24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 04d70bb24920… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 04d70bb24920…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"],"about":{"@type":"SoftwareApplication","name":"tmp4oyd7_d9","applicationCategory":["peexe","executable"],"identifier":"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4a5,LoadResource@KERNEL32.dll at 2250-35272-00464112 LoadResource@KERNEL32.dll at 2250-35148-00419C85 LoadResource@KERNEL32.dll at 2250-35333-00420423 LoadResource@KERNEL32.dll at 2250-35386-00420E95 LoadResource@KERNEL32.dll at 2250-35855-00419FB3 LoadResource@KERNEL32.dll at 2250-36095-00403D60 LoadResource@KERNEL32.dll at 2250-36254-00419B79 LoadResource@KERNEL32.dll at 2250-36105-00402FA0 LockResource@KERNEL32.dll at 2250-36106-00419ED9 FindResourceW@KERNEL32.DLL at 00085407-00001812-64957-287-00353120 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-289-00353040 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-340-003AC092 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-368-0045B868 FindResourceW@KERNEL32.DLL at 00085407-00001812-64957-377-003530B0 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-642-00369C85 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-766-003B4112 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-825-00370423 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-878-00370E95 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-1347-00369FB3 LoadResource@KERNEL32.DLL at 00085407-00001812-64957-1587-00353D6026:T405,RegDeleteKeyA RegCloseKey RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegEnumKeyA RegEnumKeyExA GetFileAttributesA GetTempPathA FindResourceExW OutputDebugStringA OutputDebugStringW GetModuleFileNameW CopyFileA GetModuleFileNameA UnhandledExceptionFilter LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetTickCount VirtualProtect GetVersionExA LoadLibraryA Process32Next GetFileSize Process32First CreateDirectoryA DeleteFileA GetStartupInfoW GetProcAddress WriteFile GetFileSizeEx FindFirstFileExA FindFirstFileA GetTempFileNameA FindNextFileA CreateFileW CreateFileA LockResource GetCommandLineW IsDebuggerPresent GetCommandLineA GetModuleHandleA GetModuleHandleW FindResourceW Sleep GetFileAttributesExA FindResourceA VirtualAlloc ShellExecuteA GetCursorPos GetLastActivePopup SetWindowsHookExA GetWindowThreadProcessId GetUpdateRect socket bind send accept WSAStartup recv closesocket listen27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAABEREQAAAAAAAAAAAAAAAAARHdkAAAAAAAAAAAAAAAAAER3ZAAAAAAAAAAAAERAAABkREYAAAREAAAAAAREQAAAAEQAAAAEREAAAABEd2QAAABEAAAARndEAAAARIdkAAAARAAAAERmRAAAAERERAAAAEQAAABEREQAAAAARERAAAZEYAAEREQAAAAAAAAERARERERAREAAAAAAAAAAAGREREREREQAAAAAAAAAAAAERERmRERAAAAAAAAAAAAARER4/4ZERAAAAAAERGAAAERH////ZEQAAAZERERAAAZESPiIj4REYAAERER3RERERG/4iI+ERERERHdEd0RERERv+Ij/hERERER3RERAAAZESP+I/4REYAAEREZEYAAAREb///hkRAAABkRAAAAAAEREaIiGREQAAAAAAAAAAAAERERERERAAAAAAAAAAAAARkRERERERAAAAAAAAAAABEQEREREQGRAAAAAAAAARERAAAZEYAAEREQAAAAAREZEAAAARAAAAERmRAAAAEZ3ZAAAAEQAAABEiEQAAABEZkQAAABEAAAARIdEAAAABERAAAAARGAAAAREQAAAAABEQAAAZERGAAAERAAAAAAAAAAAAEaIZAAAAAAAAAAAAAAAAABEiEQAAAAAAAAAAAAAAAAAZERGAAAAAAAAD/+B////gf///4H//4+B8f8Hw+D+B+fgfgfn4H4H5+B/A8PA//EAj//4AB///AA///gAH/D4AB8AcAAOAAAAAAAAAAAAcAAOAPgAHw/4AB///AA///gAH//xAI//A8PA/gfn4H4H5+B+B+fgfgfD4P8PgfH//4H///+B////gf/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790749019139,"unified_at":"2026-09-30T06:16:59.139Z","metadata":{"hashes":{"sha256":"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30","sha1":"49e16180795034a4888fff776968e29871f79340","md5":"96071956d4890aebea14ecd8015617cc","sha512":"29abd5fa0c24e42916631f830b6860027dcefdfd320978bee389e55f4f04278668ec4cfb67e5b1c8b7133338cc0fb09ffae28c5cf6d5226d1f9e44381db17c41","ssdeep":"98304:SC6l4uHxECiYwS2BsszjfisjJiBg1pDClmMFLOAkGkzdnEVomFHKnP:P44uHi0mFi+1p+FLOyomFHKnP","ssdeep_chunks":["98304:SC6l4uH","98304:C6l4uHx","98304:6l4uHxE","98304:l4uHxEC","98304:4uHxECi","98304:uHxECiY","98304:HxECiYw","98304:xECiYwS","98304:ECiYwS2","98304:CiYwS2B","98304:iYwS2Bs","98304:YwS2Bss","98304:wS2Bssz","98304:S2Bsszj","98304:2Bsszjf","98304:Bsszjfi","98304:sszjfis","98304:szjfisj","98304:zjfisjJ","98304:jfisjJi","98304:fisjJiB","98304:isjJiBg","98304:sjJiBg1","98304:jJiBg1p","98304:JiBg1pD","98304:iBg1pDC","98304:Bg1pDCl","98304:g1pDClm","98304:1pDClmM","98304:pDClmMF","98304:DClmMFL","98304:ClmMFLO","98304:lmMFLOA","98304:mMFLOAk","98304:MFLOAkG","98304:FLOAkGk","98304:LOAkGkz","98304:OAkGkzd","98304:AkGkzdn","98304:kGkzdnE","98304:GkzdnEV","98304:kzdnEVo","98304:zdnEVom","98304:dnEVomF","98304:nEVomFH","98304:EVomFHK","98304:VomFHKn","98304:omFHKnP","196608:SC6l4uH","196608:C6l4uHx","196608:6l4uHxE","196608:l4uHxEC","196608:4uHxECi","196608:uHxECiY","196608:HxECiYw","196608:xECiYwS","196