24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ef294e69cda9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ef294e69cda9…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f"],"about":{"@type":"SoftwareApplication","name":"stinger.rl.zip","applicationCategory":["peexe","executable"],"identifier":"ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":29},"behavioralIndicators":{"malicious":3,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7d5,"C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Liesmich.htm" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\ReadMe.htm" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Javascripts\JSByteCodeWin.bin" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\DEU\license.html" for deletion "C:\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\ENU\license.html" for deletion26:T669,".exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Liesmich.htm" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\ReadMe.htm" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Javascripts\JSByteCodeWin.bin" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\DEU\license.html" with delete access ".exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\ENU\license.html" with delete access27:T16f9,Heuristic match: "|| E-mail:hackcwand@protonmail.com" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6af87429a4abeed7 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "https://validation.sls.microsoft.com/SLWGA/slwga.asmx" Pattern match: "www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl0" Pattern match: "www.microsoft.com/pkiops/certs/MicSecSerCA2011_2011-10-18.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://genuine.microsoft.com/reporting/XmlEvent.ashx?v=3" Pattern match: "www.microsoft.com" Pattern match: "http://0012b1-1.l.windowsupdate.com/llnhost_ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191611" Pattern match: ".download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191611" Pattern match: "www.microsoft.com/pkiops/crl/Microsoft%20Update%20Secure%20Server%20CA%202.1.crl0u" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Update%20Secure%20Server%20CA%202.1.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "http://0016fe-1.l.windowsupdate.com/llnhost_ds.download.windowsupdate.com/v11/3/windowsupdate/selfupdate/WSUS3/x64/Win7SP1/wsus3setup.cab?1803191612" Pattern match: ".download.windowsupdate.com/v11/3/windowsupdate/selfupdate/WSUS3/x64/Win7SP1/wsus3setup.cab?1803191612" Pattern match: "http://0016e6-1.l.windowsupdate.com/llnhost_ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191612" Pattern match: ".download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191612" Heuristic match: "HEAD /v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191613 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: ds.download.windowsupdate.com" Pattern match: "http://001ad7-1.l.windowsupdate.com/llnhost_ds.download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191613" Pattern match: ".download.windowsupdate.com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1803191613" Heuristic match: "HEAD /d/msdownload/update/software/updt/2018/02/windows6.1-kb2952664-v24-x64-express_105376a37c8ace7aa4ba72c52bc707b0b7fe05ff.cab HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: au.download.windowsupdate.com" Heuristic match: "HEAD /d/msdownload/update/software/updt/2018/02/windows6.1-kb2952664-v24-x64-express_105376a37c8ace7aa4ba72c52bc707b0b7fe05ff.cab HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityUser-Agent: Microsoft BITS/7.5Host: au.download.wi" Heuristic match: "HEAD /c/msdownload/update/software/uprl/2018/03/windows-kb890830-x64-v5.58_83692b6e0bf4960554b3273d9d3e01e8442b538f.exe HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: au.download.windowsupdate.com" Heuristic match: "HEAD /c/msdownload/update/software/secu/2017/11/windows6.1-kb4054518-x64-express_db28ce70ccefa582bf52abdc5c6d440f08667426.cab HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: au.download.windowsupdate.com" Heuristic match: "GET /d/msdownload/update/software/updt/2018/02/windows6.1-kb2952664-v24-x64-express_105376a37c8ace7aa4ba72c52bc707b0b7fe05ff.cab HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Mon, 26 Feb 2018 15:20:35 GMTR" Heuristic match: "update.cat" Heuristic match: "package_for_kb2952664_sp1~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "package_3_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "package_2_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat" Heuristic match: "package_1_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Heuristic match: "HEAD /c/msdownload/update/software/uprl/2018/03/windows-kb890830-x64-v5.58_83692b6e0bf4960554b3273d9d3e01e8442b538f.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityUser-Agent: Microsoft BITS/7.5Host: au.download.windowsupdat" Heuristic match: "GET /c/msdownload/update/software/uprl/2018/03/windows-kb890830-x64-v5.58_83692b6e0bf4960554b3273d9d3e01e8442b538f.