24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d0ef4dca8279… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d0ef4dca8279…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 10 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T402,"services.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "services.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "services.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "services.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "services.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "services.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "services.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")26:T5a3,"services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\services_RASAPI32" (Filter: 14; Subtree: 2620672) "services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\services_RASAPI32" (Filter: 14; Subtree: 9187072) "services.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 9131008) "services.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 9131008) "services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\services_RASMANCS" (Filter: 14; Subtree: 2620672) "services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\services_RASAPI32" (Filter: 14; Subtree: 9208832) "services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\services_RASMANCS" (Filter: 14; Subtree: 9208832) "services.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 2620673) "services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 2620673) "services.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 4; Subtree: 2620673)27:Tb1c,".exe" wrote bytes "e9bdc95f89" to virtual address "0x776DC74E" ("LdrAccessResource@NTDLL.DLL") ".exe" wrote bytes "e93ac7eaff" to virtual address "0x77830017" ".exe" wrote bytes "e966c7eaff" to virtual address "0x77830005" ".exe" wrote bytes "e910c95f89" to virtual address "0x776DC76B" ("LdrFindResource_U@NTDLL.DLL") ".exe" wrote bytes "e96201ff8a" to virtual address "0x75CE8EB9" ("LoadStringW@USER32.DLL") ".exe" wrote bytes "6c17de7500000000ce128076000000005ed62e7600000000cffdd37500000000f048de75000000004512de757749de755c16de75dc2cde758114de75b079de7500000000" to virtual address "0x00ED1874" (part of module "D0EF4DCA82793B28B195630226CB3CCDF9D257B91C0D6F2F60641DDE0B1427EC.EXE") ".exe" wrote bytes "7111a4017a3ba301ab8b02007f950200fc8c0200729602006cc805001ecda0017d26a001" to virtual address "0x75CE07E4" (part of module "USER32.DLL") ".exe" wrote bytes "e92cdbdfff" to virtual address "0x75EF0005" ".exe" wrote bytes "e9a58edfff" to virtual address "0x75EF0014" ".exe" wrote bytes "c0df6c771cf96b77ccf86b770d646d7700000000c011de7500000000fc3ede7500000000e013de75000000009457fb7425e06c77c6e06c7700000000bc6afa7400000000cf31de75000000009319fb74000000002c32de7500000000" to virtual address "0x75EE1000" (part of module "NSI.DLL") ".exe" wrote bytes "e95ab4fe8a" to virtual address "0x75CEDB31" ("LoadStringA@USER32.DLL") "services.exe" wrote bytes "db4d827300000000" to virtual address "0x00182000" "services.exe" wrote bytes "d055637664736c760000000051c1667594986675ee9c667575dc6875273e68750fb36c75000000008548de756987de750f77e075d917de75ead7df75a934de75f811de752014de754cbce075f516de755414de75ff10de753214de7500000000" to virtual address "0x73681000" (part of module "SHFOLDER.DLL") "services.exe" wrote bytes "7111a4017a3ba301ab8b02007f950200fc8c0200729602006cc805001ecda0017d26a001" to virtual address "0x75CE07E4" (part of module "USER32.DLL") "services.exe" wrote bytes "83808948" to virtual address "0x72F61FFC" (part of module "MSCORWKS.DLL") "services.exe" wrote bytes "7d07707781ed6e77ae866d77c6e06c77effd6f772d166e7760147077478d6d77a8e26c7760896d7700000000ad3761758b2d6175b641617500000000" to virtual address "0x73EC1000" (part of module "WSHTCPIP.DLL") "services.exe" wrote bytes "0efc6f7781ed6e77ae866d77c6e06c77effd6f772d166e77c0fc6b77da8f767760147077478d6d77a8e26c7760896d7700000000ad3761758b2d6175b641617500000000" to virtual address "0x73ED1000" (part of module "WSHIP6.DLL") "services.exe" wrote bytes "c0df6c771cf96b77ccf86b770d646d7700000000c011de7500000000fc3ede7500000000e013de75000000009457fb7425e06c77c6e06c7700000000bc6afa7400000000cf31de75000000009319fb74000000002c32de7500000000" to virtual address "0x75EE1000" (part of module "NSI.DLL")28:T74a,Found malicious artifacts related to "3.232.242.170": ... URL: https://docsend.com/view/yg2cikvskwqqkbg2 (AV positives: 1/93 scanned on 03/20/2022 20:14:04) URL: https://docsend.com/view/7kbaanzkgswcge6a (AV positives: 5/93 scanned on 03/20/2022 01:23:11) URL: https://www.bksgruppen.se/ (AV positives: 1/93 scanned on 03/19/2022 11:51:27) URL: http://bis.vidazoo.com/ (AV positives: 1/93 scanned on 03/18/2022 14:34:21) URL: https://click.getfeedback-cx.com/f/a/_p8b-aM9MshMeHF9V5VMsA~~/AAOPSAA~/RgRkFeuIP0QcaHR0cHM6Ly93d3cuZGFuaWVsc2hlYWx0aC5jYVcDc3BjQgpiKrFmM2Ju0np2Uhxtd2lrdG9yb3dpY3pAbW9oYXdrbWVkYnV5LmNhWAQAAA5D (AV positives: 1/93 scanned on 03/17/2022 17:06:41) File SHA256: f89dd765da63918dfa0c00ebfee562691d08503d50c48ca1dc06b77b63c46c6d (Date: 03/21/2022 09:56:10) File SHA256: a0ba28a44fdb34400495d8635ab608be85ff0ed9087be8d6c96525fe4a7d4bbe (Date: 03/21/2022 04:05:30) File SHA256: a61decba475226d1bb85e7ed2e9c29c589b593f60362c2132ead5e5f10e3d1a0 (Date: 03/20/2022 00:58:55) File SHA256: 813d0f328d45de03cd7951685100a2edd2c8a55d8b68ab1cb4a24ce74478aa7f (Date: 03/20/2022 00:56:26) File SHA256: eac4af2494693af3873a994aa64ffb339277c30d29e0a54c13d9a2af02ea9f35 (Date: 03/19/2022 21:52:00) File SHA256: 9f74ba71916c2d2cdd446328a7eac34d7d605e780cf08af7b5798a6e935377cd (AV positives: 1/70 scanned on 02/06/2022 14:29:56) File SHA256: bad2465ab8150172b62923cd150ec8e79a6b6102a971467e82c3a154458c5ab9 (AV positives: 1/73 scanned on 02/03/2022 02:54:20) File SHA256: 60600502c32065b6609902b908023dad3a06cee84160a88fdc6680ab203923f5 (AV positives: 1/71 scanned on 11/18/2021 00:53:35) File SHA256: 72291c82daac881a95bed34a2882ef18a293843490c7d003cb02f109c80f8501 (AV positives: 18/74 scanned on 09/01/2021 07:36:36) File SHA256: 069593f5e2524218db07a62112c5f73251209d39867b6ccece766df39ebae385 (AV positives: 2/73 scanned on 03/26/2021 06:01:49)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790796372855,"unified_at":"2026-09-30T19:26:12.855Z","metadata":{"hashes":{"sha256":"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec","sha1":"e9d750a3e2082fd0475decde25096fa1d477d086","md5":"070f0390aad17883cc8fad2dc8bc81ba","sha512":"81fd7e9bf59da644d409ab5032a79049d9aa8529d377f8754367c3b586cfede12fc3caca5905a0313dd1655775fb9aa139a044e346bd5dc7fea703113567a283","ssdeep":"24576:swxEuK9mmCqVar92/s9eSROB5SYdmbTpAjgpOFa73y1YS:BxEuKg+A4B5SYdUW8J","ssdeep_chunks":["24576:swxEuK9","24576:wxEuK9m","24576:xEuK9mm","24576:EuK9mmC","24576:uK9mmCq","24576:K9mmCqV","24576:9mmCqVa","24576:mmCqVar","24576:mCqVar9","24576:CqVar92","24576:qVar92/","24576:Var92/s","24576:ar92/s9","24576:r92/s9e","24576:92/s9eS","24576:2/s9eSR","24576:/s9eSRO","24576:s9eSROB","24576:9eSROB5","24576:eSROB5S","24576:SROB5SY","24576:ROB5SYd","24576:OB5SYdm","24576:B5SYdmb","24576:5SYdmbT","24576:SYdmbTp","24576:YdmbTpA","24576:dmbTpAj","24576:mbTpAjg","24576:bTpAjgp","24576:TpAjgpO","24576:pAjgpOF","24576:AjgpOFa","24576:jgpOFa7","24576:gpOFa73","24576:pOFa73y","24576:OFa73y1","24576:Fa73y1Y","24576:a73y1YS","49152:swxEuK9","49152:wxEuK9m","49152:xEuK9mm","49152:EuK9mmC","49152:uK9mmCq","49152:K9mmCqV","49152:9mmCqVa","49152:mmCqVar","49152:mCqVar9","49152:CqVar92","49152:qVar92/","49152:Var92/s","49152:ar92/s9","49152:r92/s9e","49152:92/s9eS","49152:2/s9eSR","49152:/s9eSRO","49152:s9eSROB","49152:9eSROB5","49152:eSROB5S","49152:SROB5SY","49152:ROB5SYd","49152:OB5SYdm","49152:B5SYdmb","49152:5SYdmbT","49152:SYdmbTp","49152:YdmbTpA","49152:dmbTpAj","49152:mbTpAjg","49152:bTpAjgp","49152:TpAjgpO","49152:pAjgpOF","49152:AjgpOFa","49152:jgpOFa7","49152:gpOFa73","49152:pOFa73y","49152:OFa73y1","49152:Fa73y1Y","49152:a73y1YS","24576:BxEuKg+","24576:xEuKg+A","24576:EuKg+A4","24576:uKg+A4B","24576:Kg+A4B5","24576:g+A4B5S","24576:+A4B5SY","24576:A4B5SYd","24576:4B5SYdU","24576:B5SYdUW","24576:5SYdUW8","24576:SYdUW8J"],"imphash":"054b422ab7ba29a1cb4e84bbcce56642"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1173504,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1643534532000,"last_seen":1695385948000,"last_multi_scan":1695385948000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["obfuscated","evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":21,"suspicious_count":10,"malicious_count":10,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win.XRat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.Quasar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.103732","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.103732 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Kimsuky.BC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0058da841 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.MSIL.Quasar.llw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-kimsuky.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/VMProtBad-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Backdoo.06CCC67A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Backdoo.06CCC67A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Malware-Cryptor.SB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kimsuky.Win32.92","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"malicious","value":"PE file is protected by VMProtect"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"services.exe\" at 00000000-00001668-00000033-14502157289550940","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"services.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"services.