26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/BTSGeneric Sample f479a3779efb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f479a3779efb…. Malware family: Trojan/BTSGeneric. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f","keywords":["Malicious","Trojan/BTSGeneric","malware analysis","sandbox report","threat intelligence","f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f"],"about":{"@type":"SoftwareApplication","name":"SoftUpdate.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/BTSGeneric","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4de,"" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" touched file "C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"28:Tafc,Found malicious artifacts related to "195.22.26.248": ... URL: http://zillionnetuk.info/get/?data=R%2B6N1lcXD3Hy0dHkg0wMmL1yA0G53A8ATzObjx9p7Lefj2LY0trKOIZ6TlGzUsr/FjKLWu/Hw8QKRe4gxdqJy%2BHnKXpa7DFrifhUPc%2BzQJdx/F%2BHIvdtKXPfPPgKWU66I7A00ajIvmg3okQfh1%2BRU8TEfhTRDUbTRP77HOCYIdwz5kKCcGTnWtjqLa7YRftyK9eekBo0j92X4oHPb6mbs70Tll7BKVHk6Ei/eE4f2fqD70hZrnW/wk3EE7b/IdjsyJqco28OStdpIrZ9udQmpZu44IhTrMXynkCehLgksZAudod2CJpfitLJiFSF%2BDzfkIdS%2BJx2j6A/xWtxnPbfVJP/6inLyLAsL3GPtxBYgXF8vQl1iplTVithbb4yaxEGEem3X7t7dhK5jF8d5aLSZ83qvotq17IrLyr/1qHGpIkLuHyS9jPHuzMmKloCm6ZuGoGHwqBQI&version=4 (AV positives: 4/67 scanned on 02/27/2018 13:30:18) URL: http://p.pxl2015x1.com/pixel/?id=54539d62-1f31-4d57-8704-6f39f0ac67f2&tid=c1cf51c8-bd89-4ca8-9de9-1dafe7703f5c&pub=e9de4d2e-3361-11e5-aa89-c6471388719e&rid=&did=&cb=1519679819963 (AV positives: 2/67 scanned on 02/27/2018 12:40:59) URL: http://c1.reportbox3.info/?step_id=1&installer_id=2604950356&publisher_id=377&source_id=0&page_id=0&country_code=CZ&locale=EN&browser_id=1&download_id=2656631122&external_id=0&session_id=2014941829&hardware_id=949403515&%3Bproduct_file_name=MafiaFox8.sis&%3Bproduct_title=DFHDownloadManager&%3Buuid=&file=b3c3db6c&product_name=MafiaFox8.sis&installer_file_name=DataFileHost&product_download_url=%3CServerUrl%3E%2Faddons%2Ferror.txt&product_file_name=error.txt&filesize= (AV positives: 5/67 scanned on 02/27/2018 12:38:32) URL: http://mucheckin.innopath.net/cic/bxn4nw==875892069/checkin.dat (AV positives: 1/67 scanned on 02/27/2018 12:34:03) URL: http://mucheckin.innopath.net/ (AV positives: 1/67 scanned on 02/27/2018 12:32:14) File SHA256: 4b17ed15b03e73bed2b16d0c31f89ea47146c2977957d8b9f1c5a2814fc6b9a1 (AV positives: 62/68 scanned on 02/27/2018 09:57:50) File SHA256: 96f0cc6d3673d0e8786dbf3f7911ffe5b4d5be73364eca6ac0cd52297f7fbf60 (AV positives: 52/67 scanned on 02/26/2018 22:29:35) File SHA256: a885a542ab18da811b3a16071ca32c43ecc21b65fa3bdc6978a0771b49975b68 (AV positives: 52/68 scanned on 02/26/2018 22:13:58) File SHA256: bb949fdccafbd7711e582c8487769b8482bf3053462a7a0506a77114b7f676c3 (AV positives: 52/68 scanned on 02/26/2018 21:39:41) File SHA256: 4f40932fc9515b205591c9b61eca722bd22461ebd8aa52bdc13aea8829d3a477 (AV positives: 32/68 scanned on 02/26/2018 15:57:18) File SHA256: a65bbfbb131e9d2f4754a8679724c4c9bcf82a24c16040c9238591de34eb61d6 (Date: 02/24/2018 15:42:47) File SHA256: 5039ac2ef31094b12d7cdc6c0fb23d98183b45ba8f0734d69edf8f9cf23c843c (Date: 02/23/2018 19:52:47) File SHA256: 87f60ad33cb59275c676a374e093c1cf9dab425943e90ab4a146d54a4333358b (Date: 02/18/2018 07:50:08) File SHA256: 77bd07d42f99a1dcb233ab59826ef9fbab6ef37360e5aa376090f5a2fa61530c (Date: 02/18/2018 04:23:43) File SHA256: 2c63ed299424040101132c087a9af0db8ce2422634c5fd7b62717f52a1b730a1 (Date: 02/16/2018 