26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Razy.Generic Sample e8c6741d3d21… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e8c6741d3d21…. Malware family: Razy.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16","keywords":["Malicious","Razy.Generic","malware analysis","sandbox report","threat intelligence","e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16"],"about":{"@type":"SoftwareApplication","name":"cerber_payload.exe","applicationCategory":["peexe","executable"],"identifier":"e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Razy.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T432,GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-98-013A8C07 GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-197-013A10CA GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-145-013A9337 GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-65-013A67F0 GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-178-013AAA68 GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-157-013A7D10 GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-180-013AE0F7 GetVersionExW@KERNEL32.DLL at 00144984-00002740-6845-179-013ADF9A GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-65-013A67F0 GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-145-013A9337 GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-179-013ADF9A GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-180-013AE0F7 GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-197-013A10CA GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-157-013A7D10 GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-98-013A8C07 GetVersionExW@KERNEL32.DLL at 00144984-00002740-13823-178-013AAA6828:Tc46,Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-6845-98-013A8C07") which is directly followed by "cmp dword ptr [ebp-00000114h], 06h" and "jne 013A8D14h". See related instructions: "... +156 call dword ptr [013B5130h] ;GetVersionExW +162 cmp dword ptr [ebp-00000114h], 06h +169 jne 013A8D14h" ... at 00144984-00002740-6845-98-013A8C07 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-6845-65-013A67F0") which is directly followed by "cmp dword ptr [ebp-0000017Ch], 06h" and "jc 013A6905h". See related instructions: "... +153 call dword ptr [013B5130h] ;GetVersionExW +159 cmp dword ptr [ebp-0000017Ch], 06h +166 jc 013A6905h" ... at 00144984-00002740-6845-65-013A67F0 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-6845-178-013AAA68") which is directly followed by "cmp dword ptr [ebp-00000110h], 06h" and "jc 013AAAB9h". See related instructions: "... +50 call dword ptr [013B5130h] ;GetVersionExW +56 cmp dword ptr [ebp-00000110h], 06h +63 jc 013AAAB9h" ... at 00144984-00002740-6845-178-013AAA68 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-6845-180-013AE0F7") which is directly followed by "cmp dword ptr [ebp-0000011Ch], 05h" and "jnbe 013AE13Fh". See related instructions: "... +50 call dword ptr [013B5130h] ;GetVersionExW +56 cmp dword ptr [ebp-0000011Ch], 05h +63 jnbe 013AE13Fh" ... at 00144984-00002740-6845-180-013AE0F7 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-13823-65-013A67F0") which is directly followed by "cmp dword ptr [ebp-0000017Ch], 06h" and "jc 013A6905h". See related instructions: "... +153 call dword ptr [013B5130h] ;GetVersionExW +159 cmp dword ptr [ebp-0000017Ch], 06h +166 jc 013A6905h" ... at 00144984-00002740-13823-65-013A67F0 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-13823-180-013AE0F7") which is directly followed by "cmp dword ptr [ebp-0000011Ch], 05h" and "jnbe 013AE13Fh". See related instructions: "... +50 call dword ptr [013B5130h] ;GetVersionExW +56 cmp dword ptr [ebp-0000011Ch], 05h +63 jnbe 013AE13Fh" ... at 00144984-00002740-13823-180-013AE0F7 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-13823-98-013A8C07") which is directly followed by "cmp dword ptr [ebp-00000114h], 06h" and "jne 013A8D14h". See related instructions: "... +156 