608:ECiYwS2","196608:CiYwS2B","196608:iYwS2Bs","196608:YwS2Bss","196608:wS2Bssz","196608:S2Bsszj","196608:2Bsszjf","196608:Bsszjfi","196608:sszjfis","196608:szjfisj","196608:zjfisjJ","196608:jfisjJi","196608:fisjJiB","196608:isjJiBg","196608:sjJiBg1","196608:jJiBg1p","196608:JiBg1pD","196608:iBg1pDC","196608:Bg1pDCl","196608:g1pDClm","196608:1pDClmM","196608:pDClmMF","196608:DClmMFL","196608:ClmMFLO","196608:lmMFLOA","196608:mMFLOAk","196608:MFLOAkG","196608:FLOAkGk","196608:LOAkGkz","196608:OAkGkzd","196608:AkGkzdn","196608:kGkzdnE","196608:GkzdnEV","196608:kzdnEVo","196608:zdnEVom","196608:dnEVomF","196608:nEVomFH","196608:EVomFHK","196608:VomFHKn","196608:omFHKnP","98304:P44uHi0","98304:44uHi0m","98304:4uHi0mF","98304:uHi0mFi","98304:Hi0mFi+","98304:i0mFi+1","98304:0mFi+1p","98304:mFi+1p+","98304:Fi+1p+F","98304:i+1p+FL","98304:+1p+FLO","98304:1p+FLOy","98304:p+FLOyo","98304:+FLOyom","98304:FLOyomF","98304:LOyomFH","98304:OyomFHK","98304:yomFHKn"],"imphash":"0937a296014c778f116e3990f06e314b"},"file_info":{"file_name":"tmp4oyd7_d9","file_type":["peexe","executable"],"file_type_id":"exe","file_size":7014400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1573066181000,"last_seen":1691477085000,"last_multi_scan":1691477085000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","coinminer","evotob","installmonstr","miner","ramnit","evasive","panda","pandazeus","sheldor","viknok","zbot"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":14,"suspicious_count":10,"malicious_count":3,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win32.Keylogger","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1319025","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.63501535","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.63501535 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Spy.Agent.PUH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 00555d821 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Agent.jvyo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-Injector.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.ghyuap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-BCXS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Keylogger.7014400","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_BI.A98159BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_BI.A98159BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.ERVE-8191","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.1168788","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to read monitor info"},{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameA@SHLWAPI.DLL at 00085407-00001812-64957-369-0045B9E4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00085407-00001812-64957-13-004ACE2B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00085407-00001812-64957-93-004B5077\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00085407-00001812-64957-491-004ADE6A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API DllGetVersion@COMCTL32.DLL at 00085407-00001812-64957-2629-0038FA35","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 2250-35735-00413220\n GetLocalTime@KERNEL32.dll at 2250-35782-004116E0\n GetLocalTime@KERNEL32.dll at 2250-35823-00410020\n GetLocalTime@KERNEL32.dll at 2250-36139-004022D0\n GetLocalTime@KERNEL32.dll at 2250-36145-00404C80\n GetLocalTime@KERNEL32.dll at 2250-36225-00413C00\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00085407-00001812-64957-504-004AE00D\n GetLocalTime@KERNEL32.DLL at 00085407-00001812-64957-1227-00363220\n GetLocalTime@KERNEL32.DLL at 00085407-00001812-64957-1274-003616E0\n GetLocalTime@KERNEL32.DLL at 00085407-00001812-64957-1315-00360020\n GetLocalTime@KERNEL32.DLL at 00085407-00001812-64957-1609-003522D0\n GetLocalTime@KERNEL32.DLL at 00085407-00001812-64957-1615-00354C80\n GetLocalTime@KERNEL32.DLL at 00085407-00001812-64957-1695-00363C00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 2250-35890-0043A45B\n GetVersionExA@KERNEL32.dll at 2250-36114-00427F2C\n GetVersionExA@KERNEL32.DLL at 00085407-00001812-64957-1382-0038A45B\n DllGetVersion@COMCTL32.DLL at 00085407-00001812-64957-2629-0038FA35","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.dll at 2250-36649-0045A49C\n GetUserDefaultUILanguage@KERNEL32.DLL at 00085407-00001812-64957-368-0045B868\n GetUserDefaultUILanguage@KERNEL32.DLL at 00085407-00001812-64957-2117-003AA49C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-000000A0h], 06h\" and \"jc 0043A507h\" at 2250-35890-0043A45B\n Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-000000A0h], 06h\" and \"jne 00428056h\" at 2250-36114-00427F2C\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-000000A0h], 06h\" and \"jc 0038A507h\" at 00085407-00001812-64957-1382-0038A45B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\shared\\C++\\CARATRC\\Release\\CAgent11.