26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample e4f7fa6a0846… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e4f7fa6a0846…. Malware family: Fragtor.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493"],"about":{"@type":"SoftwareApplication","name":"Kelihos_stage2_.exe","applicationCategory":["neexe","executable"],"identifier":"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6c4,".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "UNINSTALLSTRING"; Value: "0000000001000000AC00000043003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C004D006100630072006F006D00650064005C0046006C006100730068005C0046006C006100730068005500740069006C00330032005F00320034005F0030005F0030005F003200320031005F0050006C007500670069006E002E0065007800650020002D006D00610069006E007400610069006E00200070006C007500670069006E000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME"; Value: "000000000100000038000000410064006F0062006500200046006C00610073006800200050006C00610079006500720020003200340020004E0050004100500049000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "UNINSTALLSTRING"; Value: "00000000010000004E00000043003A005C00500072006F006700720061006D002000460069006C00650073005C004100750074006F004900740033005C0055006E0069006E007300740061006C006C002E006500780065000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME"; Value: "0000000001000000220000004100750074006F00490074002000760033002E0033002E00310032002E0030000000")28:T56f,"255.255.255.255" "127.0.0.1" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)" Heuristic match: "@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)" Heuristic match: "; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17"29:T43d,SetSecurityDescriptorDacl RegCloseKey RegDeleteValueA RegCreateKeyExA RegOpenKeyExA RegEnumKeyExA GetFileAttributesA LockResource GetDriveTypeA FindFirstFileW GetFileAttributesW MapViewOfFileEx UnhandledExceptionFilter OpenFileMappingA GetTempPathA WriteFile OutputDebugStringA DeviceIoControl WriteProcessMemory GetModuleFileNameW IsDebuggerPresent GetVersionExA GetModuleFileNameA CreateThread ExitThread TerminateProcess GetTickCount LoadLibraryA CreateRemoteThread GetStartupInfoA OpenProcess DeleteFileA ReadProcessMemory GetProcAddress GetFileSizeEx FindNextFileW CreateFileMappingA FindNextFileA CreateFileW CreateFileA SleepEx GetCommandLineW GetCommandLineA GetModuleHandleA FindFirstFileA GetModuleHandleW GetFileAttributesExW CreateProcessA Sleep VirtualAlloc GetWindowThreadProcessId HttpSendRequestA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA HttpQueryInfoA InternetCrackUrlA WSASocketA accept WSAStartup connect recv send WSASend listen closesocket socket bind recvfrom sendto2a:T9ae,".exe" wrote bytes "b8c015d86dffe0" to virtual address "0x74F811F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "92e6f57679a8fa76be72fa76d62dfa761de2f57605a2fa76bee3f576616ffa766841f8760050f87600000000ad3752758b2d5275b641527500000000" to virtual address "0x74601000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74F8139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74F812DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812f874" to virtual address "0x74F983DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4053f8765858f976186af976653cfa760000000000bf94750000000056cc9475000000007cca947500000000376832756a2cfa76d62dfa7600000000206932750000000029a6947500000000a48d327500000000f70e947500000000" to virtual address "0x77091000" (part of module "NSI.DLL") ".exe" wrote bytes "7739f67679a8fa76be72fa76d62dfa761de2f57605a2fa76c868f97657d10077bee3f576616ffa766841f8760050f87600000000ad3752758b2d5275b641527500000000" to virtual address "0x74AD1000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74F81408" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b84013d86dffe0" to virtual address "0x74F81248" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812f874" to virtual address "0x74F98348" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811f874" to virtual address "0x74F98368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x75521680" (part of module "WS2_32.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74F812CC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811f874" to virtual address "0x74F9834C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812f874" to virtual address "0x74F983C0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811f874" to virtual address "0x74F983E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b83012d86dffe0" to virtual address "0x75521368" (part of module "WS2_32.DLL") ".exe" wrote bytes "f811f874" to virtual address "0x74F983C4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812f874" to virtual address "0x74F98364" (part of module "SSPICLI.DLL")2b:T756,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040A") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040B") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040C") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040E") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040F") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000410") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000411") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000412") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000413") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000414")2c:T2c4d,Found malicious artifacts related to "188.190.26.56": ... URL: http://188.190.26.56/default.htm (AV positives: 2/66 scanned on 12/09/2018 05:41:13) URL: http://188.190.26.56/login.htm (AV positives: 1/66 scanned on 12/06/2018 10:22:38) URL: http://188.190.26.56/suba002.exe (AV positives: 3/67 scanned on 09/07/2018 10:35:31) URL: http://188.190.26.56/agre001.exe (AV positives: 2/67 scanned on 09/07/2018 10:18:59) URL: http://188.190.26.56/arisx06.exe (AV positives: 3/67 scanned on 09/06/2018 21:52:32) File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 2dcc564db17d34a93ccf5a6eb2a0f2f7564dfab348e3ba02bd42604ebf0afd30 (Date: 01/11/2018 16:51:02) File SHA256: 3c33eacead0c05556d3c2d807fb2d7db2462af0896dc1058a8eaf6202e1034df (Date: 04/30/2016 02:56:03) File SHA256: 71e785bd30933cffa206ecb5c533ff7a2e6a795caeb38431d2c47ca2bc4fa2ee (Date: 04/27/2016 07:10:46) File SHA256: 76e5b78a0e6a35ae07f6f0ac386373a71549128b64c6a32a8086b19845cb7322 (Date: 04/22/2016 16:04:32) File SHA256: c96dea0e9bf2d569d16e6e8b0d268d4d6beef40b2bb32c11564d203d94de9a7b (AV positives: 4/55 scanned on 11/18/2015 18:08:28) File SHA256: fc368ef5d1b41c434b6a83d53d17666427bdd3d7a042c84d58f263a40345a579 (AV positives: 3/54 scanned on 11/13/2015 17:51:35) File SHA256: 98b195bbd6ef57bb3043b1f31393b0f07eee3b2aec1981ec4b42a2afe27b8e5f (AV positives: 3/55 scanned on 11/13/2015 16:35:38) File SHA256: f9a7954050ba4b406db2d11097cd0289e4a02cffa62784020d49552ca244dc4c (AV positives: 6/55 scanned on 11/13/2015 14:56:42) Found malicious artifacts related to "119.202.72.57": ... URL: http://119.202.72.57/ (AV positives: 1/67 scanned on 07/21/2018 09:42:55) URL: http://119.202.72.57/tag1.php (AV positives: 1/65 scanned on 08/24/2017 06:02:11) URL: http://119.202.72.57/main.htm (AV positives: 2/65 scanned on 06/25/2017 16:13:49) URL: http://119.202.72.57/index.htm (AV positives: 2/64 scanned on 03/21/2017 13:40:56) URL: http://119.202.72.57/login.htm (AV positives: 2/64 scanned on 02/28/2017 08:43:01) File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: b16d0e2a4c92dba48afc2ec85002df0a83cc41e7108ec961b344af571051e21f (Date: 05/02/2016 18:36:36) File SHA256: aa15e334b93358fdc5276f577e4a8f1ab4fe116238f862d8792925f1fa4163e0 (Date: 04/26/2016 02:41:39) File SHA256: 3f727829d8d4d2eb1972a3239743afcab8652d1991621bf03e8ae4352657e934 (Date: 04/24/2016 22:30:03) File SHA256: fb594a42d31382876c985a7260907c66b5213349d270eff8ab55461f8e16db10 (Date: 04/23/2016 08:50:16) Found malicious artifacts related to "221.127.80.57": ... File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 2c9097d5e3a4eb534aa21ecce7e37a613c245130ac3a2a62e6ad2a95963f3cfb (Date: 02/16/2016 23:18:43) File SHA256: 29c3d2c55115a572834cf2963bb08124b51e10a45a3652d00e7cacf913034ed4 (Date: 01/28/2016 01:29:21) File SHA256: ba1fec801578b311257ba6ba9d69c50b909c9d3f0d4b92b4db5860d75ec3c277 (Date: 01/08/2016 08:28:32) File SHA256: 6f12aed816ad2e8f08922811b0ea856aebd521ca785aafcc3a4987fdc8964c45 (Date: 01/07/2016 16:17:35) Found malicious artifacts related to "105.227.164.57": ... File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 174ce13df39fe8f29ed051b4f4581ea0ef84c59083aa1d8a4d64b8357d7974e1 (Date: 04/15/2016 09:10:47) File SHA256: 2c9097d5e3a4eb534aa21ecce7e37a613c245130ac3a2a62e6ad2a95963f3cfb (Date: 02/16/2016 23:18:43) File SHA256: 29c3d2c55115a572834cf2963bb08124b51e10a45a3652d00e7cacf913034ed4 (Date: 01/28/2016 01:29:21) File SHA256: ba1fec801578b311257ba6ba9d69c50b909c9d3f0d4b92b4db5860d75ec3c277 (Date: 01/08/2016 08:28:32) Found malicious artifacts related to "46.164.189.57": ... File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 2c9097d5e3a4eb534aa21ecce7e37a613c245130ac3a2a62e6ad2a95963f3cfb (Date: 02/16/2016 23:18:43) File SHA256: 29c3d2c55115a572834cf2963bb08124b51e10a45a3652d00e7cacf913034ed4 (Date: 01/28/2016 01:29:21) File SHA256: ba1fec801578b311257ba6ba9d69c50b909c9d3f0d4b92b4db5860d75ec3c277 (Date: 01/08/2016 08:28:32) File SHA256: 6f12aed816ad2e8f08922811b0ea856aebd521ca785aafcc3a4987fdc8964c45 (Date: 01/07/2016 16:17:35) Found malicious artifacts related to "175.194.174.45": ... URL: http://175.194.174.45/loader/onprdfi.exe (AV positives: 1/66 scanned on 12/08/2015 07:59:33) URL: http://175.194.174.45/favicon.ico (AV positives: 1/66 scanned on 12/07/2015 17:13:00) URL: http://175.194.174.45/home.htm (AV positives: 3/66 scanned on 12/07/2015 16:43:43) URL: http://175.194.174.45/onprdfi.exe (AV positives: 3/66 scanned on 12/07/2015 15:38:40) URL: http://175.194.174.45/search.htm (AV positives: 1/66 scanned on 12/07/2015 13:21:31) File SHA256: 6b250dcd18e109e14a61551f829ff4aae7e492ff064b9b7945714a31f6d090a4 (Date: 05/02/2016 01:00:28) File SHA256: ab5bd1d4925e4980f20f10cd59cd77263cdb5a363aca93baac26aaf76ff3a2de (Date: 12/13/2015 16:12:45) File SHA256: ad51414bec865cec2330a681faa4df5f6af2cf93b002043176bdd612484cf827 (Date: 12/13/2015 05:30:56) File SHA256: 02b5342efa7a482f1c340747c23192f1d444dda1204d139c1c176818334e2caa (AV positives: 5/56 scanned on 12/06/2015 12:49:26) File SHA256: d6972b54c14822ee7528e4ea14dc3ed2b287636620039185ec516ca435b41ab6 (AV positives: 5/54 scanned on 12/06/2015 12:38:59) File SHA256: e4b7beb749dc141d82edaf33fecd7243ac74b6d325413ed573a8f756b56f9e6f (AV positives: 4/56 scanned on 12/06/2015 06:05:21) File SHA256: a97a88d815216d9038bf8c220bbe9bdede341c5d0eecba101f3bdd2c0457b2ff (AV positives: 5/55 scanned on 12/05/2015 17:28:10) File SHA256: 11795b8db24bf259c644c58d3200b2373fdb6cdf67add6d3285d3ca0ee1ff69c (AV positives: 7/56 scanned on 12/05/2015 13:02:16) File SHA256: 