call dword ptr [013B5130h] ;GetVersionExW +162 cmp dword ptr [ebp-00000114h], 06h +169 jne 013A8D14h" ... at 00144984-00002740-13823-98-013A8C07 Found API call GetVersionExW@KERNEL32.DLL (Target: "cerber_payload.exe", Stream UID: "00144984-00002740-13823-178-013AAA68") which is directly followed by "cmp dword ptr [ebp-00000110h], 06h" and "jc 013AAAB9h". See related instructions: "... +50 call dword ptr [013B5130h] ;GetVersionExW +56 cmp dword ptr [ebp-00000110h], 06h +63 jc 013AAAB9h" ... at 00144984-00002740-13823-178-013AAA6829:T401,CreateToolhelp32Snapshot@KERNEL32.dll at 63899-416-004011F4 CreateToolhelp32Snapshot@KERNEL32.dll at 63899-439-0040A601 CreateToolhelp32Snapshot@KERNEL32.dll at 63899-423-004016E0 CreateToolhelp32Snapshot@KERNEL32.dll at 63899-446-0040A39E CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-6845-53-013A8DB8 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-6845-377-013AA601 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-6845-384-013AA39E CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-6845-361-013A16E0 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-6845-354-013A11F4 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-13823-361-013A16E0 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-13823-354-013A11F4 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-13823-53-013A8DB8 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-13823-377-013AA601 CreateToolhelp32Snapshot@KERNEL32.DLL at 00144984-00002740-13823-384-013AA39E2a:T4f5,InternetCrackUrlA InternetConnectA InternetReadFile HttpSendRequestA InternetOpenA InternetCloseHandle closesocket (Ordinal #3) WSAStartup (Ordinal #115) sendto (Ordinal #20) socket (Ordinal #23) GetModuleFileNameExW Process32NextW CreateToolhelp32Snapshot Process32FirstW Sleep CreateDirectoryW GetVersionExW TerminateProcess CreateThread GetModuleHandleW CreateFileW GetProcAddress OutputDebugStringW WriteFile OpenProcess GetFileSizeEx GetTempFileNameW GetFileSize MapViewOfFile CreateProcessW LoadLibraryExW LoadLibraryW CopyFileW ReadProcessMemory GetTempPathW VirtualAllocEx CreateFileMappingW WinExec DeleteFileW WriteProcessMemory FindFirstFileW GetModuleFileNameW GetCommandLineW VirtualProtect GetTickCount GetModuleHandleA OutputDebugStringA LockResource GetModuleFileNameA GetDriveTypeW VirtualAlloc FindNextFileW FindResourceW GetComputerNameA GetFileAttributesW CreateProcessAsUserW SetKernelObjectSecurity RegOpenKeyW RegCreateKeyExW CryptEncrypt RegEnumKeyW StartServiceCtrlDispatcherW RegCloseKey RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW CreateServiceW OpenProcessToken ZwQueryInformationProcess FindWindowW GetWindowThreadProcessId ShellExecuteExW ShellExecuteW2b:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790475216776,"unified_at":"2026-09-27T02:13:36.776Z","metadata":{"hashes":{"sha256":"e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16","sha1":"193f407a2f0c7e1eaa65c54cd9115c418881de42","md5":"9a7f87c91bf7e602055a5503e80e2313","sha512":"d798b435a92b45ffcd747316f6080d787309a7bcedeb87e2677d57220a83db73f16edb5ddcc69c869c278e969c0391fa19663a29fb2a8c3949e6ecf980bca08d","ssdeep":"3072:yGdtoUTLVtbfcgYMIAN06WJBmc+sFqxF5QIPxdt:yGdtoUTDbfZRgJBmce+Ift","ssdeep_chunks":["3072:yGdtoUT","3072:GdtoUTL","3072:dtoUTLV","3072:toUTLVt","3072:oUTLVtb","3072:UTLVtbf","3072:TLVtbfc","3072:LVtbfcg","3072:VtbfcgY","3072:tbfcgYM","3072:bfcgYMI","3072:fcgYMIA","3072:cgYMIAN","3072:gYMIAN0","3072:YMIAN06","3072:MIAN06W","3072:IAN06WJ","3072:AN06WJB","3072:N06WJBm","3072:06WJBmc","3072:6WJBmc+","3072:WJBmc+s","3072:JBmc+sF","3072:Bmc+sFq","3072:mc+sFqx","3072:c+sFqxF","3072:+sFqxF5","3072:sFqxF5Q","3072:FqxF5QI","3072:qxF5QIP","3072:xF5QIPx","3072:F5QIPxd","3072:5QIPxdt","6144:yGdtoUT","6144:GdtoUTL","6144:dtoUTLV","6144:toUTLVt","6144:oUTLVtb","6144:UTLVtbf","6144:TLVtbfc","6144:LVtbfcg","6144:VtbfcgY","6144:tbfcgYM","6144:bfcgYMI","6144:fcgYMIA","6144:cgYMIAN","6144:gYMIAN0","6144:YMIAN06","6144:MIAN06W","6144:IAN06WJ","6144:AN06WJB","6144:N06WJBm","6144:06WJBmc","6144:6WJBmc+","6144:WJBmc+s","6144:JBmc+sF","6144:Bmc+sFq","6144:mc+sFqx","6144:c+sFqxF","6144:+sFqxF5","6144:sFqxF5Q","6144:FqxF5QI","6144:qxF5QIP","6144:xF5QIPx","6144:F5QIPxd","6144:5QIPxdt","3072:GdtoUTD","3072:dtoUTDb","3072:toUTDbf","3072:oUTDbfZ","3072:UTDbfZR","3072:TDbfZRg","3072:DbfZRgJ","3072:bfZRgJB","3072:fZRgJBm","3072:ZRgJBmc","3072:RgJBmce","3072:gJBmce+","3072:JBmce+I","3072:Bmce+If","3072:mce+Ift"],"imphash":"1bad95f861013577ea8c1dc9812823cd"},"file_info":{"file_name":"cerber_payload.