26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f1ea3b36cb95… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f1ea3b36cb95…. Malware family: Trojan.Generic. Threat score 100/100. 11/29 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705"],"about":{"@type":"SoftwareApplication","name":"redkeeper.exe","applicationCategory":["peexe","executable"],"identifier":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":29},"behavioralIndicators":{"malicious":9,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8e8,".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15482294317 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15482294377 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15501825048 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15506887728 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15510836025 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15513583579 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15517445967 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15521263545 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15523989396 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15527966423 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15531944955 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15536810987 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15539704058 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15545518690 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15548642529 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15552257422 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15557276418 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-15561620649 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11~1\_socket.pyd" at 00069680-00003232-00000046-15572749548 ".exe" queries volume information of "C:\F1EA3B~1.EXE" at 00069680-00003232-00000046-1564153912528:T71f,".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Cipher._AES.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Hash._SHA256.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Random.OSRNG.winrandom.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Util._counter.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Microsoft.VC90.CRT.manifest" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_hashlib.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_socket.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_ssl.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\bz2.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcm90.dll" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcp90.dll" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcr90.dll" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\python27.dll" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\redkeeper.exe.manifest" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\select.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\unicodedata.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Include\pyconfig.h" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\certifi\cacert.pem"29:T4a8,Antivirus vendors marked dropped file "msvcm90.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "msvcr90.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "python27.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcp90.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "cacert.pem" as clean (type is "ASCII text"), Antivirus vendors marked dropped file "Crypto.Cipher._AES.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Crypto.Util._counter.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Crypto.Random.OSRNG.winrandom.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Crypto.Hash._SHA256.pyd" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")2a:Ta5b,".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") ".exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") ".exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}")2b:T62a,"msvcm90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "msvcr90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "python27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "msvcp90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "cacert.pem" has type "ASCII text" "Crypto.Cipher._AES.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Util._counter.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_socket.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RTFM.txt" has type "UTF-8 Unicode text with CRLF line terminators" "pyconfig.h" has type "C source ASCII text" "unicodedata.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Random.OSRNG.winrandom.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Hash._SHA256.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "redkeeper.exe.manifest" has type "XML 1.0 document ASCII text with CRLF line terminators" "Microsoft.VC90.CRT.manifest" has type "XML 1.0 document ASCII text with CRLF line terminators" "_hashlib.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "select.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "bz2.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_ssl.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "desktop.ini" has type "empty"2c:T407,"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.bin" was detected as "VC8 -> Microsoft Corporation" "msvcr90.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "python27.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "msvcp90.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "Crypto.Cipher._AES.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "Crypto.Util._counter.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "_socket.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "unicodedata.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "Crypto.Random.OSRNG.winrandom.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "Crypto.Hash._SHA256.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "_hashlib.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "select.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "bz2.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft" "_ssl.pyd" was detected as "Visual C++ 2005 DLL -> Microsoft"2d:T4b7,"msvcm90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "msvcr90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "python27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "msvcp90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Cipher._AES.