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 06 Mar 2018 17:04:00 GMTRange: byte" Heuristic match: "HEAD /d/msdownload/update/software/updt/2018/02/windows6.1-kb2952664-v24-x64_4e25d9cf8db321a797ffd699b4d793ad373a3fe7.psf HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: au.download.windowsupdate.com" Heuristic match: "-#MB{.IN" Pattern match: "X.ibmL/+o"28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791401696178,"unified_at":"2026-10-07T19:34:56.178Z","metadata":{"hashes":{"sha256":"ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f","sha1":"deb7847bb22194ee8b9b6a14e42cbafb1500c09c","md5":"874632c09503322f62525b0735e59e84","sha512":"af19947e755835ec448bd1e9f194fea59db799f81fefbc02f0d1be157966d0855cbb293ded90c5fec5e694104dd43ae998da1c233e1ad9da32ad8505877d19f6","ssdeep":"768:w+93pM8s1Y9Z7/DNdpdWBDB+7I+hpjpvUcqLD1:zRpM8/T7r3WiXzvUpLD","ssdeep_chunks":["768:w+93pM8","768:+93pM8s","768:93pM8s1","768:3pM8s1Y","768:pM8s1Y9","768:M8s1Y9Z","768:8s1Y9Z7","768:s1Y9Z7/","768:1Y9Z7/D","768:Y9Z7/DN","768:9Z7/DNd","768:Z7/DNdp","768:7/DNdpd","768:/DNdpdW","768:DNdpdWB","768:NdpdWBD","768:dpdWBDB","768:pdWBDB+","768:dWBDB+7","768:WBDB+7I","768:BDB+7I+","768:DB+7I+h","768:B+7I+hp","768:+7I+hpj","768:7I+hpjp","768:I+hpjpv","768:+hpjpvU","768:hpjpvUc","768:pjpvUcq","768:jpvUcqL","768:pvUcqLD","768:vUcqLD1","1536:w+93pM8","1536:+93pM8s","1536:93pM8s1","1536:3pM8s1Y","1536:pM8s1Y9","1536:M8s1Y9Z","1536:8s1Y9Z7","1536:s1Y9Z7/","1536:1Y9Z7/D","1536:Y9Z7/DN","1536:9Z7/DNd","1536:Z7/DNdp","1536:7/DNdpd","1536:/DNdpdW","1536:DNdpdWB","1536:NdpdWBD","1536:dpdWBDB","1536:pdWBDB+","1536:dWBDB+7","1536:WBDB+7I","1536:BDB+7I+","1536:DB+7I+h","1536:B+7I+hp","1536:+7I+hpj","1536:7I+hpjp","1536:I+hpjpv","1536:+hpjpvU","1536:hpjpvUc","1536:pjpvUcq","1536:jpvUcqL","1536:pvUcqLD","1536:vUcqLD1","768:zRpM8/T","768:RpM8/T7","768:pM8/T7r","768:M8/T7r3","768:8/T7r3W","768:/T7r3Wi","768:T7r3WiX","768:7r3WiXz","768:r3WiXzv","768:3WiXzvU","768:WiXzvUp","768:iXzvUpL","768:XzvUpLD"],"imphash":"76074a169f840181079353f5b9e6fe7b"},"file_info":{"file_name":"stinger.rl.zip","file_type":["peexe","executable"],"file_type_id":"exe","file_size":40448,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521476230000,"last_seen":1694468887000,"last_multi_scan":1694468887000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Stinger","Ransomware","evasive"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":16,"malicious_count":3,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dinwod.mgDt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.CryFile","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.AS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30412660","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.30412660 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Stinger.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Adware ( 005524301 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.CryFile.zxf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.ayj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryFile.eyxxcl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Stingran-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.CryFile.40448","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.EFEF86C3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.EFEF86C3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Ransom.VJFZ-0135","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptoStinger.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanRansom.CryFile","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.Win32.123609","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"PSPUBWS-PC\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.3395480855","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"PSPUBWS-PC\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$25","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeA\n IsDebuggerPresent\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n DeleteFileA\n GetProcAddress\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n FindNextFileA\n CreateProcessA\n CreateFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"CreateWindowExA\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: USER32.DLL)\n Found string \"GetMessageA\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: USER32.DLL)\n Found string \"TranslateMessage\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: USER32.DLL)\n Found string \"DispatchMessageA\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: USER32.DLL)\n Found string \"LocalSize\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: KERNEL32.DLL)\n Found string \"RegisterClassExA\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: USER32.DLL)\n Found string \"DefWindowProcA\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: USER32.DLL)\n Found string \"GetDiskFreeSpaceExA\" (Source: deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"41/66 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"41/66 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00012316-00003216-58139-72-00405A80","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00012316-00003216-58139-78-00405850\n GetProcessHeap@KERNEL32.DLL at 00012316-00003216-58139-86-00407BC0\n GetProcessHeap@KERNEL32.DLL at 00012316-00003216-58139-85-00407C90\n GetProcessHeap@KERNEL32.DLL at 00012316-00003216-58139-12-0040576D\n GetProcessHeap@KERNEL32.DLL at 00012316-00003216-58139-80-00407DC0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"notepad.exe\" queries volume information of \"C:\\About .Stinger unlocking instructions.txt\" at 00025567-00002164-00000046-106012918","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"95.100.252.34:53350\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mrtstub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"notepad.exe\" with