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":114688,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293919000,"last_seen":1657769968000,"last_multi_scan":1657769968000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cerber","ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":4,"suspicious_count":17,"malicious_count":7,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Cerber.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.Cerber.btuqq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.41653","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.41653 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Cerber.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Zerber.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.eatydy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Cerber.A5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-CJM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_CERBER.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_CERBER.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan-Ransom.Zerber","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Razy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"MSCTF.Shared.MUTEX.06363562\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/d /c taskkill /t /f /im \"cerber_payload.exe\" > NUL & ping -n 1 127.0.0.1 > NUL & del \"Z:\\cerber_payload.exe\" > NUL\" on 2016-03-03.11:48:49","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"taskkill.exe\" with commandline \"taskkill /t /f /im \"cerber_payload.exe\"\" (UID: 00149703-00000936)\n Spawned process \"PING.EXE\" with commandline \"ping -n 1 127.0.0.1\" (UID: 00151171-00002996)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"esentutl.lnk.147984\" has type \"MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Mon Jan 1 06:50:36 1601, mtime=Mon Jan 1 06:50:36 1601, atime=Mon Jan 1 06:50:36 1601, length=0, window=hide\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceW@ADVAPI32.dll at 63899-435-0040AACA\n OpenServiceW@ADVAPI32.dll at 63899-434-0040ABD4\n OpenServiceW@ADVAPI32.DLL at 00144984-00002740-6845-236-013A2EE9\n OpenServiceW@ADVAPI32.DLL at 00144984-00002740-6845-372-013AABD4\n OpenServiceW@ADVAPI32.DLL at 00144984-00002740-6845-373-013AAACA\n OpenServiceW@ADVAPI32.DLL at 00144984-00002740-13823-372-013AABD4\n OpenServiceW@ADVAPI32.DLL at 00144984-00002740-13823-373-013AAACA\n OpenServiceW@ADVAPI32.DLL at 00144984-00002740-13823-236-013A2EE9","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.DLL at 00144984-00002740-6845-347-013A318B\n CreateProcessAsUserW@ADVAPI32.DLL at 00144984-00002740-13823-347-013A318B","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.96772070636","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$27","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$28","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeaps@KERNEL32.DLL at 00144984-00002740-6845-24-013B4639\n GetProcessHeap@KERNEL32.DLL at 00144984-00002740-6845-199-013A2BA5\n GetProcessHeaps@KERNEL32.DLL at 00144984-00002740-13823-24-013B4639\n GetProcessHeap@KERNEL32.DLL at 00144984-00002740-13823-199-013A2BA5","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 63899-478-004058A2\n FindResourceW@KERNEL32.DLL at 00144984-00002740-6845-415-013A58A2\n FindResourceW@KERNEL32.DLL at 00144984-00002740-6845-343-013A1000\n FindResourceW@KERNEL32.DLL at 00144984-00002740-13823-343-013A1000\n FindResourceW@KERNEL32.DLL at 00144984-00002740-13823-415-013A58A2","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\"\n \"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"ESENTUTL\", Value: \"\"%APPDATA%\\{2F8065E6-1EE9-F382-9727-163AF6748C62}\\esentutl.exe\"\")\n \"\" (Access type: \"CREATE\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\", Key: \"ESENTUTL\", Value: \"\"%APPDATA%\\{2F8065E6-1EE9-F382-9727-163AF6748C62}\\esentutl.