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Util._counter.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_socket.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "unicodedata.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Random.OSRNG.winrandom.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Crypto.Hash._SHA256.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_hashlib.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "select.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "bz2.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_ssl.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2e:Tc87,"C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\bz2.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\certifi\cacert.pem" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\certifi" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Cipher._AES.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Hash._SHA256.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Random.OSRNG.winrandom.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Util._counter.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Include\pyconfig.h" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Include" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Microsoft.VC90.CRT.manifest" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcm90.dll" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcp90.dll" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcr90.dll" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\python27.dll" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\redkeeper.exe.manifest" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\select.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\unicodedata.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_hashlib.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_socket.pyd" for deletion "C:\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_ssl.pyd" for deletion2f:T8db,".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\bz2.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\certifi\cacert.pem" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\certifi" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Cipher._AES.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Hash._SHA256.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Random.OSRNG.winrandom.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Crypto.Util._counter.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Include\pyconfig.h" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Include" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\Microsoft.VC90.CRT.manifest" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcm90.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcp90.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\msvcr90.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\python27.dll" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\redkeeper.exe.manifest" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\select.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\unicodedata.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_hashlib.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_socket.pyd" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI11562\_ssl.pyd" with delete access30:T428,GetDriveTypeW GetTempPathW GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter LoadLibraryExW TerminateProcess GetModuleHandleExW LoadLibraryA GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress FindNextFileW FindFirstFileExW CreateFileW GetCommandLineW GetCommandLineA GetModuleHandleW GetFileAttributesExW WriteFile CreateProcessW Sleep GetTickCount CreateThread ExitThread GetFileAttributesA GetDriveTypeA FindFirstFileW GetFileAttributesW OutputDebugStringA GetModuleFileNameA LoadLibraryW VirtualProtect GetStartupInfoA CreateDirectoryA DeleteFileA FindNextFileA CreateFileA GetModuleHandleA FindFirstFileA CreateProcessA VirtualAlloc RegDeleteKeyA RegCloseKey RegDeleteValueA RegCreateKeyExA RegOpenKeyExA RegCreateKeyA RegEnumKeyExA OutputDebugStringW LoadLibraryExA GetVersionExA GetFileSize OpenProcess CreateFileMappingA MapViewOfFile GetFileAttributesExA ShellExecuteW ShellExecuteA accept WSAStartup connect recv send listen closesocket socket bind recvfrom sendto31:T1472,Found malicious artifacts related to "67.199.248.10": ... URL: http://bit.ly/2JOwMCB?offvvctxcb (AV positives: 1/71 scanned on 07/24/2019 07:33:10) URL: http://bit.ly/30A6gSS/ (AV positives: 1/71 scanned on 07/24/2019 06:07:41) URL: https://bit.ly/2Lzo3WR (AV positives: 3/71 scanned on 07/24/2019 05:38:12) URL: https://bit.ly/2JNaRvt (AV positives: 1/71 scanned on 07/24/2019 03:52:54) URL: http://bit.ly/2WxR3nW (AV positives: 10/72 scanned on 07/24/2019 02:46:05) File SHA256: 962e71852d823c3d28eb3fd3c2dddba1ed660e8eb35caa610e395bd4bf11bb39 (AV positives: 10/72 scanned on 07/24/2019 05:20:55) File SHA256: 2f7f5e6dd1c039050e0bd414608875586f7e6ceebb9abe96b8f4fda74eee46b5 (AV positives: 57/72 scanned on 07/24/2019 00:29:19) File SHA256: 56bba86dd59afa20b398c89210295d1315f3ffe007e24bdc6c9490f3ac9fff46 (AV positives: 32/74 scanned on 07/24/2019 04:11:41) File SHA256: 8cc9ba2061647a9b258e2cc41c9d6efe39b6ffdc2a70af89d2e4a21b4c3dc2df (AV positives: 1/72 scanned on 07/24/2019 05:39:06) File SHA256: cc368dde6c845d57fab846179736f18924f8e9a5a6012989af297a8350b7f9e0 (AV positives: 1/69 scanned on 07/23/2019 20:59:48) File SHA256: 3782fe2b9194bf2616609ff2a9559263ea73e697ec4eec0dce750a695377f2f2 (Date: 07/23/2019 18:02:38) File SHA256: 082b69070cef4912e396979da0592ca21e8331c5729ec4098676626ba5688d22 (Date: 07/23/2019 17:42:50) File SHA256: 57bc95c7068910de754e2a795dfa08f1a7b8101662e8faf5aaf8ba3d5634234f (Date: 07/22/2019 16:29:33) File SHA256: 10a00c523418ee0cb83d5ac30492d5560645fc88c495f95363e6785289a5f6ac (Date: 07/22/2019 16:18:51) File SHA256: e2e8b97d1dec5cf3f9035da9751cb5be398829183936f91c3a5504caeab31d7d (Date: 07/21/2019 15:33:36) Found malicious artifacts related to "52.18.63.80": ... URL: http://canarytokens.com/tags/static/terms/046zkwyzph8m865gt8a53o9kl/submit.aspx (AV positives: 1/70 scanned on 05/24/2019 16:28:23) URL: http://canarytokens.com/traffic/jrno2pyyz1ubiz3be52n4p89p/index.html (AV positives: 1/67 scanned on 05/23/2019 14:51:08) URL: http://canarytokens.com/ (AV positives: 1/67 scanned on 05/21/2019 11:00:12) URL: http://canarytokens.com/traffic/zfwe4p9qnq85iknc1p9s36k45/post.jsp (AV positives: 1/70 scanned on 05/18/2019 16:15:08) URL: http://canarytokens.com/feedback/dpon0v0ozgdqrugeiyrjrluiq/submit.aspx (AV positives: 1/67 scanned on 05/15/2019 20:14:18) File SHA256: 27b05fc2e704581ccdce5ab1655c39c60d47ad021181fbfa1843f39ef8b7438f (Date: 07/16/2019 14:51:55) File SHA256: 1fdedbd8bec566f5b435050d1eaf072ee3a4e30de67ba0024073fba736546a35 (Date: 07/06/2019 10:24:20) File SHA256: 6b1bf0d8f26323b68bd65446b65ae574bba460c9a9010a1f0e0277ee46cd2e52 (Date: 06/28/2019 06:18:24) File SHA256: f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705 (Date: 06/09/2019 13:29:48) File SHA256: 84020c9dfd3afbb280182f8161942cb3881974dcb412cb31bd42ad1a287d8fbd (Date: 06/09/2019 12:34:07) File SHA256: 7bb940ba7a443a0cb3c85d4b725fe0547de096f1c70334a5f29295019b08a1a1 (AV positives: 68/73 scanned on 05/17/2019 23:47:12) File SHA256: 949795e4dfce40a1d0544d6a513010b8de6555959a1bbe91c13a49c07c293b4b (AV positives: 1/71 scanned on 04/02/2019 07:04:17) File SHA256: 0f958e566951c646592d6e85d6b550b0347818e3267469cd827f82bbd28bbf75 (AV positives: 41/71 scanned on 02/06/2019 17:57:42) File SHA256: a1481f1dac5c868f79567cc85e5c739fee14c952fdfdec074d038d29b94ab797 (AV positives: 39/70 scanned on 12/17/2018 02:14:40) File SHA256: c310a2a2108b7aaaf6d743311c641921a895001d587eb4b56c78e0eb2e8fceed (AV positives: 55/67 scanned on 11/10/2018 14:56:47) Found malicious artifacts related to "104.16.55.3": ... URL: https://blockchain.info/wallet/ (AV positives: 1/67 scanned on 08/27/2018 23:37:46) URL: https://blockchain.info/ (AV positives: 1/67 scanned on 07/31/2018 02:43:54) URL: http://blockchain.info/confirm/wallet (AV positives: 1/68 scanned on 05/26/2018 18:28:49) URL: http://blockchain.info/Confirm/Wallet_ (AV positives: 1/68 scanned on 05/24/2018 03:27:33) URL: https://blockchain.info/confirm/wallet (AV positives: 1/64 scanned on 01/31/2017 17:16:00) File SHA256: 2c1a20174ea9914ddb76846cf65b3ad5f85d0624921003408eeb43542483664c (AV positives: 1/69 scanned on 07/23/2019 09:29:21) File SHA256: 4f3728c541518781469196e4ae13fa82fbb946b53c9bc236f073266f014b292b (AV positives: 1/72 scanned on 07/20/2019 23:05:44) File SHA256: f22669e7b6d43eaa85c5c986e9706520ca0c06bf8b078fa641799663657c987e (AV positives: 31/74 scanned on 07/15/2019 23:31:40) File SHA256: 04936d196f0afaaea0c447c9f87c1d18a0fd2f8807d1fea921228402dec7d92a (AV positives: 34/72 scanned on 07/15/2019 23:27:58) File SHA256: af7228e7eb29c437976ca01b77f0ee32aff331db4024c110f4d7dbb499e18ed4 (Date: 07/15/2019 18:07:18) File SHA256: fa8fc23934aff8aef2cc0493044814cb9abec7e534f8d2102e2447817bc0c3a6 (AV positives: 47/70 scanned on 07/12/2019 07:36:03) File SHA256: 640bc8c372985e0b69bb3f22b088cd1dff19c3e80e7026e72a246fd78463e0ba (Date: 07/12/2019 00:50:06) File SHA256: afbc1abe4d7c3de21cda6526ea41b9eb11035cbd744af7e2d2c6dcbe03d619cc (Date: 07/07/2019 21:16:57) File SHA256: afc0795b74b44852d13c64b650d0de672449992e266214a5d0ef5c805b04a833 (Date: 07/07/2019 05:43:22) File SHA256: 840cb3eebac506afcff30ce70cee5a4d33e462c35783ef15a5fdf1ae2b1f0b2d (Date: 07/07/2019 05:09:05)32:T1472,Found malicious artifacts related to "67.199.248.10": ... URL: http://bit.ly/2JOwMCB?offvvctxcb (AV positives: 1/71 scanned on 07/24/2019 07:33:10) URL: http://bit.ly/30A6gSS/ (AV positives: 1/71 scanned on 07/24/2019 06:07:41) URL: https://bit.ly/2Lzo3WR (AV positives: 3/71 scanned on 07/24/2019 05:38:12) URL: https://bit.ly/2JNaRvt (AV positives: 1/71 scanned on 07/24/2019 03:52:54) URL: http://bit.ly/2WxR3nW (AV positives: 10/72 scanned on 07/24/2019 02:46:05) File SHA256: 962e71852d823c3d28eb3fd3c2dddba1ed660e8eb35caa610e395bd4bf11bb39 (AV positives: 10/72 scanned on 07/24/2019 05:20:55) File SHA256: 2f7f5e6dd1c039050e0bd414608875586f7e6ceebb9abe96b8f4fda74eee46b5 (AV positives: 57/72 scanned on 07/24/2019 00:29:19) File SHA256: 56bba86dd59afa20b398c89210295d1315f3ffe007e24bdc6c9490f3ac9fff46 (AV positives: 32/74 scanned on 07/24/2019 04:11:41) File SHA256: 8cc9ba2061647a9b258e2cc41c9d6efe39b6ffdc2a70af89d2e4a21b4c3dc2df (AV positives: 1/72 scanned on 07/24/2019 05:39:06) File SHA256: cc368dde6c845d57fab846179736f18924f8e9a5a6012989af297a8350b7f9e0 (AV positives: 1/69 scanned on 07/23/2019 20:59:48) File SHA256: 3782fe2b9194bf2616609ff2a9559263ea73e697ec4eec0dce750a695377f2f2 (Date: 07/23/2019 18:02:38) File SHA256: 082b69070cef4912e396979da0592ca21e8331c5729ec4098676626ba5688d22 (Date: 07/23/2019 17:42:50) File SHA256: 57bc95c7068910de754e2a795dfa08f1a7b8101662e8faf5aaf8ba3d5634234f (Date: 07/22/2019 16:29:33) File SHA256: 10a00c523418ee0cb83d5ac30492d5560645fc88c495f95363e6785289a5f6ac (Date: 07/22/2019 16:18:51) File SHA256: e2e8b97d1dec5cf3f9035da9751cb5be398829183936f91c3a5504caeab31d7d (Date: 07/21/2019 15:33:36) Found malicious artifacts related to "52.18.63.80": ... URL: http://canarytokens.com/tags/static/terms/046zkwyzph8m865gt8a53o9kl/submit.aspx (AV positives: 1/70 scanned on 05/24/2019 16:28:23) URL: http://canarytokens.com/traffic/jrno2pyyz1ubiz3be52n4p89p/index.html (AV positives: 1/67 scanned on 05/23/2019 14:51:08) URL: http://canarytokens.com/ (AV positives: 1/67 scanned on 05/21/2019 11:00:12) URL: http://canarytokens.com/traffic/zfwe4p9qnq85iknc1p9s36k45/post.jsp (AV positives: 1/70 scanned on 05/18/2019 16:15:08) URL: http://canarytokens.com/feedback/dpon0v0ozgdqrugeiyrjrluiq/submit.aspx (AV positives: 1/67 scanned on 05/15/2019 20:14:18) File SHA256: 27b05fc2e704581ccdce5ab1655c39c60d47ad021181fbfa1843f39ef8b7438f (Date: 07/16/2019 14:51:55) File SHA256: 1fdedbd8bec566f5b435050d1eaf072ee3a4e30de67ba0024073fba736546a35 (Date: 07/06/2019 10:24:20) File SHA256: 6b1bf0d8f26323b68bd65446b65ae574bba460c9a9010a1f0e0277ee46cd2e52 (Date: 06/28/2019 06:18:24) File SHA256: f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705 (Date: 06/09/2019 13:29:48) File SHA256: 84020c9dfd3afbb280182f8161942cb3881974dcb412cb31bd42ad1a287d8fbd (Date: 06/09/2019 12:34:07) File SHA256: 7bb940ba7a443a0cb3c85d4b725fe0547de096f1c70334a5f29295019b08a1a1 (AV positives: 68/73 scanned on 05/17/2019 23:47:12) File SHA256: 949795e4dfce40a1d0544d6a513010b8de6555959a1bbe91c13a49c07c293b4b (AV positives: 1/71 scanned on 04/02/2019 07:04:17) File SHA256: 