26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample 0468270bb741… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0468270bb741…. Malware family: Yogi.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250"],"about":{"@type":"SoftwareApplication","name":"0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250","applicationCategory":["peexe","executable"],"identifier":"0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":8,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1208,"UPDATE LoaiTaiSan SET SoHieu='2111'+Right(SoHieu,Len(SoHieu)-3) WHERE SoHieu LIKE '211*'" (Source: sample.bin, Indicator: "update loaitaisan set sohieu='2111'+right(sohieu,len(sohieu)-3) where sohieu like '211*'"), "SELECT MaSo, SoHieu FROM Vattu" (Source: sample.bin, Indicator: "select maso, sohieu from vattu"), "SELECT DISTINCTROW Count(MaSo) As F1 FROM HethongTK WHERE TKCha0 = " (Source: sample.bin, Indicator: "select distinctrow count(maso) as f1 from hethongtk where tkcha0 = "), "SELECT TOP 1 MaSo AS F1 FROM HethongTK WHERE SoHieu LIKE '632*' AND TKCon=0 ORDER BY SoHieu" (Source: sample.bin, Indicator: "select top 1 maso as f1 from hethongtk where sohieu like '632*' and tkcon=0 order by sohieu"), "SELECT DISTINCTROW TenKho AS F1, MaSo AS F2 FROM KhoHang WHERE MaSo = " (Source: sample.bin, Indicator: "select distinctrow tenkho as f1, maso as f2 from khohang where maso = "), "SELECT SUM(SoPS) AS F1,SUM(SoPS2No) AS F2 FROM " (Source: sample.bin, Indicator: "select sum(sops) as f1,sum(sops2no) as f2 from "), "SELECT SoHieu FROM Vattu GROUP BY SoHieu" (Source: sample.bin, Indicator: "select sohieu from vattu group by sohieu"), "SELECT * FROM BaoCaoCP ORDER BY Kq3" (Source: sample.bin, Indicator: "select * from baocaocp order by kq3"), "SELECT MaSo AS F1 FROM HethongTK WHERE TKCha0=" (Source: sample.bin, Indicator: "select maso as f1 from hethongtk where tkcha0="), "Select * FROM QTongHop ORDER BY NgayCT,SHCT,MS,MaNVL" (Source: sample.bin, Indicator: "select * from qtonghop order by ngayct,shct,ms,manvl"), "SELECT DISTINCTROW Count(MaSo) As F1 FROM TP154 WHERE MaTK = " (Source: sample.bin, Indicator: "select distinctrow count(maso) as f1 from tp154 where matk = "), "SELECT * FROM BaoCaoCP WHERE Kq3<>0" (Source: sample.bin, Indicator: "select * from baocaocp where kq3<>0"), "INSERT INTO HethongTK (SoHieu,Cap,Ten,Loai,Kieu,TkCha0) VALUES ('136',1,'" (Source: sample.bin, Indicator: "insert into hethongtk (sohieu,cap,ten,loai,kieu,tkcha0) values ('136',1,'"), "SELECT DISTINCTROW ChungTu.MaSo,ChungTu.MaCT,ChungTu.NgayGS,ChungTu.SoHieu,ChungTu.MaKho,ChungTu.SoPS2Co,ChungTu.MaVattu,ChungTu.ThangCT FROM " (Source: sample.bin, Indicator: "select distinctrow chungtu.maso,chungtu.mact,chungtu.ngaygs,chungtu.sohieu,chungtu.makho,chungtu.sops2co,chungtu.mavattu,chungtu.thangct from "), "SELECT TOP 1 MaSo AS F1 FROM HethongTK WHERE TKCon=0 AND SoHieu LIKE '156*' ORDER BY SoHieu" (Source: sample.bin, Indicator: "select top 1 maso as f1 from hethongtk where tkcon=0 and sohieu like '156*' order by sohieu"), "SELECT Sum(TP) AS F1 FROM QChiTiet2 where TRUE" (Source: sample.bin, Indicator: "select sum(tp) as f1 from qchitiet2 where true"), "SELECT MaSo AS F1 FROM DTQLy WHERE Ten='" (Source: sample.bin, Indicator: "select maso as f1 from dtqly where ten='"), "SELECT Sum(KyTruoc) AS F1 FROM LCTT200 WHERE MaSo=1 OR MaSo=22 OR MaSo=24 OR MaSo=26 OR MaSo=27 OR MaSo=31 OR MaSo=33" (Source: sample.bin, Indicator: "select sum(kytruoc) as f1 from lctt200 where maso=1 or maso=22 or maso=24 or maso=26 or maso=27 or maso=31 or maso=33"), "SELECT DISTINCTROW ShVT FROM BKNhomPS WHERE TRUE GROUP BY ShVT" (Source: sample.bin, Indicator: "select distinctrow shvt from bknhomps where true group by shvt"), "UPDATE BaoCao SET KyNay=0, KyTruoc=0 WHERE SoHieu='" (Source: sample.bin, Indicator: "update baocao set kynay=0, kytruoc=0 where sohieu='"), "SELECT PhanLoaiVattu.*,PL.SoHieu AS SHCha,HethongTK.SoHieu AS SHTK FROM (PhanLoaiVattu INNER JOIN HethongTK ON PhanLoaiVattu.MaTK=HethongTK.MaSo) LEFT JOIN PhanLoaiVattu AS PL ON PhanLoaiVattu.PLCha=PL.MaSo ORDER BY PhanLoaiVattu.SoHieu" (Source: sample.bin, Indicator: "select phanloaivattu.