24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tool.VNC Sample 28d0e945f064… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 28d0e945f064…. Malware family: Tool.VNC. Threat score 100/100. 15/27 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/28d0e945f0648bed7b7b2a2139f2b9bf1901feec39ff4f6c0315fa58e054f44e","keywords":["Malicious","Tool.VNC","malware analysis","sandbox report","threat intelligence","28d0e945f0648bed7b7b2a2139f2b9bf1901feec39ff4f6c0315fa58e054f44e"],"about":{"@type":"SoftwareApplication","name":"CamPackHack for dark-time.com.7z.exe","applicationCategory":["peexe","executable"],"identifier":"28d0e945f0648bed7b7b2a2139f2b9bf1901feec39ff4f6c0315fa58e054f44e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tool.VNC","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4a3,"%-15s:%-7d vnc4:VULNERABLE" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d vnc4:VULNERABLE" (Indicator for product: Generic VNC) "%-15s:%-7d vnc4:patched" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d vnc4:patched" (Indicator for product: Generic VNC) "%-15s:%-7d vnc4:banned" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d vnc4:banned" (Indicator for product: Generic VNC) "%-15s:%-7d vnc4:nothing received" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d vnc4:nothing received" (Indicator for product: Generic VNC) "RFB 003.008" (Indicator for product: RealVNC) "%-15s:%-7d vnc4:license expired" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d vnc4:license expired" (Indicator for product: Generic VNC) "%-15s:%-7d not_vnc4:wrong datas" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d not_vnc4:wrong datas" (Indicator for product: Generic VNC) "%-15s:%-7d not_vnc4:nothing received" (Indicator for product: Generic VNC) "-vn:%-15s:%-7d not_vnc4:nothing received" (Indicator for product: Generic VNC) "|___-cT___|___-vnc___|" (Indicator for product: Generic VNC) ". VNC_bypauth -vnc" (Indicator for product: Generic VNC)26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"28d0e945f0648bed7b7b2a2139f2b9bf1901feec39ff4f6c0315fa58e054f44e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790331623091,"unified_at":"2026-09-25T10:20:23.091Z","metadata":{"hashes":{"sha256":"28d0e945f0648bed7b7b2a2139f2b9bf1901feec39ff4f6c0315fa58e054f44e","sha1":"0365fe05e2de0f327dfaa8cd0d988dbb7b379612","md5":"a4cddfaa5a1fc2abf8a920bee84ce8e3","sha512":"3ef1bbbeacfe5b6bd8f1a0752806d01acba98e7c6998b586a2adf6cc70aee9f5e9a888198580d78e26853095f9b7387f98510ee3f3d738fb30ad9bfff911aac1","ssdeep":"384:opg6998lnEtjj0E8rKABwlGUrXczj/gdtn4:ohUnEmX2ABgragdtn4","ssdeep_chunks":["384:opg6998","384:pg6998l","384:g6998ln","384:6998lnE","384:998lnEt","384:98lnEtj","384:8lnEtjj","384:lnEtjj0","384:nEtjj0E","384:Etjj0E8","384:tjj0E8r","384:jj0E8rK","384:j0E8rKA","384:0E8rKAB","384:E8rKABw","384:8rKABwl","384:rKABwlG","384:KABwlGU","384:ABwlGUr","384:BwlGUrX","384:wlGUrXc","384:lGUrXcz","384:GUrXczj","384:UrXczj/","384:rXczj/g","384:Xczj/gd","384:czj/gdt","384:zj/gdtn","384:j/gdtn4","768:opg6998","768:pg6998l","768:g6998ln","768:6998lnE","768:998lnEt","768:98lnEtj","768:8lnEtjj","768:lnEtjj0","768:nEtjj0E","768:Etjj0E8","768:tjj0E8r","768:jj0E8rK","768:j0E8rKA","768:0E8rKAB","768:E8rKABw","768:8rKABwl","768:rKABwlG","768:KABwlGU","768:ABwlGUr","768:BwlGUrX","768:wlGUrXc","768:lGUrXcz","768:GUrXczj","768:UrXczj/","768:rXczj/g","768:Xczj/gd","768:czj/gdt","768:zj/gdtn","768:j/gdtn4","384:ohUnEmX","384:hUnEmX2","384:UnEmX2A","384:nEmX2AB","384:EmX2ABg","384:mX2ABgr","384:X2ABgra","384:2ABgrag","384:ABgragd","384:Bgragdt","384:gragdtn","384:ragdtn4"],"imphash":"8715dec08c11992a99f8aa2a844397f6"},"file_info":{"file_name":"CamPackHack for dark-time.com.7z.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":32768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286902000,"last_seen":1689257001000,"last_multi_scan":1689257001000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":2,"suspicious_count":5,"malicious_count":4,"total":11},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-AppCare/Vnc.32768","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"HackTool[NetTool]/Win32.VNC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Hacktool.Vncpass.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"ApplicUnsaf.Win32.NetTool.VNC.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/NetTool.VNC.A potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!FD11A06AECD2682A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"RemoteTool ( 004a4ec01 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent.tesyby","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/VNCScan-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Spy/W32.Vnc.32768","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Tool.PPKE-1202","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Tool.VNC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.VNC.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Tool.VNC","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"CamPackHack for dark-time.com.7z.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00017770-00003284-48538-27-004022CA","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \". VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.50.1-192.168.60.1,...\"\n Heuristic match: \". VNC_bypauth -i 192.168.0.1-192.168.0.10,192.168.50.1-192.168.55.1,...\"\n Heuristic match: \". VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,...\"\n Heuristic match: \". VNC_bypauth -i 192.168.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"$25","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n recv (Ordinal #16)\n connect (Ordinal #4)\n socket (Ordinal #23)\n send (Ordinal #19)\n closesocket (Ordinal #3)\n WSAStartup (Ordinal #115)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/61 Antivirus vendors marked sample as malicious (78% detection rate)\n 25/40 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/61 Antivirus vendors marked sample as malicious (78% detection rate)\n 25/40 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"62/84 Antivirus vendors marked spawned process \"\" (PID: 3284) as malicious (classified as \"NetTool.VNC\" with 73% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59182964343bbeae9505cfb4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"CN_Tools_Vscan\" matched file \"CamPackHack for dark-time.com.7z.exe.bin\" as \"Chinese Hacktool Set - file Vscan.exe\" based on indicators: \"[+] Usage: VNC_bypauth