128ac7becda652c57374d8a5fbe70aee40e25b0d8cc47fc8378ac02c4a0d6a01 (Date: 12/03/2015 21:45:10) File SHA256: c8b1c52880a062fe35404f11fd216ec3f36a9e8196f1d733042c1d8edd640bf7 (Date: 12/03/2015 21:44:42) Found malicious artifacts related to "125.134.98.46": ... URL: http://125.134.98.46/onprdfi.exe (AV positives: 3/67 scanned on 09/09/2018 21:56:47) URL: http://125.134.98.46/onrsbqq.exe (AV positives: 1/67 scanned on 09/09/2018 17:55:51) URL: http://125.134.98.46/ (AV positives: 1/68 scanned on 08/21/2016 19:02:21) URL: http://125.134.98.46/loader/onprdfi.exe (AV positives: 2/66 scanned on 12/06/2015 05:40:50) URL: http://125.134.98.46/main.htm (AV positives: 2/66 scanned on 12/06/2015 03:42:18) File SHA256: 1a17a5e27c658004e3900653663f22969eaf852fa54d89488fbf3cfee29774d1 (AV positives: 1/56 scanned on 07/18/2017 11:32:14) File SHA256: 5b9ffae3b6e5dfb86356cf95b3d0a00ef7d36160b4db70c300ec3c314fe0dabd (Date: 04/29/2016 19:46:18) File SHA256: 7c59b99a2d13df61797df2f8d70df4fbb7de3d636ff7ef515e6624df390803bc (AV positives: 5/56 scanned on 12/06/2015 05:00:48) File SHA256: 4a36e5f534504c6490cda423c4d258ac52f4293862c3603e901b2825840f5cd5 (AV positives: 10/56 scanned on 12/05/2015 19:27:27) File SHA256: 7a87d4364bb980fba94537139adc8e9046c31e2d12488527ff76a781dc2fc126 (AV positives: 9/55 scanned on 12/05/2015 19:00:49) File SHA256: 300ab53830136993c1becd89a86dc7df61b78c06e1ae140d343c541985638d17 (AV positives: 6/55 scanned on 12/05/2015 09:59:05) File SHA256: 77c4cb57749af4d6af8d293337e8bcfcf0f35c9a08b6b8649c5ff2578b889567 (Date: 12/03/2015 17:21:22) Found malicious artifacts related to "46.150.254.47": ... URL: http://46.150.254.47/file.htm (AV positives: 5/66 scanned on 01/28/2019 05:40:17) URL: http://46.150.254.47/loader/vfkgitm.exe (AV positives: 7/66 scanned on 01/26/2019 06:02:35) URL: http://46.150.254.47/mgptfdo.exe (AV positives: 7/66 scanned on 01/24/2019 06:01:35) URL: http://46.150.254.47/vfkgitm.exe (AV positives: 7/66 scanned on 01/24/2019 05:54:07) URL: http://46.150.254.47/loader/pfrotha.exe (AV positives: 7/66 scanned on 01/24/2019 05:25:56) File SHA256: eb532831f1a8fb109302a596a700165ffcd3bdcd08ecc71d0fc3ade83243211e (AV positives: 58/71 scanned on 01/06/2019 19:10:57) File SHA256: bdb698f96443fd26ec095324c1eea742b62a206a748449227f832e77084475eb (Date: 10/25/2017 19:45:46) File SHA256: f98fe8ac62a96e64c9e86d6d795f4adfe261220362ab5f34f82c8e0d43ee68d8 (Date: 02/22/2017 04:22:22) File SHA256: 7e2b291af94d6bf0f4b93c35794344a777a994cdacba7dbf51988e421f3c1963 (Date: 07/21/2016 08:58:24) File SHA256: 962e85a0f1d0e2a3f36315446f8a3c09c3787c379f03f38f424f6c6323ba8f47 (Date: 06/08/2016 18:05:21) File SHA256: 3b48632705b8226fcb07362096dfc39d1328f7e2805569a554bee8b218857d68 (AV positives: 8/56 scanned on 05/26/2016 21:21:50) File SHA256: 81fed725db9fc1ff0a31af99229f6cbf346845a50b0b50341fc8768bfec4015d (Date: 05/05/2016 04:33:29) File SHA256: f95ac934e0182f3626f6a688386b3e87b8dac6e90473ec04f6143f8c79671b77 (AV positives: 2/56 scanned on 02/24/2016 17:30:05) File SHA256: b81ca83c933bf45bfc06fa15dba521f97fb1639d0c868cc515dee1539a4d072a (AV positives: 1/52 scanned on 01/04/2016 21:37:59) File SHA256: 45b8b2232dad0dbead226f0b880b6acb8533ef2f125d9d94ee8c2e26900a1f35 (AV positives: 9/52 scanned on 01/04/2016 20:53:07) Found malicious artifacts related to "220.22.48.45": ... URL: http://220.22.48.45/onrsbqq.exe (AV positives: 1/67 scanned on 09/09/2018 07:50:58) URL: http://220.22.48.45/onprdfi.exe (AV positives: 2/67 scanned on 09/09/2018 06:26:21) URL: http://220.22.48.45/page_reach.php (AV positives: 2/66 scanned on 12/06/2015 18:35:47) URL: http://220.22.48.45/page_umax.php (AV positives: 2/66 scanned on 12/06/2015 17:35:13) URL: http://220.22.48.45/main.htm (AV positives: 2/66 scanned on 12/06/2015 16:56:24) File SHA256: 24b318f10ede49fdbac4f0ebff0ba494af91d30c070e59278d17597fbf27470b (Date: 04/29/2016 12:08:23) File SHA256: fa8147b4de0bebf7198422e0f7e02eff3de89574492ff196f85b3795ee51080f (Date: 04/21/2016 01:07:10) File SHA256: 1adc77897b04885b611fd8e3d8d388754cb3d5293840c412ea187782e04cc1d7 (Date: 12/16/2015 16:55:21) File SHA256: 3fa82813df75a4d9380327ac33fc091d09e7877f7c55287766ba06a10a302962 (AV positives: 6/54 scanned on 12/06/2015 16:02:00) File SHA256: 79aa4b8895f69cde192567aca3667471982d1abd1ecb14028b296800a24b07b9 (AV positives: 7/56 scanned on 12/06/2015 15:46:50) File SHA256: 38ac461d6bee4d93f4c56e5b2ff0144e0e30e0c2cf83141ddae76930f9855252 (AV positives: 8/56 scanned on 12/05/2015 17:59:48) File SHA256: 11b2c7d3ac70df46e7f6458af2cada3358d577529540983c7b50993fb8b75935 (AV positives: 5/56 scanned on 12/05/2015 13:57:47) File SHA256: 5978c1ffd19fd53656b4e884ffa3a243653ba3c14104971d90fb0ed850bd4f62 (AV positives: 4/56 scanned on 12/03/2015 19:55:27)2d:T2c4d,Found malicious artifacts related to "188.190.26.56": ... URL: http://188.190.26.56/default.htm (AV positives: 2/66 scanned on 12/09/2018 05:41:13) URL: http://188.190.26.56/login.htm (AV positives: 1/66 scanned on 12/06/2018 10:22:38) URL: http://188.190.26.56/suba002.exe (AV positives: 3/67 scanned on 09/07/2018 10:35:31) URL: http://188.190.26.56/agre001.exe (AV positives: 2/67 scanned on 09/07/2018 10:18:59) URL: http://188.190.26.56/arisx06.exe (AV positives: 3/67 scanned on 09/06/2018 21:52:32) File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 2dcc564db17d34a93ccf5a6eb2a0f2f7564dfab348e3ba02bd42604ebf0afd30 (Date: 01/11/2018 16:51:02) File SHA256: 3c33eacead0c05556d3c2d807fb2d7db2462af0896dc1058a8eaf6202e1034df (Date: 04/30/2016 02:56:03) File SHA256: 71e785bd30933cffa206ecb5c533ff7a2e6a795caeb38431d2c47ca2bc4fa2ee (Date: 04/27/2016 07:10:46) File SHA256: 76e5b78a0e6a35ae07f6f0ac386373a71549128b64c6a32a8086b19845cb7322 (Date: 04/22/2016 16:04:32) File SHA256: c96dea0e9bf2d569d16e6e8b0d268d4d6beef40b2bb32c11564d203d94de9a7b (AV positives: 4/55 scanned on 11/18/2015 18:08:28) File SHA256: fc368ef5d1b41c434b6a83d53d17666427bdd3d7a042c84d58f263a40345a579 (AV positives: 3/54 scanned on 11/13/2015 17:51:35) File SHA256: 98b195bbd6ef57bb3043b1f31393b0f07eee3b2aec1981ec4b42a2afe27b8e5f (AV positives: 3/55 scanned on 11/13/2015 16:35:38) File SHA256: f9a7954050ba4b406db2d11097cd0289e4a02cffa62784020d49552ca244dc4c (AV positives: 6/55 scanned on 11/13/2015 14:56:42) Found malicious artifacts related to "119.202.72.57": ... URL: http://119.202.72.57/ (AV positives: 1/67 scanned on 07/21/2018 09:42:55) URL: http://119.202.72.57/tag1.php (AV positives: 1/65 scanned on 08/24/2017 06:02:11) URL: http://119.202.72.57/main.htm (AV positives: 2/65 scanned on 06/25/2017 16:13:49) URL: http://119.202.72.57/index.htm (AV positives: 2/64 scanned on 03/21/2017 13:40:56) URL: http://119.202.72.57/login.htm (AV positives: 2/64 scanned on 02/28/2017 08:43:01) File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: b16d0e2a4c92dba48afc2ec85002df0a83cc41e7108ec961b344af571051e21f (Date: 05/02/2016 18:36:36) File SHA256: aa15e334b93358fdc5276f577e4a8f1ab4fe116238f862d8792925f1fa4163e0 (Date: 04/26/2016 02:41:39) File SHA256: 3f727829d8d4d2eb1972a3239743afcab8652d1991621bf03e8ae4352657e934 (Date: 04/24/2016 22:30:03) File SHA256: fb594a42d31382876c985a7260907c66b5213349d270eff8ab55461f8e16db10 (Date: 04/23/2016 08:50:16) Found malicious artifacts related to "221.127.80.57": ... File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 2c9097d5e3a4eb534aa21ecce7e37a613c245130ac3a2a62e6ad2a95963f3cfb (Date: 02/16/2016 23:18:43) File SHA256: 29c3d2c55115a572834cf2963bb08124b51e10a45a3652d00e7cacf913034ed4 (Date: 01/28/2016 01:29:21) File SHA256: ba1fec801578b311257ba6ba9d69c50b909c9d3f0d4b92b4db5860d75ec3c277 (Date: 01/08/2016 08:28:32) File SHA256: 6f12aed816ad2e8f08922811b0ea856aebd521ca785aafcc3a4987fdc8964c45 (Date: 01/07/2016 16:17:35) Found malicious artifacts related to "105.227.164.57": ... File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 174ce13df39fe8f29ed051b4f4581ea0ef84c59083aa1d8a4d64b8357d7974e1 (Date: 04/15/2016 09:10:47) File SHA256: 2c9097d5e3a4eb534aa21ecce7e37a613c245130ac3a2a62e6ad2a95963f3cfb (Date: 02/16/2016 23:18:43) File SHA256: 29c3d2c55115a572834cf2963bb08124b51e10a45a3652d00e7cacf913034ed4 (Date: 01/28/2016 01:29:21) File SHA256: ba1fec801578b311257ba6ba9d69c50b909c9d3f0d4b92b4db5860d75ec3c277 (Date: 01/08/2016 08:28:32) Found malicious artifacts related to "46.164.189.57": ... File SHA256: a314fb77ad46679445c24ed4bbe4c3fbfe7f78a43346fa8e36c7cee34277eaa0 (AV positives: 55/71 scanned on 09/27/2018 14:42:21) File SHA256: 8ce8a101943203132327f6d9121324bacfc8d90a1b3d814e94086aa4082f9a29 (Date: 01/11/2018 20:12:50) File SHA256: 2c9097d5e3a4eb534aa21ecce7e37a613c245130ac3a2a62e6ad2a95963f3cfb (Date: 02/16/2016 23:18:43) File SHA256: 29c3d2c55115a572834cf2963bb08124b51e10a45a3652d00e7cacf913034ed4 (Date: 01/28/2016 01:29:21) File SHA256: ba1fec801578b311257ba6ba9d69c50b909c9d3f0d4b92b4db5860d75ec3c277 (Date: 01/08/2016 08:28:32) File SHA256: 6f12aed816ad2e8f08922811b0ea856aebd521ca785aafcc3a4987fdc8964c45 (Date: 01/07/2016 16:17:35) Found malicious artifacts related to "175.194.174.45": ... URL: http://175.194.174.45/loader/onprdfi.exe (AV positives: 1/66 scanned on 12/08/2015 07:59:33) URL: http://175.194.174.45/favicon.ico (AV positives: 1/66 scanned on 12/07/2015 17:13:00) URL: http://175.194.174.45/home.htm (AV positives: 3/66 scanned on 12/07/2015 16:43:43) URL: http://175.194.174.45/onprdfi.exe (AV positives: 3/66 scanned on 12/07/2015 15:38:40) URL: http://175.194.174.45/search.htm (AV positives: 1/66 scanned on 12/07/2015 13:21:31) File SHA256: 6b250dcd18e109e14a61551f829ff4aae7e492ff064b9b7945714a31f6d090a4 (Date: 05/02/2016 01:00:28) File SHA256: ab5bd1d4925e4980f20f10cd59cd77263cdb5a363aca93baac26aaf76ff3a2de (Date: 12/13/2015 16:12:45) File SHA256: ad51414bec865cec2330a681faa4df5f6af2cf93b002043176bdd612484cf827 (Date: 12/13/2015 05:30:56) File SHA256: 02b5342efa7a482f1c340747c23192f1d444dda1204d139c1c176818334e2caa (AV positives: 5/56 scanned on 12/06/2015 12:49:26) File SHA256: d6972b54c14822ee7528e4ea14dc3ed2b287636620039185ec516ca435b41ab6 (AV positives: 5/54 scanned on 12/06/2015 12:38:59) File SHA256: e4b7beb749dc141d82edaf33fecd7243ac74b6d325413ed573a8f756b56f9e6f (AV positives: 4/56 scanned on 12/06/2015 06:05:21) File SHA256: a97a88d815216d9038bf8c220bbe9bdede341c5d0eecba101f3bdd2c0457b2ff (AV positives: 5/55 scanned on 12/05/2015 17:28:10) File SHA256: 11795b8db24bf259c644c58d3200b2373fdb6cdf67add6d3285d3ca0ee1ff69c (AV positives: 7/56 scanned on 12/05/2015 13:02:16) File SHA256: 128ac7becda652c57374d8a5fbe70aee40e25b0d8cc47fc8378ac02c4a0d6a01 (Date: 12/03/2015 21:45:10) File SHA256: c8b1c52880a062fe35404f11fd216ec3f36a9e8196f1d733042c1d8edd640bf7 (Date: 12/03/2015 21:44:42) Found malicious artifacts related to "125.134.98.46": ... URL: http://125.134.98.46/onprdfi.exe (AV positives: 3/67 scanned on 09/09/2018 21:56:47) URL: http://125.134.98.46/onrsbqq.exe (AV positives: 1/67 scanned on 09/09/2018 17:55:51) URL: http://125.134.98.46/ (AV positives: 1/68 scanned on 08/21/2016 19:02:21) URL: http://125.134.98.46/loader/onprdfi.exe (AV positives: 2/66 scanned on 12/06/2015 05:40:50) URL: http://125.134.98.46/main.htm (AV positives: 2/66 scanned on 12/06/2015 03:42:18) File SHA256: 1a17a5e27c658004e3900653663f22969eaf852fa54d89488fbf3cfee29774d1 (AV positives: 1/56 scanned on 07/18/2017 11:32:14) File SHA256: 5b9ffae3b6e5dfb86356cf95b3d0a00ef7d36160b4db70c300ec3c314fe0dabd (Date: 04/29/2016 19:46:18) File SHA256: 7c59b99a2d13df61797df2f8d70df4fbb7de3d636ff7ef515e6624df390803bc (AV positives: 5/56 scanned on 12/06/2015 05:00:48) File SHA256: 4a36e5f534504c6490cda423c4d258ac52f4293862c3603e901b2825840f5cd5 (AV positives: 10/56 scanned on 12/05/2015 19:27:27) File SHA256: 7a87d4364bb980fba94537139adc8e9046c31e2d12488527ff76a781dc2fc126 (AV positives: 9/55 scanned on 12/05/2015 19:00:49) File SHA256: 300ab53830136993c1becd89a86dc7df61b78c06e1ae140d343c541985638d17 (AV positives: 6/55 scanned on 12/05/2015 09:59:05) File SHA256: 77c4cb57749af4d6af8d293337e8bcfcf0f35c9a08b6b8649c5ff2578b889567 (Date: 12/03/2015 17:21:22) Found malicious artifacts related to "46.150.254.47": ... URL: http://46.150.254.47/file.htm (AV positives: 5/66 scanned on 01/28/2019 05:40:17) URL: http://46.150.254.47/loader/vfkgitm.exe (AV positives: 7/66 scanned on 01/26/2019 06:02:35) URL: http://46.150.254.47/mgptfdo.exe (AV positives: 7/66 scanned on 01/24/2019 06:01:35) URL: http://46.150.254.47/vfkgitm.exe (AV positives: 7/66 scanned on 01/24/2019 05:54:07) URL: http://46.150.254.47/loader/pfrotha.exe (AV positives: 7/66 scanned on 01/24/2019 05:25:56) File SHA256: eb532831f1a8fb109302a596a700165ffcd3bdcd08ecc71d0fc3ade83243211e (AV positives: 58/71 scanned on 01/06/2019 19:10:57) File SHA256: bdb698f96443fd26ec095324c1eea742b62a206a748449227f832e77084475eb (Date: 10/25/2017 19:45:46) File SHA256: f98fe8ac62a96e64c9e86d6d795f4adfe261220362ab5f34f82c8e0d43ee68d8 (Date: 02/22/2017 04:22:22) File SHA256: 7e2b291af94d6bf0f4b93c35794344a777a994cdacba7dbf51988e421f3c1963 (Date: 07/21/2016 08:58:24) File SHA256: 962e85a0f1d0e2a3f36315446f8a3c09c3787c379f03f38f424f6c6323ba8f47 (Date: 06/08/2016 18:05:21) File SHA256: 3b48632705b8226fcb07362096dfc39d1328f7e2805569a554bee8b218857d68 (AV positives: 8/56 scanned on 05/26/2016 21:21:50) File SHA256: 81fed725db9fc1ff0a31af99229f6cbf346845a50b0b50341fc8768bfec4015d (Date: 05/05/2016 04:33:29) File SHA256: f95ac934e0182f3626f6a688386b3e87b8dac6e90473ec04f6143f8c79671b77 (AV positives: 2/56 scanned on 02/24/2016 17:30:05) File SHA256: b81ca83c933bf45bfc06fa15dba521f97fb1639d0c868cc515dee1539a4d072a (AV positives: 1/52 scanned on 01/04/2016 21:37:59) File SHA256: 45b8b2232dad0dbead226f0b880b6acb8533ef2f125d9d94ee8c2e26900a1f35 (AV positives: 9/52 scanned on 01/04/2016 20:53:07) Found malicious artifacts related to "220.22.48.45": ... URL: http://220.22.48.45/onrsbqq.exe (AV positives: 1/67 scanned on 09/09/2018 07:50:58) URL: http://220.22.48.45/onprdfi.exe (AV positives: 2/67 scanned on 09/09/2018 06:26:21) URL: http://220.22.48.45/page_reach.php (AV positives: 2/66 scanned on 12/06/2015 18:35:47) URL: http://220.22.48.45/page_umax.php (AV positives: 2/66 scanned on 12/06/2015 17:35:13) URL: http://220.22.48.45/main.htm (AV positives: 2/66 scanned on 12/06/2015 16:56:24) File SHA256: 24b318f10ede49fdbac4f0ebff0ba494af91d30c070e59278d17597fbf27470b (Date: 04/29/2016 12:08:23) File SHA256: fa8147b4de0bebf7198422e0f7e02eff3de89574492ff196f85b3795ee51080f (Date: 04/21/2016 01:07:10) File SHA256: 1adc77897b04885b611fd8e3d8d388754cb3d5293840c412ea187782e04cc1d7 (Date: 12/16/2015 16:55:21) File SHA256: 3fa82813df75a4d9380327ac33fc091d09e7877f7c55287766ba06a10a302962 (AV positives: 6/54 scanned on 12/06/2015 16:02:00) File SHA256: 79aa4b8895f69cde192567aca3667471982d1abd1ecb14028b296800a24b07b9 (AV positives: 7/56 scanned on 12/06/2015 15:46:50) File SHA256: 38ac461d6bee4d93f4c56e5b2ff0144e0e30e0c2cf83141ddae76930f9855252 (AV positives: 8/56 scanned on 12/05/2015 17:59:48) File SHA256: 11b2c7d3ac70df46e7f6458af2cada3358d577529540983c7b50993fb8b75935 (AV positives: 5/56 scanned on 12/05/2015 13:57:47) File SHA256: 5978c1ffd19fd53656b4e884ffa3a243653ba3c14104971d90fb0ed850bd4f62 (AV positives: 4/56 scanned on 12/03/2015 19:55:27)2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790528050549,"unified_at":"2026-09-27T16:54:10.549Z","metadata":{"hashes":{"sha256":"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493","sha1":"e1f7cf8becf38ac1d3bfd8f744df370c5b988fc3","md5":"990e5daa285f5c9c6398811edc68a659","sha512":"8c2b51df9b2e1195a7890e3e47b55c038c16de3741c60de3b9dc992b516805b0c5e591ed7f0755e6b6aa7c883f98b790fe82823a81445d73465aa71760120e31","ssdeep":"49152:H94KQa01wFpYiAzYWXzmQRnsYCIHo0TElDTVn0MQdEL:d4KQ11w7iYJinVCMUnuPI","ssdeep_chunks":["49152:H94KQa0","49152:94KQa01","49152:4KQa01w","49152:KQa01wF","49152:Qa01wFp","49152:a01wFpY","49152:01wFpYi","49152:1wFpYiA","49152:wFpYiAz","49152:FpYiAzY","49152:pYiAzYW","49152:YiAzYWX","49152:iAzYWXz","49152:AzYWXzm","49152:zYWXzmQ","49152:YWXzmQR","49152:WXzmQRn","49152:XzmQRns","49152:zmQRnsY","49152:mQRnsYC","49152:QRnsYCI","49152:RnsYCIH","49152:nsYCIHo","49152:sYCIHo0","49152:YCIHo0T","49152:CIHo0TE","49152:IHo0TEl","49152:Ho0TElD","49152:o0TElDT","49152:0TElDTV","49152:TElDTVn","49152:ElDTVn0","49152:lDTVn0M","49152:DTVn0MQ","49152:TVn0MQd","49152:Vn0MQdE","49152:n0MQdEL","98304:H94KQa0","98304:94KQa01","98304:4KQa01w","98304:KQa01wF","98304:Qa01wFp","98304:a01wFpY","98304:01wFpYi","98304:1wFpYiA","98304:wFpYiAz","98304:FpYiAzY","98304:pYiAzYW","98304:YiAzYWX","98304:iAzYWXz","98304:AzYWXzm","98304:zYWXzmQ","98304:YWXzmQR","98304:WXzmQRn","98304:XzmQRns","98304:zmQRnsY","98304:mQRnsYC","98304:QRnsYCI","98304:RnsYCIH","98304:nsYCIHo","98304:sYCIHo0","98304:YCIHo0T","98304:CIHo0TE","98304:IHo0TEl","98304:Ho0TElD","98304:o0TElDT","98304:0TElDTV","98304:TElDTVn","98304:ElDTVn0","98304:lDTVn0M","98304:DTVn0MQ","98304:TVn0MQd","98304:Vn0MQdE","98304:n0MQdEL","49152:d4KQ11w","49152:4KQ11w7","49152:KQ11w7i","49152:Q11w7iY","49152:11w7iYJ","49152:1w7iYJi","49152:w7iYJin","49152:7iYJinV","49152:iYJinVC","49152:YJinVCM","49152:JinVCMU","49152:inVCMUn","49152:nVCMUnu","49152:VCMUnuP","49152:CMUnuPI"],"imphash":"67a040777ce29d8786cb26366f203afb"},"file_info":{"file_name":"Kelihos_stage2_.exe","file_type":["neexe","executable"],"file_type_id":"dos","file_size":2375004,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499291164000,"last_seen":1677216645000,"last_multi_scan":1677216645000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["botnet","fitmu","kelihos"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":15,"suspicious_count":18,"malicious_count":9,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Hlux","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Patched.Ren.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.113281","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Fareit-9956814-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Packed.Win32.MUPX.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.113281 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kelihos.G trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Kelihos.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0057265c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Hlux.crv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Hlux.ehqiiq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Slym.ULX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.Hlux","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.OutBrowse.Win32.79400","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Fragtor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Credential Access","technique":"Credentials in Files","attack_id":"T1081","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1081","identifiers":[{"type":"malicious","value":"Tries to steal FTP credentials"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00027885-00002084-42785-16-00503461\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00027885-00002084-42785-17-00501AD4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00027885-00002084-42785-243-004D9F64","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00027885-00002084-42785-109-00506877\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00027885-00002084-42785-129-00421274\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00027885-00002084-42785-983-00451922\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00027885-00002084-42785-1207-00515977","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00027885-00002084-42785-334-005075F6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00027885-00002084-42785-768-00414354","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.DLL at 00027885-00002084-42785-750-00512060\n EnumSystemLocalesA@KERNEL32.DLL at 00027885-00002084-42785-752-00511FF9\n EnumSystemLocalesA@KERNEL32.DLL at 00027885-00002084-42785-749-0051209C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 00507812h\" at 00027885-00002084-42785-334-005075F6","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00027885-00002084-42785-111-004DC2A0\n GetProcessHeap@KERNEL32.DLL at 00027885-00002084-42785-156-0045708C\n GetProcessHeap@KERNEL32.DLL at 00027885-00002084-42785-444-0051F4A0\n GetProcessHeap@KERNEL32.DLL at 00027885-00002084-42785-663-004570E3","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.190.26.56:80\"\n \"119.202.72.57:80\"\n \"221.127.80.57:80\"\n \"105.227.164.57:80\"\n \"46.164.189.57:80\"\n \"175.194.174.45:80\"\n \"125.134.98.46:80\"\n \"108.162.116.46:80\"\n \"95.85.145.47:80\"\n \"46.150.254.47:80\"\n \"220.22.48.45:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"e:\\releases\\winpcap_4_1_0_1753\\winpcap\\packetntx\\driver\\bin\\i386\\npf.pdb\"\n \"e:\\releases\\winpcap_4_1_0_1753\\winpcap\\wpcap\\PRJ\\Release\\x86\\wpcap.pdb\"\n \"e:\\releases\\winpcap_4_1_0_1753\\winpcap\\packetNtx\\Dll\\Project\\Release\\x86\\Packet.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\")\n \".exe\" touched \"UsersFiles\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\")\n \".exe\" touched \"Recycle Bin\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\")\n \".exe\" touched \"Computers and Devices\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\drivers\\npf.sys\"\n \".exe\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\en-US\\tzres.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ocsp.verisign.com0\"\n Pattern match: \"http://crl.verisign.com/tss-ca.crl0\"\n Pattern match: \"crl.verisign.com/ThawteTimestampingCA.crl0\"\n Pattern match: \"https://www.verisign.com/rpa\"\n Pattern match: \"https://www.verisign.com/rpa01\"\n Pattern match: \"http://crl.verisign.com/pca3.crl0\"\n Pattern match: \"http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D\"\n Pattern match: \"https://www.verisign.com/rpa0\"\n Pattern match: \"CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0\"\n Heuristic match: \"goloduha.info\"\n Heuristic match: \".in-addr.arpa\"\n Heuristic match: \"xxx.xiles.net\"\n Heuristic match: \"TurboFTP@usa.net\"\n Heuristic match: \"your.name@your.server.