commandline \"Notepad C:\\About .Stinger unlocking instructions.txt\" (UID: 00025567-00002164)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"dot4.inf.Stinger\" has type \"data\"\n \"-Pfo47a3NDD[1].js.Stinger\" has type \"data\"\n \"2[1].htm.Stinger\" has type \"data\"\n \"EB_api[1].js.Stinger\" has type \"data\"\n \"player-skin.min[1].css.Stinger\" has type \"data\"\n \"prnbr006.inf.Stinger\" has type \"data\"\n \"_SMSvcHostPerfCounters.ini.Stinger\" has type \"data\"\n \"smiles.7310cf01[1].css.Stinger\" has type \"data\"\n \"new_icons.png.Stinger\" has type \"data\"\n \"common.min[1].js.Stinger\" has type \"data\"\n \"edit_pdf_poster.jpg.Stinger\" has type \"data\"\n \"enhanced[1].css.Stinger\" has type \"data\"\n \"About .Stinger unlocking instructions.txt\" has type \"Non-ISO extended-ASCII text with CRLF line terminators\"\n \"css[2].css.Stinger\" has type \"data\"\n \"capinfos.html.Stinger\" has type \"data\"\n \"illustrations_retina.png.Stinger\" has type \"data\"\n \"ffjcext.zip.Stinger\" has type \"data\"\n \"cabecera[1].css.Stinger\" has type \"data\"\n \"netw5v64.inf.Stinger\" has type \"ATSC A/52 aka AC-3 aka Dolby Digital stream 44.1 kHz music and effects (ME) 3 front/2 rear 32 kbit/s\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"notepad.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\notepad.exe.mui\"\n \"notepad.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"notepad.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"notepad.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui\"\n \"notepad.exe\" touched file \"%WINDIR%\\System32\\sppuinotify.dll\"\n \"notepad.exe\" touched file \"%WINDIR%\\System32\\slui.exe\"\n \"notepad.exe\" touched file \"%WINDIR%\\System32\\sppsvc.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"notepad.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.contact.Stinger\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"m:ManufacturerInfoinnotek GmbHWMI:Win32_ComputerSystem:ModelInfoVirtualBoxWMI:Win32_OperatingSystem:InstallDateInfo20171203120616.000000+060\" (Indicator: \"win32_computersystem\"; File: \"network.pcap\")","origin":"File/Memory","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"m:ManufacturerInfoinnotek GmbHWMI:Win32_ComputerSystem:ModelInfoVirtualBoxWMI:Win32_OperatingSystem:InstallDateInfo20171203120616.000000+060\" (Indicator: \"virtualbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"hackcwand@protonmail.com\"\n Pattern match: \"xq@u-.kcm\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"notepad.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"MM-SEARCH * HTTP/1.1Host:239.255.255.250:1900ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1Man:\"ssdp:discover\"MX:3\"\n Heuristic match: \"r_kb2952664_sp1~31bf3856ad364e35~amd64~~6.1.24.3.mum\"\n Heuristic match: \"package_for_kb2952664_sp1~31bf3856ad364e35~amd64~~6.1.24.3.cat\"\n Heuristic match: \"package_3_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.mum\"\n Heuristic match: \"package_3_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat\"\n Heuristic match: \"package_2_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.mum\"\n Heuristic match: \"package_2_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat\"\n Heuristic match: \"package_1_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.mum\"\n Heuristic match: \"package_1_for_kb2952664~31bf3856ad364e35~amd64~~6.1.24.3.cat\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 95.100.252.34 on port 53350","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"},{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":164,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Stinger","Ransomware","evasive"],"sample_flags":["Network Traffic","User Comment","Extracted Files"],"sandbox_reports":[{"id":"5aafe0987ca3e12bc87d8b74","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["EU"],"submit_name":"stinger.zip","analysis_start_time":"2018-03-19T17:08:35+00:00","indicators_count":{"informative":11,"suspicious":15,"malicious":4},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5aafe0617ca3e12a517adf24","environment_id":300,"state":"ERROR","error_type":"The system is configured to reject 32-bit native files on a 64-bit linux virtual machine","verdict":"undetected","submit_name":"stinger.zip","analysis_start_time":"2018-03-19T16:08:01+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5aafdf4e7ca3e126074c9650","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"stinger.rl.zip","analysis_start_time":"2018-03-19T17:59:04+00:00","indicators_count":{"informative":1,"suspicious":7,"malicious":3},"tags":["Network Traffic","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.100.252.34","port":53350,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]}],"dns_resolutions":[{"domain":"PSPUBWS-PC","ttl":30,"country":"-","sources":[{"report_type":"sandbox","report_id":"5aafdf4e7ca3e126074c9650"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}],"processes":[{"pid":3216,"ppid":0,"name":"deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe","command_line":"","sha256":"ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f","normalized_path":"C:\\deb7847bb22194ee8b9b6a14e42cbafb1500c09c.rl.exe","uid":"00012316-00003216","icon":"$28"},{"pid":2164,"ppid":3216,"name":"notepad.exe","command_line":"Notepad C:\\About .Stinger unlocking instructions.txt","sha256":"b56afe7165ad341a749d2d3bd925d879728a1fe4a4df206145c1a69aa233f68b","normalized_path":"%WINDIR%\\SysWOW64\\notepad.exe","parent_uid":"00012316-00003216","uid":"00025567-00002164"}],"all_imported_dlls":["ntdll.dll","kernel32.dll","KernelBase.dll","user32.dll","gdi32.dll","usp10.dll","imm32.dll","lpk.dll","msvcrt.dll","shlwapi.dll","msctf.dll","wow64cpu.dll","sechost.dll","cryptbase.dll","comdlg32.dll","oleaut32.dll","rpcrt4.dll","comctl32.dll","clbcatq.dll","wow64win.dll","ole32.dll","wow64.dll","apphelp.dll","dwmapi.dll","shell32.dll","sspicli.dll","uxtheme.dll","advapi32.dll","version.