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"services.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"telize.com\"\n \"www.telize.com\"\n \"freegeoip.net\"\n \"api.ipify.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"88.198.193.213:80\"\n \"104.26.15.73:80\"\n \"3.232.242.170:80\"\n \"45.77.71.50:8082\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"\\Sessions\\1\\BaseNamedObjects\\7LkqEfJ4sGlXt1Anc7\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"\n \"7LkqEfJ4sGlXt1Anc7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /geoip HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: telize.com\nConnection: Keep-Alive\"\n \"GET /geoip HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: www.telize.com\nConnection: Keep-Alive\"\n \"GET /xml/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: freegeoip.net\nConnection: Keep-Alive\"\n \"GET /shutdown HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: freegeoip.net\"\n \"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: api.ipify.org\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"services.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\199dd46435d7fdbbe590cccd8c8ae9cb\\mscorlib.ni.dll\" at 72460000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"services.exe\" (UID: 00000000-00001668) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"services.exe\" (UID: 00000000-00001668) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"services.exe\" (UID: 00000000-00001668)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"services.exe\" (UID: 00000000-00001668)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$26","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config\"\n \"services.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"telize.com\"\n Pattern match: \"www.telize.com\"\n Heuristic match: \"freegeoip.net\"\n Heuristic match: \"GET /shutdown HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: freegeoip.net\"\n Heuristic match: \"api.ipify.org\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"services.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"services.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00002496-00000033-2754174","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".vmp1 with unusual entropies 7.88582034858","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"54/71 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 88.198.193.213 on port 80 is sent without HTTP header\n TCP traffic to 104.26.15.73 on port 80 is sent without HTTP header\n TCP traffic to 3.232.242.170 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"LdrAccessResource@NTDLL.DLL\" in \".exe\"\n \"LdrFindResource_U@NTDLL.DLL\" in \".exe\"\n \"LoadStringW@USER32.DLL\" in \".exe\"\n \"LoadStringA@USER32.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec.bin\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetModuleHandleA\n GetModuleFileNameW\n GetModuleFileNameA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"services.exe\" at non-system pathway \"%ALLUSERSPROFILE%\\cp1093\\services.exe\" (UID: 00000000-00001668)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"services.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00001668)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Environment Awareness","name":"PE file is protected by VMProtect","description":"\"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec.bin\" has a section named \".vmp0\"\n \"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec.bin\" has a section named \".vmp1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":7,"id":"static-74","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"54/71 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%ALLUSERSPROFILE%\\cp1093\\services.exe\" (Handle: 168)\n \".exe\" wrote 52 bytes to a remote process \"%ALLUSERSPROFILE%\\cp1093\\services.exe\" (Handle: 168)\n \".exe\" wrote 4 bytes to a remote process \"%ALLUSERSPROFILE%\\cp1093\\services.exe\" (Handle: 168)\n \".exe\" wrote 8 bytes to a remote process \"%ALLUSERSPROFILE%\\cp1093\\services.exe\" (Handle: 168)\n \".exe\" wrote 278528 bytes to a remote process \"%ALLUSERSPROFILE%\\cp1093\\services.exe\" (Handle: 168)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file is protected by VMProtect"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["obfuscated","evasive"],"sample_flags":["Multi-Process","Network Traffic","Sample not shared"],"sandbox_reports":[{"id":"623865bf26a64003a33e5cc5","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MSIL.Quasar.l","contacted_countries":["DEU","USA"],"submit_name":"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec","analysis_start_time":"2022-03-21T11:47:22+00:00","indicators_count":{"informative":21,"suspicious":14,"malicious":13},"tags":["Multi-Process","Network