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00027885-00002084-00000105-24098833965","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"qhwlsxw with unusual entropies 7.85526097833","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00027885-00002084-42785-1192-0050B7FA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini\"\n \".exe\" read file \"C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini\"\n \".exe\" read file \"C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\eula.ini\"\n \".exe\" read file \"C:\\Program Files\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\eula.ini\"\n \".exe\" read file \"%APPDATA%\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NETWORKUPDATER\"; Value: \"C:\\e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$28","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 188.190.26.56 on port 80 is sent without HTTP header\n TCP traffic to 119.202.72.57 on port 80 is sent without HTTP header\n TCP traffic to 221.127.80.57 on port 80 is sent without HTTP header\n TCP traffic to 105.227.164.57 on port 80 is sent without HTTP header\n TCP traffic to 46.164.189.57 on port 80 is sent without HTTP header\n TCP traffic to 175.194.174.45 on port 80 is sent without HTTP header\n TCP traffic to 125.134.98.46 on port 80 is sent without HTTP header\n TCP traffic to 108.162.116.46 on port 80 is sent without HTTP header\n TCP traffic to 95.85.145.47 on port 80 is sent without HTTP header\n TCP traffic to 46.150.254.47 on port 80 is sent without HTTP header\n TCP traffic to 220.22.48.45 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe\" marked \"C:\\tmp.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\tmp.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.bin\" claimed CRC 1207419125 while the actual is CRC 2380632","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.bin\" has an entrypoint in section \"tuybrgg\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$29","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.bin\" claims program is from Mon Jun 1 06:15:35 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.bin\" (Offset: 1920552)\n Found VM detection artifact \"VMware trick\" in \"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.bin\" (Offset: 342610)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET TROJAN Win32/Kelihos.F Checkin\" (SID: 2021947, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/68 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/68 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 11 (or more) hosts in at least 8 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials","description":"\"Software\\FlashPeak\\BlazeFtp\\Settings\" (Indicator: \"\\blazeftp\\\")\n \"RushSite.xml\" (Indicator: \"rushsite.xml\")","origin":"File/Memory","mitre_attack_id":"T1081","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"ntoskrnl.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Reads terminal service related keys (often RDP related)"},{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal FTP credentials"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":45,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":115,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["botnet","fitmu","kelihos"],"sample_flags":["Network Traffic","TOR analysis"],"sandbox_reports":[{"id":"58071615aac2ede606739add","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor.Elzob","contacted_countries":["CAN","HKG","JPN","KOR","RUS","SRB","UKR","ZAF"],"submit_name":"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe","analysis_start_time":"2019-02-03T08:06:51+00:00","indicators_count":{"informative":15,"suspicious":26,"malicious":10},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true},{"id":"566250470e316d56254e943a","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":94,"contacted_countries":["ARE","ARG","AUS","AUT","AZE","BEL","BGR","BIH","BRA","CAN","CHE","CHL","CHN","COL","CUB","CZE","DEU","DNK","DOM","ECU","ESP","EU","FIN","FRA","GBR","GEO","GTM","HKG","HUN","IDN","IND","IRL","IRN","ISR","ITA","JOR","JPN","KOR","LAO","LTU","LUX","LVA","MAC","MAR","MEX","MKD","MWI","MYS","NCL","NIC","NLD","NOR","NZL","PER","PHL","POL","PRI","PRT","ROU","RUS","SAU","SGP","SVK","SVN","SWE","THA","TUN","TUR","TWN","UKR","URY","USA","VEN","VGB","ZAF","ZZZ"],"submit_name":"Kelihos_stage2_.exe","analysis_start_time":"2015-12-04T20:47:53+00:00","indicators_count":{"informative":6,"suspicious":17,"malicious":6},"tags":["Network Traffic","Extracted