09:29:51)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790427275795,"unified_at":"2026-09-26T12:54:35.795Z","metadata":{"hashes":{"sha256":"f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f","sha1":"2735dedc91b0b6637709f75c1232a232125b516c","md5":"fbce77645d9bb72efa77a2934306e854","sha512":"41b2033bde92c688eddc2ca27c461b0224b53ac5b67c34168c21d61a120a2975fa1c948b5754b2ce5381840929a447491e855cb03bc30570d8846176857db3eb","ssdeep":"12288:5bjpCTgvxz+qtBNjnPLIG71pqBht4kT2aqBj0tr+ELbahJqAbjpCTgvxz+qtBNjk:fXBwiFXBwiFXBwi","ssdeep_chunks":["12288:5bjpCTg","12288:bjpCTgv","12288:jpCTgvx","12288:pCTgvxz","12288:CTgvxz+","12288:Tgvxz+q","12288:gvxz+qt","12288:vxz+qtB","12288:xz+qtBN","12288:z+qtBNj","12288:+qtBNjn","12288:qtBNjnP","12288:tBNjnPL","12288:BNjnPLI","12288:NjnPLIG","12288:jnPLIG7","12288:nPLIG71","12288:PLIG71p","12288:LIG71pq","12288:IG71pqB","12288:G71pqBh","12288:71pqBht","12288:1pqBht4","12288:pqBht4k","12288:qBht4kT","12288:Bht4kT2","12288:ht4kT2a","12288:t4kT2aq","12288:4kT2aqB","12288:kT2aqBj","12288:T2aqBj0","12288:2aqBj0t","12288:aqBj0tr","12288:qBj0tr+","12288:Bj0tr+E","12288:j0tr+EL","12288:0tr+ELb","12288:tr+ELba","12288:r+ELbah","12288:+ELbahJ","12288:ELbahJq","12288:LbahJqA","12288:bahJqAb","12288:ahJqAbj","12288:hJqAbjp","12288:JqAbjpC","12288:qAbjpCT","12288:AbjpCTg","12288:+qtBNjk","24576:5bjpCTg","24576:bjpCTgv","24576:jpCTgvx","24576:pCTgvxz","24576:CTgvxz+","24576:Tgvxz+q","24576:gvxz+qt","24576:vxz+qtB","24576:xz+qtBN","24576:z+qtBNj","24576:+qtBNjn","24576:qtBNjnP","24576:tBNjnPL","24576:BNjnPLI","24576:NjnPLIG","24576:jnPLIG7","24576:nPLIG71","24576:PLIG71p","24576:LIG71pq","24576:IG71pqB","24576:G71pqBh","24576:71pqBht","24576:1pqBht4","24576:pqBht4k","24576:qBht4kT","24576:Bht4kT2","24576:ht4kT2a","24576:t4kT2aq","24576:4kT2aqB","24576:kT2aqBj","24576:T2aqBj0","24576:2aqBj0t","24576:aqBj0tr","24576:qBj0tr+","24576:Bj0tr+E","24576:j0tr+EL","24576:0tr+ELb","24576:tr+ELba","24576:r+ELbah","24576:+ELbahJ","24576:ELbahJq","24576:LbahJqA","24576:bahJqAb","24576:ahJqAbj","24576:hJqAbjp","24576:JqAbjpC","24576:qAbjpCT","24576:AbjpCTg","24576:+qtBNjk","12288:fXBwiFX","12288:XBwiFXB","12288:BwiFXBw","12288:wiFXBwi","12288:iFXBwiF","12288:FXBwiFX"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"SoftUpdate.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1340416,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297643000,"last_seen":1677402777000,"last_multi_scan":1677402777000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["neshta","banker","dridex","evasive","sinkhole"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":2},"sandbox_signatures":{"informative_count":14,"suspicious_count":17,"malicious_count":4,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.bck","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-EBU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Allaple.Win32.23917","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/BTSGeneric","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/56 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"event.swupdateservice.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"138.91.189.124:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\Users\\Motti\\Documents\\emaze\\Development\\SwUpdater\\Client\\SoftUpdate\\obj\\Release\\SoftUpdate.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"IPHLPAPI.DLL\" at base 753D0000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\FWPUCLNT.DLL\" at base 73F90000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 68EE0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"GetAdaptersAddresses@iphlpapi.dll\"\n \"getaddrinfo@WS2_32.dll\"\n \"freeaddrinfo@WS2_32.dll\"\n \"DnsFree@DNSAPI.dll\"\n \"NamespaceCallout@fwpuclnt.dll\"\n \"WSAConnect@WS2_32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"event.swupdateservice.net/event\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 138.91.189.124 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2432.517250\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2432.517250\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2432.517265\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"42F2EDFA\" to