Traffic","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"88.198.193.213","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"address":"104.26.15.73","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"address":"3.232.242.170","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"address":"45.77.71.50","port":8082,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"3.232.242.170","country":"United States","registrar_name":"eNom, Inc.","registrar_name_servers":"NS1.DNSIMPLE.COM","registrar_creation_date":"2014-01-05T22:02:15+00:00","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"domain":"freegeoip.net","address":"104.26.15.73","country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"JEROME.NS.CLOUDFLARE.COM","registrar_creation_date":"2009-08-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"domain":"telize.com","address":"88.198.193.213","country":"Germany","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"domain":"www.telize.com","address":"88.198.193.213","country":"Germany","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}],"http_requests":[{"host":"telize.com","host_ip":"88.198.193.213:80","url":"/geoip","method":"GET","header":"GET /geoip HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: telize.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"host":"freegeoip.net","host_ip":"104.26.15.73:80","url":"/xml/","method":"GET","header":"GET /xml/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: freegeoip.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"host":"freegeoip.net","host_ip":"104.26.15.73:80","url":"/shutdown","method":"GET","header":"GET /shutdown HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: freegeoip.net","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"host":"api.ipify.org","host_ip":"3.232.242.170:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0\nHost: api.ipify.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}],"processes":[{"pid":2496,"ppid":0,"name":"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec.exe","command_line":"","sha256":"d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec","normalized_path":"C:\\d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec.exe","uid":"00000000-00002496","icon":"$29"},{"pid":1668,"ppid":2496,"name":"services.exe","command_line":"","sha256":"f2d60c0f8688f3036bdc48c37f93b204bed596b8707a5f96c9bc69e8cb6efeab","normalized_path":"%ALLUSERSPROFILE%\\cp1093\\services.exe","parent_uid":"00000000-00002496","uid":"00000000-00001668"}],"all_imported_dlls":["System.Runtime.Serialization.ni.dll","sechost.dll","advapi32.dll","mscoreei.dll","msvcr80.dll","shell32.dll","mscoree.dll","mscorjit.dll","mswsock.dll","WSHTCPIP.DLL","uxtheme.dll","System.Windows.Forms.dll","ntdsapi.dll","rpcrt4.dll","wow64.dll","wow64win.dll","shlwapi.dll","mscorwks.dll","winhttp.dll","user32.dll","api-ms-win-core-synch-l1-2-0.dll","System.Drawing.ni.dll","shfolder.dll","WMINet_Utils.dll","dhcpcsvc6.dll","msvcrt.dll","System.ServiceModel.Web.ni.dll","rtutils.dll","nsi.dll","tzres.dll","cryptsp.dll","ntdll.dll","usp10.dll","System.Management.ni.dll","System.Configuration.ni.dll","clbcatq.dll","System.Xml.ni.dll","bcrypt.dll","System.Core.ni.dll","wow64cpu.dll","KernelBase.dll","imm32.dll","msctf.dll","ws2_32.dll","wbemcomn.dll","System.ServiceModel.ni.dll","sspicli.dll","apphelp.dll","version.dll","mscorlib.ni.dll","rasman.dll","wship6.dll","rsaenh.dll","System.Windows.Forms.ni.dll","fastprox.dll","ole32.dll","profapi.dll","winnsi.dll","dhcpcsvc.dll","dnsapi.dll","cryptbase.dll","kernel32.dll","wbemprox.dll","wbemsvc.dll","RpcRtRemote.dll","rasapi32.dll","FWPUCLNT.DLL","lpk.dll","System.ni.dll","SMDiagnostics.ni.dll","credssp.dll","rasadhlp.dll","wmiutils.dll","webio.dll","IPHLPAPI.DLL","gdi32.dll","oleaut32.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\7LkqEfJ4sGlXt1Anc7","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]},{"name":"7LkqEfJ4sGlXt1Anc7","sources":[{"report_type":"sandbox","report_id":"623865bf26a64003a33e5cc5"}]}]}},"report_ids":{"sandbox_job_ids":["623865bf26a64003a33e5cc5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample d0ef4dca8279… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d0ef4dca8279…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 10 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample d0ef4dca8279… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d0ef4dca8279…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 10 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d0ef4dca82793b28b195630226cb3ccdf9d257b91c0d6f2f60641dde0b1427ec"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample d0ef4dca8279… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d0ef4dca8279…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 10 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]