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"$29","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetEntriesInAclW@ADVAPI32.DLL at 00144984-00002740-6845-215-013A1998\n SetKernelObjectSecurity@ADVAPI32.DLL at 00144984-00002740-6845-196-013AA934\n SetKernelObjectSecurity@ADVAPI32.DLL at 00144984-00002740-13823-196-013AA934\n SetEntriesInAclW@ADVAPI32.DLL at 00144984-00002740-13823-215-013A1998","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"cerber_payload.exe.bin\" claimed CRC 100 while the actual is CRC 151925","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2a","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /t /f /im \"cerber_payload.exe\"\" (UID: 00149703-00000936)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/55 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/55 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"\" loaded module \"%WINDIR%\\system32\\taskschd.dll\" at 71A40000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 1 127.0.0.1\" (UID: 00151171-00002996)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00144984-00002740-6845-197-013A10CA\n ExitWindowsEx@USER32.DLL at 00144984-00002740-13823-197-013A10CA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"ZwQueryInformationProcess@ntdll.dll at 63899-418-00404F0B\n ZwOpenDirectoryObject@ntdll.dll at 63899-476-0040AD25\n NtQueryVirtualMemory@ntdll.dll at 63899-497-00414DC2\n ZwDeleteFile@NTDLL.DLL at 00144984-00002740-6845-51-013ABE81\n ZwOpenProcess@NTDLL.DLL at 00144984-00002740-6845-55-013AA439\n ZwQueryInformationProcess@NTDLL.DLL at 00144984-00002740-6845-356-013A4F0B\n ZwQueryVirtualMemory@NTDLL.DLL at 00144984-00002740-6845-432-013B4B99\n ZwOpenDirectoryObject@NTDLL.DLL at 00144984-00002740-6845-413-013AAD25\n ZwDeleteFile@NTDLL.DLL at 00144984-00002740-13823-51-013ABE81\n ZwQueryInformationProcess@NTDLL.DLL at 00144984-00002740-13823-356-013A4F0B\n ZwOpenProcess@NTDLL.DLL at 00144984-00002740-13823-55-013AA439\n ZwQueryVirtualMemory@NTDLL.DLL at 00144984-00002740-13823-432-013B4B99\n ZwOpenDirectoryObject@NTDLL.DLL at 00144984-00002740-13823-413-013AAD25","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"},{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"ControlService@ADVAPI32.dll at 65143-434-0040ABD4\n ControlService@ADVAPI32.dll at 65143-435-0040AACA","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"575343d0aac2ed5d2be719d4"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Persists itself using auto-execute at a hidden registry location"}],"sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["cerber","ransomware"],"sample_flags":["Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"575343d0aac2ed5d2be719d4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"Gen:Variant.Razy","submit_name":"unknown_sample","analysis_start_time":"2017-05-02T05:39:48+00:00","indicators_count":{"informative":0,"suspicious":6,"malicious":4},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"56d8947daac2ed302268e8a2","environment_id":4,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"cerber_payload.exe","analysis_start_time":"2016-03-03T19:46:05+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"56d8947daac2ed302268e8a0","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Zygug","submit_name":"cerber_payload.exe","analysis_start_time":"2016-03-03T13:47:06+00:00","indicators_count":{"informative":4,"suspicious":19,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}],"processes":[{"pid":2740,"ppid":0,"name":"cerber_payload.exe","command_line":"","normalized_path":"","uid":"00144984-00002740","icon":"$2b"},{"pid":2852,"ppid":0,"name":"cmd.exe","command_line":"/d /c taskkill /t /f /im \"cerber_payload.exe\" > NUL & ping -n 1 127.0.0.1 > NUL & del \"Z:\\cerber_payload.exe\" > NUL","normalized_path":"","uid":"00148546-00002852"},{"pid":936,"ppid":0,"name":"taskkill.exe","command_line":"taskkill /t /f /im \"cerber_payload.exe\"","normalized_path":"","uid":"00149703-00000936"},{"pid":2996,"ppid":0,"name":"PING.EXE","command_line":"ping -n 1 127.0.0.1","normalized_path":"","uid":"00151171-00002996"}],"all_imported_dlls":["WINNSI.DLL","ntmarta.dll","apphelp.dll","NETAPI32.dll","USERENV.dll","SAMCLI.DLL","sechost.dll","ADVAPI32.dll","VERSION.dll","CRYPTSP.dll","CRYPTBASE.dll","wmiutils.dll","SHELL32.dll","SAMLIB.dll","taskschd.dll","framedynos.dll","wbemsvc.dll","MPR.dll","imagehlp.dll","Winsta.dll","fastprox.dll","mswsock.dll","PSAPI.DLL","CFGMGR32.dll","dwmapi.dll","wshqos.dll","urlmon.dll","profapi.dll","WINBRAND.dll","wkscli.dll","USP10.dll","kernel32.dll","netutils.dll","ole32.dll","KERNELBASE.dll","rsaenh.dll","GDI32.dll","MSASN1.dll","WS2_32.dll","RPCRT4.dll","LPK.dll","DEVOBJ.dll","srvcli.dll","USER32.dll","comctl32.dll","msvcrt.dll","CLBCatQ.DLL","propsys.dll","SSPICLI.DLL","wbemprox.dll","RpcRtRemote.dll","CRYPT32.dll","MSCTF.dll","SHLWAPI.dll","SspiCli.dll","NSI.dll","SETUPAPI.dll","WTSAPI32.dll","IPHLPAPI.DLL","IMM32.DLL","iertutil.dll","WININET.dll","OLEAUT32.dll","ntdll.dll","uxtheme.dll","Secur32.dll","dbghelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"esentutl.lnk","sha256":"aa3669553ca77ff20bb2918819126b17dbe0cf2718edc3383609bee0b98f9ba3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%WINDIR%\\system32\\esentutl.exe","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\esentutl.lnk","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%APPDATA%\\{2F8065E6-1EE9-F382-9727-163AF6748C62}","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%APPDATA%\\{2F8065E6-1EE9-F382-9727-163AF6748C62}\\esentutl.exe","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%WINDIR%\\system32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%SAMPLEDIR%\\cerber_payload.exe","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\esentutl.lnk","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\soft\\Windows\\Start Menu\\Programs\\Sta","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%WINDIR%\\system32\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"NUL","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"%WINDIR%\\system32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\PRINTERS\\DEFAULTS\\{1850E290-D409-C184-C6C1-47B58E210B0A}\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\PRINTERS\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\PRINTERS\\DEFAULTS\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\COMMAND PROCESSOR\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]},{"key":"HKCU\\CONTROL PANEL\\DESKTOP\\","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"MSCTF.Shared.MUTEX.06363562","sources":[{"report_type":"sandbox","report_id":"56d8947daac2ed302268e8a0"}]}]}},"report_ids":{"sandbox_job_ids":["56d8947daac2ed302268e8a0","575343d0aac2ed5d2be719d4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Razy.Generic Sample e8c6741d3d21… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e8c6741d3d21…. Malware family: Razy.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16"}],["$","meta","4",{"property":"og:title","content":"Malicious Razy.Generic Sample e8c6741d3d21… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e8c6741d3d21…. Malware family: Razy.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Razy.Generic Sample e8c6741d3d21… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e8c6741d3d21…. Malware family: Razy.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]