virtual address \"0x6D751FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLEFILETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLECONSOLETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"FILETRACINGMASK\", Value: \"0000FFFF\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"CONSOLETRACINGMASK\", Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_Processor\" (Indicator: \"win32_process\"; File: \"f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/71 reputation engines marked \"http://event.swupdateservice.net\" as malicious (2% detection rate)\n 2/66 reputation engines marked \"http://event.swupdateservice.net/event\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetCurrentProcess\" (Source: f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcAddress\" (Source: f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.bin, API is part of module: KERNELBASE.DLL)\n Found string \"IsWow64Process\" (Source: f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/70 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/20 Antivirus vendors marked sample as malicious (20% detection rate)\n 25/70 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00012537-00001568-00000033-55157027","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /event HTTP/1.1Content-Type: application/jsonHost: event.swupdateservice.netContent-Length: 350Expect: 100-continueConnection: Keep-Alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 3004672)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4268897792)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASAPI32\" (Filter: 14; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMANCS\" (Filter: 14; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 2702804481)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 2702804481)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" (Filter: 4; Subtree: 2702804481)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5dc39e770288381e3e08c933"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":98,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":59,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["neshta","banker","dridex","evasive","sinkhole"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"5dc39e770288381e3e08c933","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"ADW_BROWSEFOX.component","submit_name":"SoftUpdate.exe","analysis_start_time":"2019-11-07T04:33:06+00:00","indicators_count":{"informative":3,"suspicious":4,"malicious":3},"is_in_unified_schema":true},{"id":"5a95517a7ca3e1279f445a2b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Browsefox","contacted_countries":["PRT"],"submit_name":"SoftUpdate.exe","analysis_start_time":"2018-02-27T14:26:04+00:00","indicators_count":{"informative":12,"suspicious":12,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"55d716710e316dfa13b58138","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":25,"contacted_countries":["USA"],"submit_name":"SoftUpdate.exe","analysis_start_time":"2015-08-21T07:17:12+00:00","indicators_count":{"informative":8,"suspicious":10,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"138.91.189.124","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"address":"195.22.26.248","port":80,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}],"dns_resolutions":[{"domain":"event.swupdateservice.net","address":"138.91.189.124","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}],"http_requests":[{"host":"event.swupdateservice.net","host_ip":"195.22.26.248:80","url":"/event","method":"POST","header":"POST /event HTTP/1.1\nContent-Type: application/json\nHost: event.swupdateservice.net\nContent-Length: 350Expect: 