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6F690000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\System32\\oleaccrc.dll\"\n \".exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"XXX.XXX.XXX.XXX\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00085407-00001812-64957-503-004ADCC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read monitor info","description":"GetMonitorInfoA@USER32.dll at 2250-35379-0041FB67\n GetMonitorInfoA@USER32.DLL at 00085407-00001812-64957-871-0036FB67\n GetMonitorInfoA@USER32.DLL at 00085407-00001812-64957-2621-0038E080","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\setting.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00085407-00001812-64957-1463-0035A220\n recv@WS2_32.DLL at 00085407-00001812-64957-1546-003569F0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00085407-00001812-64957-1545-00357430","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 2250-36055-00405CB0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00085407-00001812-64957-1547-00355CB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$26","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c04e677720546877e0656877b53869770000000000d0a67500000000c5eaa6750000000088eaa67500000000e968587582286977ee29697700000000d2695875000000007dbba6750000000009be587500000000ba18a67500000000\" to virtual address \"0x777C1000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"d5d9a67530c6a675e0c2a67542c6a67510c6a675acdca675a0dfa67536daa67587f1a6750000000091771f77c0901f777f6f1f771ffa1f77def41f77f2821f77857d1f7700000000\" to virtual address \"0x72CE1000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30.bin\" (Offset: 4653574)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"24/71 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"24/71 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":33,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banker","coinminer","evotob","installmonstr","miner","ramnit","evasive","panda","pandazeus","sheldor","viknok","zbot"],"sandbox_reports":[{"id":"5dc35fc60388387303e46785","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"tmp4oyd7_d9","analysis_start_time":"2019-11-07T00:05:30+00:00","indicators_count":{"informative":13,"suspicious":14,"malicious":4},"is_in_unified_schema":true},{"id":"5dc315c40388384b70e46507","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30","analysis_start_time":"2019-11-06T18:49:56+00:00","indicators_count":{"informative":14,"suspicious":14,"malicious":4},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"}],"processes":[{"pid":1812,"ppid":0,"name":"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30.exe","command_line":"","sha256":"04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30","normalized_path":"C:\\04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30.exe","uid":"00085407-00001812","icon":"$27"}],"all_imported_dlls":["KernelBase.dll","gdi32.dll","advapi32.dll","sechost.dll","oleaut32.dll","rpcss.dll","oledlg.dll","usp10.dll","msimg32.dll","shell32.dll","cryptbase.dll","ws2_32.dll","nsi.dll","oleaccrc.dll","ntdll.dll","ole32.dll","clbcatq.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","user32.dll","lpk.dll","riched20.dll","dwmapi.dll","msvcrt.dll","rpcrt4.dll","shlwapi.dll","comctl32.dll","uxtheme.dll","GdiPlus.dll","oleacc.dll","imm32.dll","kernel32.dll","winmm.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"C:\\Download","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"C:\\History","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"C:\\setting.ini","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"},{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\04D70BB249206A006F83DB39BBE49FF6E520EA329E5FBB9C758D426B1C8DEC30\\","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\04D70BB249206A006F83DB39BBE49FF6E520EA329E5FBB9C758D426B1C8DEC30\\LISTCTRLS\\","sources":[{"report_type":"sandbox","report_id":"5dc315c40388384b70e46507"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\TMP4OYD7_D9\\","sources":[{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\TMP4OYD7_D9\\LISTCTRLS\\","sources":[{"report_type":"sandbox","report_id":"5dc35fc60388387303e46785"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5dc35fc60388387303e46785","5dc315c40388384b70e46507"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 04d70bb24920… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 04d70bb24920…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 04d70bb24920… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 04d70bb24920…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 04d70bb24920… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 04d70bb24920…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]