24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Backdoo.80EE6F49 Sample 9bf8e8ac82b8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9bf8e8ac82b8…. Malware family: Backdoo.80EE6F49. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641","keywords":["Malicious","Backdoo.80EE6F49","malware analysis","sandbox report","threat intelligence","9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Backdoo.80EE6F49","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d5,The input sample is signed with a certificate issued by "CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 07:9A:EB:29:5C:8E:27:AC:8D:9B:E7:9C:8B:0A:AF:66:A0:EF:15:DE; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 61:4D:27:1D:91:02:E3:01:69:82:24:87:FD:E5:DE:00:A3:52:B0:1D; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 19:A0:9B:5A:36:F4:DD:99:72:7D:F7:83:C1:7A:51:23:1A:56:C1:17; see report for more information)26:T437,Pattern match: "https://sectigo.com/CPS0C" Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "www.digicert.com1!0" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0"27:T850,".exe" wrote bytes "b8c0157f6fffe0" to virtual address "0x74B911F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74B9139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74B912DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812b974" to virtual address "0x74BA83DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74B91408" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b840137f6fffe0" to virtual address "0x74B91248" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b830127f6fffe0" to virtual address "0x76F91368" (part of module "WS2_32.DLL") ".exe" wrote bytes "4812b974" to virtual address "0x74BA8348" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811b974" to virtual address "0x74BA8368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74B912CC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c04ee3762054e476e065e476b538e5760000000000d0797600000000c5ea79760000000088ea797600000000e968d4748228e576ee29e57600000000d269d474000000007dbb79760000000009bed47400000000ba18797600000000" to virtual address "0x76F61000" (part of module "NSI.DLL") ".exe" wrote bytes "f811b974" to virtual address "0x74BA834C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "60127f6f" to virtual address "0x70F04028" (part of module "WEBIO.DLL") ".exe" wrote bytes "68130000" to virtual address "0x76F91680" (part of module "WS2_32.DLL") ".exe" wrote bytes "4812b974" to virtual address "0x74BA83C0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811b974" to virtual address "0x74BA83E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811b974" to virtual address "0x74BA83C4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812b974" to virtual address "0x74BA8364" (part of module "SSPICLI.DLL")28:Tb91,Found string "FlsGetValue" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "AreFileApisANSI" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "SetLastError" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNEL32.DLL) Found string "VirtualProtect" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "IsBadReadPtr" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNEL32.DLL) Found string "VirtualAlloc" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "VirtualFree" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryA" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNEL32.DLL) Found string "GetProcAddress" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "GetNativeSystemInfo" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNEL32.DLL) Found string "GetProcessHeap" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "LocalAlloc" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "LocalFree" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL) Found string "GetLastError" (Source: 9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin, API is part of module: KERNELBASE.DLL)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790798990039,"unified_at":"2026-09-30T20:09:50.039Z","metadata":{"hashes":{"sha256":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641","sha1":"ec8d7264953b5e9e416b7e8483954d9907278f2f","md5":"48971e0e71300c99bb585d328b08bc88","sha512":"6a664cd56e2201237bb24c148f39db6878e7cb6bb507290144f4cea327989535dbea64db11de398eee822aae56e873126dc95e2abf73642070f5f15c61d9eb19","ssdeep":"12288:VhOHEwPzMEoJ1BpfYYPmrv3l1dxs6GWRGuGTi2euRBFXTnn8HPIRlxhD44ENrYAt:zOHEwPzMEoJ1BpfYYPmrv3l1dxs6GWRz","ssdeep_chunks":["12288:VhOHEwP","12288:hOHEwPz","12288:OHEwPzM","12288:HEwPzME","12288:EwPzMEo","12288:wPzMEoJ","12288:PzMEoJ1","12288:zMEoJ1B","12288:MEoJ1Bp","12288:EoJ1Bpf","12288:oJ1BpfY","12288:J1BpfYY","12288:1BpfYYP","12288:BpfYYPm","12288:pfYYPmr","12288:fYYPmrv","12288:YYPmrv3","12288:YPmrv3l","12288:Pmrv3l1","12288:mrv3l1d","12288:rv3l1dx","12288:v3l1dxs","12288:3l1dxs6","12288:l1dxs6G","12288:1dxs6GW","12288:dxs6GWR","12288:xs6GWRG","12288:s6GWRGu","12288:6GWRGuG","12288:GWRGuGT","12288:WRGuGTi","12288:RGuGTi2","12288:GuGTi2e","12288:uGTi2eu","12288:GTi2euR","12288:Ti2euRB","12288:i2euRBF","12288:2euRBFX","12288:euRBFXT","12288:uRBFXTn","12288:RBFXTnn","12288:BFXTnn8","12288:FXTnn8H","12288:XTnn8HP","12288:Tnn8HPI","12288:nn8HPIR","12288:n8HPIRl","12288:8HPIRlx","12288:HPIRlxh","12288:PIRlxhD","12288:IRlxhD4","12288:RlxhD44","12288:lxhD44E","12288:xhD44EN","12288:hD44ENr","12288:D44ENrY","12288:44ENrYA","12288:4ENrYAt","24576:VhOHEwP","24576:hOHEwPz","24576:OHEwPzM","24576:HEwPzME","24576:EwPzMEo","24576:wPzMEoJ","24576:PzMEoJ1","24576:zMEoJ1B","24576:MEoJ1Bp","24576:EoJ1Bpf","24576:oJ1BpfY","24576:J1BpfYY","24576:1BpfYYP","24576:BpfYYPm","24576:pfYYPmr","24576:fYYPmrv","24576:YYPmrv3","24576:YPmrv3l","24576:Pmrv3l1","24576:mrv3l1d","24576:rv3l1dx","24576:v3l1dxs","24576:3l1dxs6","24576:l1dxs6G","24576:1dxs6GW","24576:dxs6GWR","24576:xs6GWRG","24576:s6GWRGu","24576:6GWRGuG","24576:GWRGuGT","24576:WRGuGTi","24576:RGuGTi2","24576:GuGTi2e","24576:uGTi2eu","24576:GTi2euR","24576:Ti2euRB","24576:i2euRBF","24576:2euRBFX","24576:euRBFXT","24576:uRBFXTn","24576:RBFXTnn","24576:BFXTnn8","24576:FXTnn8H","24576:XTnn8HP","24576:Tnn8HPI","24576:nn8HPIR","24576:n8HPIRl","24576:8HPIRlx","24576:HPIRlxh","24576:PIRlxhD","24576:IRlxhD4","24576:RlxhD44","24576:lxhD44E","24576:xhD44EN","24576:hD44ENr","24576:D44ENrY","24576:44ENrYA","24576:4ENrYAt","12288:zOHEwPz","12288:xs6GWRz"],"imphash":"1513eba25694f99cecbcdc6cb414f6bd"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":609008,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1571149083000,"last_seen":1683529811000,"last_multi_scan":1683529811000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","jeus","labyrinthchollima","nukesped","targeted","downloader"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":7,"suspicious_count":7,"malicious_count":3,"total":17},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Stealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.lnumk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.567005","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.AppleJeus-9880098-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Agent.YLBZ-7698","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"MalCert.A (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/NukeSped.GN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005597f41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Agent.mytqqe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FTLI!48971E0E7130","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypted.gczdoi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/APosT-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Backdoo.80EE6F49","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Backdoo.80EE6F49","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.Win32.182","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Backdoo.80EE6F49","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"},{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 61741-3103-00443A12\n SetUnhandledExceptionFilter@KERNEL32.dll at 61741-4149-00443F27\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040513-00002892-3706-100-00D18F99\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040513-00002892-3706-227-00D13D94\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040513-00002892-3706-1422-00D13A12\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040513-00002892-3706-2097-00D13F27","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 61741-2674-0044CE01\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00040513-00002892-3706-22-00D13FD6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00040513-00002892-3706-1013-00D1CE01","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 61741-2961-00401470\n GetProcessHeap@KERNEL32.dll at 61741-4226-0044F346\n GetProcessHeap@KERNEL32.DLL at 00040513-00002892-3706-1299-00CD1470\n GetProcessHeap@KERNEL32.DLL at 00040513-00002892-3706-2155-00D1F346","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$25","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"},{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00040513-00002892-3706-67-00D1350F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/71 reputation engines marked \"https://www.digicert.