Files","Carved Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.190.26.56","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"119.202.72.57","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"221.127.80.57","port":80,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"105.227.164.57","port":80,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"46.164.189.57","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"175.194.174.45","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"125.134.98.46","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"108.162.116.46","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"95.85.145.47","port":80,"protocol":"TCP","country":"Serbia","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"46.150.254.47","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"address":"220.22.48.45","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}],"processes":[{"pid":2084,"ppid":0,"name":"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe","command_line":"","sha256":"e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493","normalized_path":"C:\\e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe","uid":"00027885-00002084","icon":"$2e"}],"all_imported_dlls":["usp10.dll","cryptsp.dll","WSHTCPIP.DLL","kernel32.dll","ws2_32.dll","gdi32.dll","lpk.dll","shell32.dll","msvcr100.dll","dhcpcsvc6.dll","advapi32.dll","msvcrt.dll","nsi.dll","user32.dll","crypt32.dll","rsaenh.dll","profapi.dll","msi.dll","rpcrt4.dll","shlwapi.dll","msasn1.dll","imm32.dll","sspicli.dll","dhcpcsvc.dll","wpcap.dll","pstorec.dll","dnsapi.dll","oleaut32.dll","psapi.dll","wininet.dll","urlmon.dll","wship6.dll","KernelBase.dll","sechost.dll","msctf.dll","cryptbase.dll","winnsi.dll","mswsock.dll","ole32.dll","tzres.dll","atl.dll","ntdll.dll","iertutil.dll","version.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\dev\\urandom","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%WINDIR%\\System32\\drivers\\npf.sys","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\autoexec.bat","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\config.sys","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{E28D896F-9EA8-433A-9C10-66C97C19A921}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{DCB14C61-690D-46F7-8A89-150432FA5C44}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{483C9FF8-503D-414B-B402-E4C1F1F568CB}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{C0DE3E38-8BA7-479F-8B75-833F294C5AA8}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{DB2B4279-B5CF-4626-9DBA-32D0ECE44C87}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_NdisWanIpv6","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_NdisWanBh","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_NdisWanIp","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{E2F8A220-AF88-446C-9A55-453E58DD3A33}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"Global\\NPF_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"c:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Liesmich.htm","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\cef.pak","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\Users\\All Users","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\Users\\Default","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\Users\\Default User","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"C:\\Users\\tZf6uj2","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Adobe.Reader.Dependencies.manifest","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\eula.ini","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\license.html","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\eula.ini","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\license.html","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\accessibility.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Acroform.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Annots.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Checkers.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\DVA.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\eBook.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Escript.deu","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\IA32.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Multimedia.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\pddom.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\RdLang32.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\reflow.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Search.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\SendMail.deu","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXEchoSign.asfx","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Files.asfx","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Spelling.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\updater.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Weblink.DEU","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Accessibility.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Checkers.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\DigSig.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\DVA.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\eBook.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"58071615aac2ede606739add"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58071615aac2ede606739add","566250470e316d56254e943a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Fragtor.Generic Sample e4f7fa6a0846… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e4f7fa6a0846…. Malware family: Fragtor.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493"}],["$","meta","4",{"property":"og:title","content":"Malicious Fragtor.Generic Sample e4f7fa6a0846… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e4f7fa6a0846…. Malware family: Fragtor.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Fragtor.Generic Sample e4f7fa6a0846… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e4f7fa6a0846…. Malware family: Fragtor.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]