0f958e566951c646592d6e85d6b550b0347818e3267469cd827f82bbd28bbf75 (AV positives: 41/71 scanned on 02/06/2019 17:57:42) File SHA256: a1481f1dac5c868f79567cc85e5c739fee14c952fdfdec074d038d29b94ab797 (AV positives: 39/70 scanned on 12/17/2018 02:14:40) File SHA256: c310a2a2108b7aaaf6d743311c641921a895001d587eb4b56c78e0eb2e8fceed (AV positives: 55/67 scanned on 11/10/2018 14:56:47) Found malicious artifacts related to "104.16.55.3": ... URL: https://blockchain.info/wallet/ (AV positives: 1/67 scanned on 08/27/2018 23:37:46) URL: https://blockchain.info/ (AV positives: 1/67 scanned on 07/31/2018 02:43:54) URL: http://blockchain.info/confirm/wallet (AV positives: 1/68 scanned on 05/26/2018 18:28:49) URL: http://blockchain.info/Confirm/Wallet_ (AV positives: 1/68 scanned on 05/24/2018 03:27:33) URL: https://blockchain.info/confirm/wallet (AV positives: 1/64 scanned on 01/31/2017 17:16:00) File SHA256: 2c1a20174ea9914ddb76846cf65b3ad5f85d0624921003408eeb43542483664c (AV positives: 1/69 scanned on 07/23/2019 09:29:21) File SHA256: 4f3728c541518781469196e4ae13fa82fbb946b53c9bc236f073266f014b292b (AV positives: 1/72 scanned on 07/20/2019 23:05:44) File SHA256: f22669e7b6d43eaa85c5c986e9706520ca0c06bf8b078fa641799663657c987e (AV positives: 31/74 scanned on 07/15/2019 23:31:40) File SHA256: 04936d196f0afaaea0c447c9f87c1d18a0fd2f8807d1fea921228402dec7d92a (AV positives: 34/72 scanned on 07/15/2019 23:27:58) File SHA256: af7228e7eb29c437976ca01b77f0ee32aff331db4024c110f4d7dbb499e18ed4 (Date: 07/15/2019 18:07:18) File SHA256: fa8fc23934aff8aef2cc0493044814cb9abec7e534f8d2102e2447817bc0c3a6 (AV positives: 47/70 scanned on 07/12/2019 07:36:03) File SHA256: 640bc8c372985e0b69bb3f22b088cd1dff19c3e80e7026e72a246fd78463e0ba (Date: 07/12/2019 00:50:06) File SHA256: afbc1abe4d7c3de21cda6526ea41b9eb11035cbd744af7e2d2c6dcbe03d619cc (Date: 07/07/2019 21:16:57) File SHA256: afc0795b74b44852d13c64b650d0de672449992e266214a5d0ef5c805b04a833 (Date: 07/07/2019 05:43:22) File SHA256: 840cb3eebac506afcff30ce70cee5a4d33e462c35783ef15a5fdf1ae2b1f0b2d (Date: 07/07/2019 05:09:05)33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZmZmd3d3d3d3d3d3d3dgBGYBMzMwRmZnd3d3d3d3YARnO7u7swAAAAAARmZnd2AEe7u7u7uwAAAAB3AAAGdgBHu7u7u7swAAAAD3AABnYAY7u7u7u7MAAAAAf3AAZkAGO7u7u7uzAAAAAAfwAGZABju7u7u7swAAAAAIgABmQAY7u7u7u7MAAAAH9wAAZgAGO7u7u7u7u7sAB3AAAGYABju7u7u7uzO7AAAAAABmAAY7u7u7u7sAOwAAAAAAZgBGO7u7u7u7M7sAAAAABGYARzu7u7u7u7uzAAAAAARmAEc7u7u7u7uzMAAAAAAGZgBnO7u7u7EAAAAAAAAABmQAZzu7u7uwAAAAAAAAAAZkAEY7u7u7sAAAAAAAAAAGZAAAO7u7u7AAAAAAAAAABmAAADu7u7szAEREAAAAAAZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791014353412,"unified_at":"2026-10-03T07:59:13.412Z","metadata":{"hashes":{"sha256":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705","sha1":"5303f76efe6f3bc63ede2bb36734699ffeddc275","md5":"e98da70892f401b58af5d9b7c37f81b5","sha512":"3ac98ec0b0173c464e7793376a97443880761d75687e285ae2c5f8e56791c8aa174567e27da9f6881ca9a0c96f9b087c4da08f938fb1beff134815dd1a9b76f7","ssdeep":"98304:aiM8iS4OU8TE77fuc9ygvCv/lPLeqNZ8hY/5Bur/C91rduEdKHn3L6n7IdoeFzj5:9Fi53kE/9cgav/lPKQ8hY/OrK9dKHnbP","ssdeep_chunks":["98304:aiM8iS4","98304:iM8iS4O","98304:M8iS4OU","98304:8iS4OU8","98304:iS4OU8T","98304:S4OU8TE","98304:4OU8TE7","98304:OU8TE77","98304:U8TE77f","98304:8TE77fu","98304:TE77fuc","98304:E77fuc9","98304:77fuc9y","98304:7fuc9yg","98304:fuc9ygv","98304:uc9ygvC","98304:c9ygvCv","98304:9ygvCv/","98304:ygvCv/l","98304:gvCv/lP","98304:vCv/lPL","98304:Cv/lPLe","98304:v/lPLeq","98304:/lPLeqN","98304:lPLeqNZ","98304:PLeqNZ8","98304:LeqNZ8h","98304:eqNZ8hY","98304:qNZ8hY/","98304:NZ8hY/5","98304:Z8hY/5B","98304:8hY/5Bu","98304:hY/5Bur","98304:Y/5Bur/","98304:/5Bur/C","98304:5Bur/C9","98304:Bur/C91","98304:ur/C91r","98304:r/C91rd","98304:/C91rdu","98304:C91rduE","98304:91rduEd","98304:1rduEdK","98304:rduEdKH","98304:duEdKHn","98304:uEdKHn3","98304:EdKHn3L","98304:dKHn3L6","98304:KHn3L6n","98304:Hn3L6n7","98304:n3L6n7I","98304:3L6n7Id","98304:L6n7Ido","98304:6n7Idoe","98304:n7IdoeF","98304:7IdoeFz","98304:IdoeFzj","98304:doeFzj5","196608:aiM8iS4","196608:iM8iS4O","196608:M8iS4OU","196608:8iS4OU8","196608:iS4OU8T","196608:S4OU8TE","196608:4OU8TE7","196608:OU8TE77","196608:U8TE77f","196608:8TE77fu","196608:TE77fuc","196608:E77fuc9","196608:77fuc9y","196608:7fuc9yg","196608:fuc9ygv","196608:uc9ygvC","196608:c9ygvCv","196608:9ygvCv/","196608:ygvCv/l","196608:gvCv/lP","196608:vCv/lPL","196608:Cv/lPLe","196608:v/lPLeq","196608:/lPLeqN","196608:lPLeqNZ","196608:PLeqNZ8","196608:LeqNZ8h","196608:eqNZ8hY","196608:qNZ8hY/","196608:NZ8hY/5","196608:Z8hY/5B","196608:8hY/5Bu","196608:hY/5Bur","196608:Y/5Bur/","196608:/5Bur/C","196608:5Bur/C9","196608:Bur/C91","196608:ur/C91r","196608:r/C91rd","196608:/C91rdu","196608:C91rduE","196608:91rduEd","196608:1rduEdK","196608:rduEdKH","196608:duEdKHn","196608:uEdKHn3","196608:EdKHn3L","196608:dKHn3L6","196608:KHn3L6n","196608:Hn3L6n7","196608:n3L6n7I","196608:3L6n7Id","196608:L6n7Ido","196608:6n7Idoe","196608:n7IdoeF","196608:7IdoeFz","196608:IdoeFzj","196608:doeFzj5","98304:9Fi53kE","98304:Fi53kE/","98304:i53kE/9","98304:53kE/9c","98304:3kE/9cg","98304:kE/9cga","98304:E/9cgav","98304:/9cgav/","98304:9cgav/l","98304:cgav/lP","98304:gav/lPK","98304:av/lPKQ","98304:v/lPKQ8","98304:/lPKQ8h","98304:lPKQ8hY","98304:PKQ8hY/","98304:KQ8hY/O","98304:Q8hY/Or","98304:8hY/OrK","98304:hY/OrK9","98304:Y/OrK9d","98304:/OrK9dK","98304:OrK9dKH","98304:rK9dKHn","98304:K9dKHnb","98304:9dKHnbP"],"imphash":"4df47bd79d7fe79953651a03293f0e8f"},"file_info":{"file_name":"redkeeper.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4941633,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1560085511000,"last_seen":1598535133000,"last_multi_scan":1598535133000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banking","commodity","criminal","crypt","downloader","equation","floxif","gozi","isfb","productkey","sbdbat2exe","ursnif","wanacrypt0r","wannacry","wannacrypt","wcry","webshell","ransomware","binder","hacktool","keylogger","lazagne","metasploit","meterpreter","neshta","wanaransomware"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":25,"suspicious_count":20,"malicious_count":9,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Python.Spy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0054fe6e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.CVE-2019-0708.