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"About .Stinger unlocking instructions.txt","sha256":"10ab08b967c8f7824675ba85d56106c3362684d862e8ff7618f3107f869efbfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"ar.txt.Stinger","sha256":"a1221bf1911c1d15d43e0fe61850ef7f13160e7ed34d04fca9a75ddffa48bce7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"az.txt.Stinger","sha256":"f10f0c702a9cb77ed0b9b0cf49fa9c1c1b009983757d3902c3cbc2280bc179e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"co.txt.Stinger","sha256":"c498fb7524c8476660f715e77a122e670fe951ab24720006ede9a80e19fa80db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"gu.txt.Stinger","sha256":"dc612eea00aca5866e4be6c8c0b98ba7a273fe8bfdbc8fd0713d38d630e1ca98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"he.txt.Stinger","sha256":"bd105c01c24c07332a9c0730c6d54d504fd20ea3220cc10bc72634bcbd539770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"mn.txt.Stinger","sha256":"1bd9aacdff57f555eb43c969ffde92491301044dacb37392aa01eed9794c7eab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"mng.txt.Stinger","sha256":"3728372601c80a7bbc9c5ccb0af9791c05b0a072c467b298c88569798b1c8702","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"mng2.txt.Stinger","sha256":"f2121a70d8f6e30322ea7419eba5dc9f2de2e20c8006cd3e246d8901186141b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"pl.txt.Stinger","sha256":"02be381dbacf70ffc961532d5bcee8d6f7b06b6a830d34b47bdfa8246301ad44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"sa.txt.Stinger","sha256":"f7c1583b0fe0ce7f565c6ba1f5725762d988e8f1b2a4ffae36efb1df4a70eb6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"sr-spc.txt.Stinger","sha256":"d1cd89adf199c3a46f16e6ab76cc4edd292239ebf22de621bf6f8cf31280a4f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"ta.txt.Stinger","sha256":"1400eeb2290170dac596772f637b633ed80f69af51aa174b6a425d0bfc25e6a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"tt.txt.Stinger","sha256":"d6ae978d52102a4ad1e3c767c473db5bb0e5ac3f6539ecd9ef6f8acd8bb9b33f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"vi.txt.Stinger","sha256":"4e40d7017cb201f98dc87215477e30198b26e63d0957600889ceb3331b6afb87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"yo.txt.Stinger","sha256":"6d3c47096e8bc61d54532be279a14c1880925776c44af1eab7f5269bbad090f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"Setup.xml.Stinger","sha256":"ea3e93dd359481d38e5dfce6b310995181f53fd8cff8a7dc71f3ac6e845d4ed7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"branding.xml.Stinger","sha256":"feed215a35bef3777732dc5f6fe07ac415ece3bd204ba8d406d7624b1530f8fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"dot4.inf.Stinger","sha256":"e38f1a10331953ca4f4062f0cac27d382323119fa8d7ac721cf730b52caed084","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"name":"-Pfo47a3NDD[1].js.Stinger","sha256":"79eb18371025dd695d03b932bf50c308a6e9901b609a99fe1d0a056687d3b9f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]}],"files_written":[{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusWW.xml.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\History.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\License.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\readme.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\af.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\an.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ar.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ast.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\az.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ba.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bg.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bn.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\br.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ca.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\co.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cs.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cy.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\da.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\de.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\el.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eo.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\es.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\et.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eu.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ext.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fa.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fi.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fr.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fur.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fy.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ga.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gl.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gu.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\he.