24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0753f8a7ae38… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0753f8a7ae38…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5"],"about":{"@type":"SoftwareApplication","name":"malware_20180110","applicationCategory":["peexe","executable"],"identifier":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb7a,Found string "GetLastActivePopup" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: USER32.DLL) Found string "CloseHandle" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThread" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "CreateProcessW" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNEL32.DLL) Found string "WriteFile" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "CreateFileW" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "GetTempPathW" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNEL32.DLL) Found string "GlobalUnlock" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNEL32.DLL) Found string "SizeofResource" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "LoadResource" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "FindResourceW" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNEL32.DLL) Found string "GetModuleHandleW" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "DeleteFileW" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "GetFileSize" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "GetCurrentThreadId" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "GetTickCount" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: 0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.bin, API is part of module: KERNELBASE.DLL)26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790334674322,"unified_at":"2026-09-25T11:11:14.322Z","metadata":{"hashes":{"sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","sha1":"f9a090dbbf2985d8a082fea6da490e8a952fce9b","md5":"b80aa583591eaf758fd95ab4ea7afe39","sha512":"d235cfc38f1524133bdd2dfab495d2590d63b1b17229c846ba6a5cc3013a9260602b8ccc057478e90b8e2b3dab30c002b8e0142da88c6e40987cfbfe3ee5934b","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"malware_20180110","file_type":["peexe","executable"],"file_type_id":"exe","file_size":311296,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1515577751000,"last_seen":1643056444000,"last_multi_scan":1643056444000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["gop","gopwiper","guardianofpeace","operationtroy","silentchollima","targeted","whoisteam","apt","shamoon"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":7,"suspicious_count":12,"malicious_count":4,"total":23},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Destroyer.311296","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Destover","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1140458","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Dropper.116","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.NGUK-3806","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Dropper.116 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/NukeSped.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!B6622F86B96CE1B8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Destover","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Destover.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-Wiper","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MLW.dnkqfe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Destover-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Backdoor.Destover","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Destover.311296","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_WIPALL.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_WIPALL.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.ALEI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Destover","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00065122-00003240) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \".exe\" (UID: 00065122-00003240) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" with commandline \"-i\" (UID: 00065122-00003240)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" with commandline \"-i\" (UID: 00065122-00003240)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe\", Handle: 160)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"212.31.102.100\"\n \"58.185.154.99\"\n \"200.87.126.116\"\n Heuristic match: \"\\\\172.20.10.117\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$25","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c0dfb3771cf9b277ccf8b2770d64b47700000000c011a17500000000fc3ea17500000000e013a1750000000094579c7525e0b377c6e0b37700000000bc6a9b7500000000cf31a1750000000093199c75000000002c32a17500000000\" to virtual address \"0x75F61000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"71115f027a3b5e02ab8b02007f950200fc8c0200729602006cc805001ecd5b027d265b02\" to virtual address \"0x755A07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/72 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/72 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"58/72 Antivirus vendors marked spawned process \".exe\" (PID: 3240) as malicious (classified as \"Trojan.Destover\" with 80% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe\" (Handle: 160)\n \".exe\" wrote 52 bytes to a remote process \"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe\" (Handle: 160)\n \".exe\" wrote 4 bytes to a remote process \"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe\" (Handle: 160)\n \".exe\" wrote 8 bytes to a remote process \"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe\" (Handle: 160)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00023312-00002484-7664-341-00408A74\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00023774-00002544-13766-341-00408A74","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00023312-00002484-7664-1-00404994\n GetVersionExA@KERNEL32.DLL at 00023312-00002484-7664-156-00406A56\n GetVersion@KERNEL32.DLL at 00023774-00002544-13766-1-00404994\n GetVersionExA@KERNEL32.DLL at 00023774-00002544-13766-156-00406A56","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00023312-00002484-7664-90-00401A90\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00023774-00002544-13766-90-00401A90","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.DLL at 00023312-00002484-7664-133-00403660\n OpenServiceW@ADVAPI32.DLL at 00023312-00002484-7664-97-00402030\n OpenServiceW@ADVAPI32.DLL at 00023774-00002544-13766-133-00403660\n OpenServiceW@ADVAPI32.DLL at 00023774-00002544-13766-97-00402030","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.DLL at 00023312-00002484-7664-176-00403100\n CreateProcessAsUserW@ADVAPI32.DLL at 00023774-00002544-13766-176-00403100","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.98851493287","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 00023312-00002484-7664-50-00401500\n LoadResource@KERNEL32.DLL at 00023312-00002484-7664-116-00401DC0\n LoadResource@KERNEL32.DLL at 00023312-00002484-7664-119-00402E20\n SizeofResource@KERNEL32.DLL at 00023774-00002544-13766-50-00401500\n LoadResource@KERNEL32.DLL at 00023774-00002544-13766-116-00401DC0\n LoadResource@KERNEL32.DLL at 00023774-00002544-13766-119-00402E20","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CREATE_SERVICE\" (0x2)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"StartServiceW\n StartServiceCtrlDispatcherW\n StartServiceA\n CreateProcessAsUserW\n CreateServiceW\n GetDriveTypeW\n GetFileAttributesW\n GetTempPathW\n CopyFileW\n GetModuleFileNameW\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n CreateThread\n TerminateProcess\n LoadLibraryW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n DeleteFileW\n GetProcAddress\n WriteFile\n FindNextFileW\n GetComputerNameA\n FindFirstFileW\n CreateFileW\n CreateFileA\n GetCommandLineA\n GetModuleHandleW\n FindResourceW\n CreateProcessW\n Sleep\n VirtualAlloc\n socket\n send\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["gop","gopwiper","guardianofpeace","operationtroy","silentchollima","targeted","whoisteam","apt","shamoon"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"5fbc6c3acefe0f6c287a1be3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":99,"malware_family":"Trojan.Destover","submit_name":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe","analysis_start_time":"2020-11-24T02:13:17+00:00","indicators_count":{"informative":3,"suspicious":6,"malicious":5},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"5a55dd1d7ca3e1641c75aa15","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Destover","submit_name":"malware_20180110","analysis_start_time":"2018-01-10T10:42:41+00:00","indicators_count":{"informative":5,"suspicious":11,"malicious":5},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"}],"processes":[{"pid":2840,"ppid":0,"name":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe","command_line":"","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe","uid":"00064930-00002840","icon":"$26"},{"pid":3240,"ppid":2840,"name":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe","command_line":"-i","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe","parent_uid":"00064930-00002840","uid":"00065122-00003240"}],"all_imported_dlls":["rpcrt4.dll","netapi32.dll","apphelp.dll","advapi32.dll","cryptbase.dll","srvcli.dll","KernelBase.dll","shell32.dll","ws2_32.dll","userenv.dll","wow64win.dll","lpk.dll","msctf.dll","user32.dll","sspicli.dll","netutils.dll","ntdll.dll","kernel32.dll","msvcrt.dll","profapi.dll","wow64.dll","usp10.dll","shlwapi.dll","imm32.dll","wkscli.dll","sechost.dll","nsi.dll","gdi32.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c3acefe0f6c287a1be3"},{"report_type":"sandbox","report_id":"5a55dd1d7ca3e1641c75aa15"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a55dd1d7ca3e1641c75aa15","5fbc6c3acefe0f6c287a1be3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0753f8a7ae38… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0753f8a7ae38…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0753f8a7ae38… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0753f8a7ae38…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0753f8a7ae38… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0753f8a7ae38…. Malware family: Trojan.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]