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Trojan.sg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.CVE20190708.frfqzf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.MBT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"totaldefense":{"name":"Total Defense","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom.630D9D05","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom.630D9D05","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 62377-1753-00407F57\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069528-00001156-2297-78-010B1AB1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069528-00001156-2297-492-010A785A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069528-00001156-2297-660-010A7DEC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069528-00001156-2297-1483-010A7F57\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069680-00003232-23665-78-010B1AB1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069680-00003232-23665-492-010A785A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069680-00003232-23665-655-010A7DEC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00069680-00003232-23665-1478-010A7F57","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00069528-00001156-2297-672-010A7CDE\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00069680-00003232-23665-667-010A7CDE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00069528-00001156-2297-141-010BB3C6\n GetTimeZoneInformation@KERNEL32.DLL at 00069680-00003232-23665-141-010BB3C6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 45303-4476-1E0DD760","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 010BB9FEh\" at 00069528-00001156-2297-141-010BB3C6\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 010BB9FEh\" at 00069680-00003232-23665-141-010BB3C6","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 62377-1784-00418CC5\n GetProcessHeap@KERNEL32.DLL at 00069528-00001156-2297-1495-010B8CC5\n GetProcessHeap@KERNEL32.DLL at 00069680-00003232-23665-1490-010B8CC5\n GetProcessHeap@KERNEL32.dll at 45303-4302-1E11E210","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RTFM.TXT\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RTFM.TXT\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NOTEPAD.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NOTEPAD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"canarytokens.com\"\n \"bit.ly\"\n \"blockchain.info\"\n \"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwel.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.199.248.10:443\"\n \"52.18.63.80:80\"\n \"104.16.55.3:443\"\n \"13.179.185.111:3389\"\n \"52.144.44.134:3389\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"msvcp90.i386.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$28","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$29","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /about/images/traffic/v9p49wb2o4w2qgl8ffb7gfl5g/submit.aspx HTTP/1.1\nHost: canarytokens.com\nConnection: keep-alive\nAccept-Encoding: gzip, deflate\nAccept: */*\nUser-Agent: python-requests/2.22.0\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00069680-00003232) was launched with new environment variables: \"_MEIPASS2=\"%TEMP%\\_MEI11562\"\"\n Process \"notepad.exe\" (UID: 00070416-00002748) was launched with missing environment variables: \"_MEIPASS2\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00069680-00003232)\n Spawned process \"notepad.exe\" with commandline \"%USERPROFILE%\\Desktop\\RTFM.txt\" (UID: 00070416-00002748)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00069680-00003232)\n Spawned process \"notepad.exe\" with commandline \"%USERPROFILE%\\Desktop\\RTFM.txt\" (UID: 00070416-00002748)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"notepad.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\ieframe.dll\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\notepad.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"canarytokens.com\"\n Heuristic match: \"bit.ly\"\n Heuristic match: \"blockchain.info\"\n Heuristic match: \"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwel.com\"\n Heuristic match: \"Not importing directory '%.*s': missing __init__.py\"\n Heuristic match: \"lib\\os.py\"\n Pattern match: \"http://python.org/dev/peps/pep-0263/\"\n Pattern match: \"www.entrust.net/CPS_2048\"\n Pattern match: \"www.entrust.net/CPS\"\n Pattern match: \"www.xrampsecurity.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"notepad.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$2c","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00069680-00003232-00000033-16587516661","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00069680-00003232-00000033-19418138552","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.29706120507","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00069528-00001156-2297-28-010A8056\n cpuid at 00069680-00003232-23665-28-010A8056\n cpuid at 55723-3356-784BA39C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/71 reputation engines marked \"http://bit.ly\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2d","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.8/29, 192.168.240.16/32, 192.168.240.22/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.199.248.10 on port 443 is sent without HTTP header\n TCP traffic to 52.18.63.80 on port 80 is sent without HTTP header\n TCP traffic to 104.16.55.3 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nAll right hes in the personal ads. Disappointed white male. Cross dresser looking for discreet friend to bring dreams to realiy. Leather, lace and water sports. Transvestites welcome.\n\n\nYour files have been encrypted. To decrypt your files send 1,000,000 satoshi (Don't you think we should ask more than 1 million satoshi ?) to address 19GL2cUrn1Xx8XD6VaL25SYAzQd6qnwVb7 \n\n\nIf you like to be a hero when balance is over 100,000,000 satoshi kill switch activates !?!