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hi.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hr.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hu.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hy.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\id.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\io.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\is.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\it.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ja.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ka.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kaa.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kk.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ko.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku-ckb.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ky.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lt.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lv.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mk.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mn.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng2.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mr.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ms.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nb.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ne.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nl.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nn.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pa-in.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pl.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ps.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt-br.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ro.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ru.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sa.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\si.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sl.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sq.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spc.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spl.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sv.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ta.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\th.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tr.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tt.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ug.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uk.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uz.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\va.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\vi.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\yo.txt.Stinger","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-cn.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-tw.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscat.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipschs.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscht.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscsy.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdan.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdeu.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsen.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsesp.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfin.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfra.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipshrv.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsita.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsjpn.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipskor.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnld.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnor.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsplk.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptb.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptg.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrom.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrus.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrb.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrl.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssve.xml","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"C:\\About .Stinger unlocking instructions.txt","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\System32\\sppuinotify.dll","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\System32\\slui.exe","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]},{"path":"%WINDIR%\\System32\\sppsvc.exe","sources":[{"report_type":"sandbox","report_id":"5aafe0987ca3e12bc87d8b74"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5aafdf4e7ca3e126074c9650","5aafe0987ca3e12bc87d8b74"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ef294e69cda9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ef294e69cda9…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ef294e69cda9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ef294e69cda9…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ef294e69cda98f1a76367d07f009e340176f523fe2fb7495f6161046d4f0944f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ef294e69cda9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ef294e69cda9…. Malware family: Trojan.Generic. Threat score 100/100. 25/29 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]