100-continue\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}],"processes":[{"pid":2432,"ppid":0,"name":"f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f","command_line":"","normalized_path":"","uid":"00514796-00002432","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAJiSURBVFhH7Ze5bsJAEIbzhghBx6PwGggJ4zLQU/AGiI4CiUsIkTScSWwX+D4mnt0s6xO8dtJlpRGLYP1/c1r78vK//iOQiMByuYTT6QTX6xXO53NBo/8/HA4wnU6hVqtB6cCuVisIggDKLNd1Ac8jRKPRKAeBD7Btm+gjSBD44Pt55oHnccMzu90OttstLBYLqNfrCCEGEgfIF/b9uDiC4Hp/f4Pj8UjA5vM5tFotMYgoQLbnaWEaBZcAoPf7/Z7sVVWFyWQCzWazOAQCWJZFHpAFEA0537t3gPV6DcPha2hDGAwGMBqNYDweM4Dn6XgMkOU9FccCRGPrcrkAwsxmMwLxUwtlAbwwGtniTJh/OuA4TqyTNptNFYDnXkfFXZcCUMNUBqDrelmAKuJ2CIDtHICmaaIAJglhuuB4rqnXDjHuMe6pMM4SNHyOpqliAKaZBIgXWlFx27bIIKsIICbOvbfCCFQGqCbOAHAgCbWhaRokdHktxnNO8x3NOc099R4HGg4zVVXEAfBgHCBZcFniVJiJUwBPHMAwDEKe39/FxC3LrApAvY632mNx6r15twoR8J72eDTf0bAnARRFsAYwBTiE8ouN5zpPGCFwnuCLSlG+xIowDpAMeZY4DzkTRnHspgoA6bGabDGs8mi42R6FmZUE0Al5vL/TLZYtTj3/FQD2QmG9/SjfPPRcvFQK8F5wu91IAVIA8z5cKICRMqwZw9AzzXFc+Pz8KF6ECPAXq/C7oN1uQ7fbBVnuQ79PTZLYXgq/c5MkKfytl2m9Xg/QZFmGTqdTPAI/V6rogd/ex25t39gL/fGAj31gAAAAAElFTkSuQmCC"}],"all_imported_dlls":["wmiutils.dll","dhcpcsvc.DLL","rasman.dll","MSCTF.dll","KERNELBASE.dll","KERNEL32.dll","credssp.dll","wminet_utils.dll","OLEAUT32.dll","System.Xml.ni.dll","CFGMGR32.dll","PSAPI.DLL","mscorjit.dll","NSI.dll","RPCRT4.dll","VERSION.dll","CRYPTBASE.dll","wbemprox.dll","sechost.dll","LPK.dll","System.ni.dll","wbemsvc.dll","rtutils.dll","mscorlib.ni.dll","CLBCatQ.DLL","wship6.dll","CRYPTSP.dll","dhcpcsvc6.DLL","rasapi32.dll","ole32.dll","System.Management.ni.dll","mscoreei.dll","IMM32.DLL","rasadhlp.dll","culture.dll","System.Configuration.ni.dll","DNSAPI.dll","iphlpapi.dll","msvcrt.dll","USP10.dll","ntdll.dll","SspiCli.dll","fwpuclnt.dll","USER32.dll","DEVOBJ.dll","SHLWAPI.dll","ADVAPI32.dll","uxtheme.dll","RpcRtRemote.dll","wshtcpip.dll","mswsock.dll","shell32.dll","rsaenh.dll","MSCOREE.DLL","WS2_32.dll","mscorwks.dll","GDI32.dll","winhttp.dll","SETUPAPI.dll","profapi.dll","rpcrt4.dll","mscoree.dll","kernel32.dll","KernelBase.dll","advapi32.dll","cryptbase.dll","dhcpcsvc6.dll","gdi32.dll","user32.dll","msctf.dll","ws2_32.dll","fastprox.dll","shlwapi.dll","usp10.dll","cryptsp.dll","dnsapi.dll","lpk.dll","WMINet_Utils.dll","clbcatq.dll","nsi.dll","ntdsapi.dll","winnsi.dll","tzres.dll","System.Drawing.ni.dll","webio.dll","msvcr80.dll","version.dll","System.Windows.Forms.ni.dll","rpcss.dll","wbemcomn.dll","IPHLPAPI.DLL","sspicli.dll","cfgmgr32.dll","imm32.dll","oleaut32.dll","WSHTCPIP.DLL","dhcpcsvc.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"C:\\f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.exe.config","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"C:\\f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f.exe","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index2b5.dat","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"},{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"55d716710e316dfa13b58138"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a95517a7ca3e1279f445a2b"}]}]}},"report_ids":{"sandbox_job_ids":["5a95517a7ca3e1279f445a2b","5dc39e770288381e3e08c933","55d716710e316dfa13b58138"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan/BTSGeneric Sample f479a3779efb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f479a3779efb…. Malware family: Trojan/BTSGeneric. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/BTSGeneric Sample f479a3779efb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f479a3779efb…. Malware family: Trojan/BTSGeneric. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/BTSGeneric Sample f479a3779efb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f479a3779efb…. Malware family: Trojan/BTSGeneric. Threat score 100/100. 6/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]