\" (Source: RTFM.txt, Indicator: \"decrypt your files\")\n \"Your files have been encrypted. To decrypt your files send 1,000,000 satoshi (Don't you think we should ask more than 1 million satoshi ?) to address 19GL2cUrn1Xx8XD6VaL25SYAzQd6qnwVb7\" (Source: RTFM.txt, Indicator: \"decrypt your files\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"decryp_\" (Source: screen_4.png, Indicator: \"decrypt\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2e","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"msvcm90.dll\" claimed CRC 253278 while the actual is CRC 4955553\n \"msvcr90.dll\" claimed CRC 675255 while the actual is CRC 253278\n \"python27.dll\" claimed CRC 2464757 while the actual is CRC 675255\n \"msvcp90.dll\" claimed CRC 622740 while the actual is CRC 2463152","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$30","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c0dfff761cf9fe76ccf8fe760d64007700000000c011ae7400000000fc3eae7400000000e013ae74000000009457a67625e0ff76c6e0ff7600000000bc6aa57600000000cf31ae74000000009319a676000000002c32ae7400000000\" to virtual address \"0x76A41000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"0efc027781ed0177ae860077c6e0ff76effd02772d160177c0fcfe76da8f097760140377478d0077a8e2ff766089007700000000ad37a3748b2da374b641a37400000000\" to virtual address \"0x74721000\" (part of module \"WSHIP6.DLL\")\n \".exe\" wrote bytes \"7d07037781ed0177ae860077c6e0ff76effd02772d16017760140377478d0077a8e2ff766089007700000000ad37a3748b2da374b641a37400000000\" to virtual address \"0x73BA1000\" (part of module \"WSHTCPIP.DLL\")\n \".exe\" wrote bytes \"7111ca007a3bc900ab8b02007f950200fc8c0200729602006cc805001ecdc6007d26c600\" to virtual address \"0x763B07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/70 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/16 Antivirus vendors marked sample as malicious (18% detection rate)\n 35/70 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/80 Antivirus vendors marked dropped file \"_socket.pyd\" as malicious (classified as \"No error\" with 1% detection rate)\n 2/81 Antivirus vendors marked dropped file \"unicodedata.pyd\" as malicious (classified as \"Suspicious\" with 2% detection rate)\n 1/80 Antivirus vendors marked dropped file \"_hashlib.pyd\" as malicious (classified as \"Unavailable\" with 1% detection rate)\n 1/82 Antivirus vendors marked dropped file \"select.pyd\" as malicious (classified as \"Process crashed\" with 1% detection rate)\n 1/81 Antivirus vendors marked dropped file \"bz2.pyd\" as malicious (classified as \"No error\" with 1% detection rate)\n 1/81 Antivirus vendors marked dropped file \"_ssl.pyd\" as malicious (classified as \"No error\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"35/80 Antivirus vendors marked spawned process \".exe\" (PID: 3232) as malicious (classified as \"CVE-2019-0708\" with 43% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe\" (Handle: 64)\n \".exe\" wrote 52 bytes to a remote process \"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe\" (Handle: 64)\n \".exe\" wrote 4 bytes to a remote process \"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe\" (Handle: 64)\n \".exe\" wrote 8 bytes to a remote process \"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe\" (Handle: 64)\n \".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 852)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 852)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 852)\n \".exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 852)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.2/31, 192.168.240.4/30, 192.168.240.8/29, 192.168.240.16/28, 192.168.240.32/27, 192.168.240.64/29\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$31","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$32","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 13.179.185.111 on port 3389\n TCP traffic to 52.144.44.134 on port 3389","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n Heuristic match: \"gethostbyname(host) -> address\n\nReturn the IP address (a string of the form '255.255.255.255') for a host.\"\n Heuristic match: \"inet_aton(string) -> packed 32-bit IP representation\n\nConvert an IP address in string format (123.45.67.89) to the 32-bit packed\nbinary format used in low-level network functions.\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":151,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":5,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["banking","commodity","criminal","crypt","downloader","equation","floxif","gozi","isfb","productkey","sbdbat2exe","ursnif","wanacrypt0r","wannacry","wannacrypt","wcry","webshell","ransomware","binder","hacktool","keylogger","lazagne","metasploit","meterpreter","neshta","wanaransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"5d239793028838473f48cadf","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2019-0708","contacted_countries":["USA"],"submit_name":"redkeeper.bin","analysis_start_time":"2019-07-24T10:33:47+00:00","indicators_count":{"informative":25,"suspicious":24,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5cfd0404028838912c006240","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"redkeeper.exe","analysis_start_time":"2019-06-09T13:04:13+00:00","indicators_count":{"informative":25,"suspicious":23,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.199.248.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"address":"52.18.63.80","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"address":"104.16.55.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"address":"13.179.185.111","port":3389,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"address":"52.144.44.134","port":3389,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"address":"67.199.248.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"dns_resolutions":[{"domain":"bit.ly","address":"67.199.248.10","ttl":248,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"domain":"blockchain.info","address":"104.16.54.3","ttl":21,"country":"United States","registrar_name":"CloudFlare, Inc.","registrar_organization":"Blockchain","registrar_name_servers":"BETH.NS.CLOUDFLARE.COM","registrar_creation_date":"2011-10-15T15:48:38+00:00","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"domain":"canarytokens.com","address":"52.18.63.80","country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Thinkst Applied Research","registrar_name_servers":"NS1.CANARYTOKENS.ORG","registrar_creation_date":"2015-07-30T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"domain":"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwel.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"domain":"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwem.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"http_requests":[{"host":"canarytokens.com","host_ip":"52.18.63.80:80","url":"/about/images/traffic/v9p49wb2o4w2qgl8ffb7gfl5g/submit.aspx","method":"GET","header":"GET /about/images/traffic/v9p49wb2o4w2qgl8ffb7gfl5g/submit.aspx HTTP/1.1\nHost: canarytokens.com\nConnection: keep-alive\nAccept-Encoding: gzip, deflate\nAccept: */*\nUser-Agent: python-requests/2.22.0","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}],"processes":[{"pid":1156,"ppid":0,"name":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe","command_line":"","sha256":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705","normalized_path":"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe","uid":"00069528-00001156","icon":"$33"},{"pid":3232,"ppid":1156,"name":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe","command_line":"","sha256":"f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705","normalized_path":"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe","parent_uid":"00069528-00001156","uid":"00069680-00003232"},{"pid":2748,"ppid":3232,"name":"notepad.exe","command_line":"%USERPROFILE%\\Desktop\\RTFM.txt","sha256":"b56afe7165ad341a749d2d3bd925d879728a1fe4a4df206145c1a69aa233f68b","normalized_path":"%WINDIR%\\SysWOW64\\notepad.exe","parent_uid":"00069680-00003232","uid":"00070416-00002748"}],"all_imported_dlls":["ieframe.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wow64cpu.dll","dnsapi.dll","oleaut32.dll","version.dll","iertutil.dll","setupapi.dll","wow64win.dll","user32.dll","ole32.dll","clbcatq.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","kernel32.dll","rpcrt4.dll","advapi32.dll","IPHLPAPI.DLL","uxtheme.dll","comctl32.dll","dwmapi.dll","msasn1.dll","cfgmgr32.dll","devobj.dll","ntmarta.dll","ws2_32.dll","sspicli.dll","shell32.dll","msvcr90.dll","winnsi.dll","comdlg32.dll","cryptsp.dll","mswsock.dll","normaliz.dll","cryptbase.dll","nsi.dll","Wldap32.dll","sechost.dll","python27.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wship6.dll","netutils.dll","ntdll.dll","msctf.dll","srvcli.dll","api-ms-win-core-synch-l1-2-0.dll","tzres.dll","rsaenh.dll","msvcrt.dll","shlwapi.dll","netapi32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","usp10.dll","api-ms-win-downlevel-user32-l1-1-0.dll","crypt32.dll","KernelBase.dll","gdi32.dll","imm32.dll","FWPUCLNT.DLL","wkscli.dll","wow64.dll","apphelp.dll","lpk.dll","WSHTCPIP.DLL","rasadhlp.dll","propsys.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bz2.pyd","sha256":"2f65a93a7e9b5d8cd618b7ad893a8e094942016dfb165e0638e57c1e9bdb4507","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"_hashlib.pyd","sha256":"afab75a25ca8f87916d2a639d384b8cff9bf3050354594e9564c27fe62ef3e4e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"_socket.pyd","sha256":"c4d4577cb797a7206dafd862bd09264b248fd9324e008dee1783067da85e793e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"_ssl.pyd","sha256":"6d9abe468b51b13e220d042f160e617e896eddecf7031a14cac2407ed65c7eaf","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"select.pyd","sha256":"d50e9e695c69f54a42ffa043029d12bb228fc1ed199c919749731c15348a6460","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"unicodedata.pyd","sha256":"a80049de708d13c0bb4a5fca2cd3083524db164cbc0629d46a3519516afed889","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Crypto.Hash._SHA256.pyd","sha256":"c2759764570922d64b82f60028ac228046c17151cdfaad2d2054dafc9721ff09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"msvcm90.dll","sha256":"7a74da389fbd10a710c294c2e914dc6f18e05f028f07958a2fa53ac44f0e4b90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"msvcp90.dll","sha256":"06918cf99ad26cd6cf106881c0d5bdb212dc0bac4549805c9f5906e3d03d152c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"msvcr90.dll","sha256":"8e7fe1a1f3550c479ffd86a77bc9d10686d47f8727025bb891d8f4f0259354c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"python27.dll","sha256":"618fdc50437b021b4efe53b093e078646a050308324493f213cdbb29db08f79b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Crypto.Cipher._AES.pyd","sha256":"f500151fa24a18ec94a614e1bd24af9b360f095b11a4ce24452099174e155a48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Crypto.Random.OSRNG.winrandom.pyd","sha256":"5ac0aa3589eb77e375c165217117a5c64cdfd8b074b243770751252490d17c04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Crypto.Util._counter.pyd","sha256":"f8454cce013f987a94bd83222762261b349b3b732319b0c91b4c6ed5318150ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"cacert.pem","sha256":"397b833e5acf89a2709b964401a9aca68d24b62349b72bbe38684e586aa07a27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"pyconfig.h","sha256":"8e1613e5363a1ec22228acea618af74ba5cb6d6fd91dcc9d4a8e8ef40f1da2b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"Microsoft.VC90.CRT.manifest","sha256":"0d060ed7c25159b7b75f16d449963bfd639c15b3c5280bc7897403268c2b9f35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"name":"redkeeper.exe.manifest","sha256":"12af6287c010e61b9c4d535a1cd8f503524e32f7d86c3933aa99f039e900e2d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"files_written":[{"path":"C:\\f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705.exe","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"C:\\F1EA3B~1.EXE","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ctypes.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ctypes.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ctypes.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\backports.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\backports.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\backports.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\backports.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ipaddress.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ipaddress.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ipaddress.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\ipaddress.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\fcntl.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\fcntl.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\fcntl.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\fcntl.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\brotli.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\brotli.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\brotli.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\brotli.