendors marked spawned process \"Icortroc.bin\" (PID: 4028) as malicious (classified as \"Gen:Variant.Razy\" with 67% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%LOCALAPPDATA%\\Icortroc.bin\" (Handle: 636)\n \"\" wrote 52 bytes to a remote process \"%LOCALAPPDATA%\\Icortroc.bin\" (Handle: 636)\n \"\" wrote 4 bytes to a remote process \"%LOCALAPPDATA%\\Icortroc.bin\" (Handle: 636)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/28, 192.168.56.32/27, 192.168.56.64/26, 192.168.56.128/26, 192.168.56.192/27, 192.168.56.224/28, 192.168.56.240/29, 192.168.56.248/30, 192.168.56.252/31, 192.168.56.254/32\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["genasom","ransomware"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5be359fcbb53f006b423eab1","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Ransom_DATAKEEPER.SMALY","submit_name":"DataKeeper.exe.exe","analysis_start_time":"2018-11-07T15:32:48+00:00","indicators_count":{"informative":10,"suspicious":16,"malicious":7},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}],"processes":[{"pid":2780,"ppid":0,"name":"DataKeeper.exe.exe","command_line":"","sha256":"e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4","normalized_path":"C:\\DataKeeper.exe.exe","uid":"00039194-00002780","icon":"$28"},{"pid":4028,"ppid":2780,"name":"Icortroc.bin","command_line":"","sha256":"1b3e5fd1be40b84d34c16b526cfb0ddd93b69172e42d069010b0bd04c00683ef","normalized_path":"%LOCALAPPDATA%\\Icortroc.bin","parent_uid":"00039194-00002780","uid":"00040266-00004028"}],"all_imported_dlls":["dnsapi.dll","WMINet_Utils.dll","wbemcomn.dll","uxtheme.dll","lpk.dll","mscorlib.ni.dll","mscorrc.dll","profapi.dll","RpcRtRemote.dll","System.Management.ni.dll","clbcatq.dll","nsi.dll","wbemsvc.dll","diasymreader.dll","dhcpcsvc.dll","cryptbase.dll","psapi.dll","IPHLPAPI.DLL","clrjit.dll","System.Drawing.ni.dll","kernel32.dll","msvcr120_clr0400.dll","shell32.dll","System.Xml.ni.dll","System.Configuration.ni.dll","fastprox.dll","System.ni.dll","shlwapi.dll","user32.dll","cryptsp.dll","wmiutils.dll","netapi32.dll","usp10.dll","ntdll.dll","System.Core.ni.dll","rsaenh.dll","wship6.dll","sechost.dll","clr.dll","ntdsapi.dll","mscoree.dll","ole32.dll","rasadhlp.dll","wkscli.dll","cscapi.dll","advapi32.dll","rpcrt4.dll","mswsock.dll","apphelp.dll","netutils.dll","KernelBase.dll","rpcss.dll","ws2_32.dll","dhcpcsvc6.dll","srvcli.dll","mscorlib.dll","System.Windows.Forms.ni.dll","nlssorting.dll","winnsi.dll","FWPUCLNT.DLL","imm32.dll","System.Windows.Forms.dll","msvcrt.dll","oleaut32.dll","bcrypt.dll","WSHTCPIP.DLL","mscoreei.dll","gdi32.dll","msctf.dll","wbemprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Icortroc.bin","sha256":"1b3e5fd1be40b84d34c16b526cfb0ddd93b69172e42d069010b0bd04c00683ef","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"name":"!!! ##### _ ReadMe _ ##### !!!.htm","sha256":"8a47f7534ce211fc39b02fd35623d33384a15d0896a8791b889d1e352abcec73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"name":"Exception.5","sha256":"0f08703bb22412ef051a1aad5183393cbcbdacb5517065edce5150fe08e212ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]}],"files_written":[{"path":"C:\\DataKeeper.exe.exe.config","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"C:\\DataKeeper.exe.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\taskhost.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIADAP.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\winlogon.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\lsm.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\dwm.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\services.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\wbem\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%LOCALAPPDATA%\\Icortroc.bin.config","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%LOCALAPPDATA%\\Icortroc.bin","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5be359fcbb53f006b423eab1"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5be359fcbb53f006b423eab1"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample e25230c9df9c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e25230c9df9c…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample e25230c9df9c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e25230c9df9c…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e25230c9df9ce8ce9f117348827f3d6706c6bfc94c5445a40665b42cb19a42a4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample e25230c9df9c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e25230c9df9c…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]