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 61741-2911-004108D0\n LoadResource@KERNEL32.dll at 61741-3408-0040BA4B\n LoadResource@KERNEL32.DLL at 00040513-00002892-3706-1249-00CE08D0\n LoadResource@KERNEL32.DLL at 00040513-00002892-3706-1726-00CDBA4B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 61741-2890-00416060\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00040513-00002892-3706-1228-00CE6060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyA\n RegCloseKey\n RegOpenKeyExA\n GetTempPathW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n LoadLibraryExW\n GetModuleHandleA\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n OpenProcess\n GetTickCount\n VirtualProtect\n LoadLibraryA\n Process32Next\n GetFileSize\n Process32First\n CreateDirectoryA\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n FindFirstFileExA\n FindFirstFileA\n CreateFileMappingA\n FindNextFileA\n CreateFileW\n CreateFileA\n LockResource\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n WriteFile\n CreateProcessW\n Sleep\n FindResourceA\n VirtualAlloc\n FindWindowA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"},{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/69 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"},{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/69 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"},{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$28","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6034f566a5a20700dc714e4a"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":24,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","jeus","labyrinthchollima","nukesped","targeted","downloader"],"sample_flags":["Sample not shared"],"sandbox_reports":[{"id":"6034f566a5a20700dc714e4a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Backdoor.Agent","submit_name":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.exe","analysis_start_time":"2021-02-23T12:30:32+00:00","indicators_count":{"informative":1,"suspicious":2,"malicious":4},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"5da5d51a028838c66254e486","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Backdoor.Agent","submit_name":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641","analysis_start_time":"2019-10-15T14:18:13+00:00","indicators_count":{"informative":7,"suspicious":7,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}],"processes":[{"pid":2892,"ppid":0,"name":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.exe","command_line":"","sha256":"9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641","normalized_path":"C:\\9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641.exe","uid":"00040513-00002892","icon":"$29"}],"all_imported_dlls":["winhttp.dll","nsi.dll","gdi32.dll","lpk.dll","webio.dll","ws2_32.dll","msvcr100.dll","user32.dll","sechost.dll","ntdll.dll","msctf.dll","sspicli.dll","usp10.dll","rpcrt4.dll","imm32.dll","kernel32.dll","api-ms-win-core-synch-l1-2-0.dll","KernelBase.dll","msvcrt.dll","advapi32.dll","wow64cpu.dll","wow64win.dll","cryptbase.dll","wow64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5da5d51a028838c66254e486"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6034f566a5a20700dc714e4a","5da5d51a028838c66254e486"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Backdoo.80EE6F49 Sample 9bf8e8ac82b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9bf8e8ac82b8…. Malware family: Backdoo.80EE6F49. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641"}],["$","meta","4",{"property":"og:title","content":"Malicious Backdoo.80EE6F49 Sample 9bf8e8ac82b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9bf8e8ac82b8…. Malware family: Backdoo.80EE6F49. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9bf8e8ac82b8f7c3707eb12e77f94cd0e06a972658610d136993235cbfa53641"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Backdoo.80EE6F49 Sample 9bf8e8ac82b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9bf8e8ac82b8…. Malware family: Backdoo.80EE6F49. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]