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\OpenSSL.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\OpenSSL.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\OpenSSL.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\OpenSSL.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pwd.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pwd.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pwd.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\pwd.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\grp.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\grp.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\grp.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\grp.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\simplejson.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\simplejson.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\simplejson.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\simplejson.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\org.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\org.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\org.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\org.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\socks.pyd","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\socks.py","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\socks.pyw","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\socks.pyc","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%TEMP%\\_MEI11~1\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\SysWOW64\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"}]},{"path":"%USERPROFILE%\\Desktop\\RTFM.txt","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Crypto.Cipher._AES.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Crypto.Hash._SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Crypto.Random.OSRNG.winrandom.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Crypto.Util._counter.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\bz2.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\select.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Include","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\Include\\pyconfig.h","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\certifi","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40082\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"C:\\redkeeper.exe","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"C:\\REDKEE~1.EXE","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ctypes.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ctypes.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ctypes.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\backports.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\backports.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\backports.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\backports.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ipaddress.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ipaddress.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ipaddress.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\ipaddress.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\fcntl.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\fcntl.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\fcntl.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\fcntl.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\brotli.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\brotli.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\brotli.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\brotli.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\OpenSSL.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\OpenSSL.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\OpenSSL.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\OpenSSL.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pwd.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pwd.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pwd.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\pwd.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\grp.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\grp.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\grp.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\grp.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\simplejson.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\simplejson.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\simplejson.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\simplejson.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\org.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\org.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\org.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\org.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\socks.pyd","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\socks.py","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\socks.pyw","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\socks.pyc","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%TEMP%\\_MEI40~1\\certifi\\cacert.pem","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\System32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\System32\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d239793028838473f48cadf"},{"report_type":"sandbox","report_id":"5cfd0404028838912c006240"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d239793028838473f48cadf","5cfd0404028838912c006240"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f1ea3b36cb95… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f1ea3b36cb95…. Malware family: Trojan.Generic. Threat score 100/100. 11/29 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f1ea3b36cb95… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f1ea3b36cb95…. Malware family: Trojan.Generic. Threat score 100/100. 11/29 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f1ea3b36cb95ba07da4ddced67b2a3da8d7842fdeff37d8153af0e75a41b8705"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f1ea3b36cb95… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f1ea3b36cb95…. Malware family: Trojan.Generic. Threat score 100/100. 11/29 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]