*,pl.sohieu as shcha,hethongtk.sohieu as shtk from (phanloaivattu inner join hethongtk on phanloaivattu.matk=hethongtk.maso) left join phanloaivattu as pl on phanloaivattu.plcha=pl.maso order by phanloaivattu.sohieu"), "SELECT MaSo,Sum(DauNam) As DK,Sum(KyTruoc) As KyTr,Sum(KyNay) As KyN FROM KQKD48 WHERE TRUE GROUP BY MaSo ORDER BY MaSo ASC" (Source: sample.bin, Indicator: "select maso,sum(daunam) as dk,sum(kytruoc) as kytr,sum(kynay) as kyn from kqkd48 where true group by maso order by maso asc"), "UPDATE HethongTk SET TkCon=0 WHERE MaSo=" (Source: sample.bin, Indicator: "update hethongtk set tkcon=0 where maso="), "UPDATE Kqkd SET MaSoCha=30 WHERE MaSo=20" (Source: sample.bin, Indicator: "update kqkd set masocha=30 where maso=20"), "DELETE FROM Chungtu WHERE (MaLoai <> 5 AND MaLoai <> 6 AND MaLoai <> 7) AND ThangCT = " (Source: sample.bin, Indicator: "delete from chungtu where (maloai <> 5 and maloai <> 6 and maloai <> 7) and thangct = ")28:Ta44,Found string "SELECT * FROM BaoCaoCP ORDER BY Kq3" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * FROM QTongHop ORDER BY NgayCT,SHCT,MS,MaNVL" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM BaoCaoCP WHERE Kq3<>0" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM CdTs48 WHERE TRUE ORDER BY MaSo ASC" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM DTQLy ORDER BY Ten" (Indicator: "select * from "; Source: "sample.bin"), Found string "INSERT INTO KQKD911 SELECT * FROM KQKD WHERE MaSo<>23" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM BKNhomPS ORDER BY ShVT, NgayGS, MaCT" (Indicator: "select * from "; Source: "sample.bin"), Found string " SELECT * FROM " (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM KQKD911 WHERE MaTK=0 AND MaSo > 10" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM PhanLoaiKhachHang" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM QuocGia ORDER BY Ten" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM KhoHang" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM ThanhPham WHERE MaSo=" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * from KhoHang ORDER BY MASO" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM HethongTK WHERE MaSo=" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM TP154 WHERE MaSo=" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM HethongTK WHERE Cap>0 ORDER BY SoHieu" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM License" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM sys_runtime WHERE Active=True" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM NamTC WHERE Nam<" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM TinhTrang ORDER BY Ten" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM NguonNhapXuat ORDER BY SoHieu" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * from PhanLoaiVattu ORDER BY SoHieu" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM Chungtu WHERE MaSo=" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM " (Indicator: "select * from "; Source: "sample.bin")29:T7ef,Found string "WHERE GV.MaLoai=2 " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE SoPS2No>0 AND MaLoai=1 AND MaVattu>0 " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE CL_CNK < 0 AND Thang = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE TK_ID=" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaCTKT IN " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE ThangCT=" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE (ChungTu.SoPS2No<>0 OR ChungTu.SoPS2Co<>0) " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE ThongSo.MaTS = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaCC IN (" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE CL_NS < 0 AND Thang = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaTKNo = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE TaiSan.MaSo = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE HethongTK.SoHieu LIKE '" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE CapTren = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaTKCo = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE Thang = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaTS IN (" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaSoKho=" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaCT IN " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE PhanLoaiVattu.MaSo=" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE IsNull(ChungTuP.MaSo)" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE HeThongTK.TK_ID = " (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaNT = -1" (Indicator: "where "; Source: "sample.bin"), Found string "WHERE MaVattu=" (Indicator: "where "; Source: "sample.bin")2a:T43e,Heuristic match: ",ctgs),makhc,matp,dvt,user_id,manv,hantt,sh1,t1,tlck,chungtu.ck", Pattern match: "www.tvl.com.vn", Pattern match: "https://www.google.com", Heuristic match: " and (clng(kqkd.shtkno) = 0) and kqkd.shtkco<>'0' group by kqkd.ma", Heuristic match: "mail.hn.vnn.vn", Pattern match: "http://wwp.greenwichmeantime.com/time/scripts/clock-8/runner.php?tz=gmt", Heuristic match: "baotri.tvl@gmail.com", Heuristic match: " and kqkd.shtkno<>'0' and kqkd.shtkco<>'0' group by kqkd.ma", Heuristic match: "tvl.com.vn", Heuristic match: " and (clng(kqkd48.shtkno) = 0) and kqkd48.shtkco<>'0' group by kqkd48.ma", Heuristic match: " group by chungtu.maso, mact, maloai, chungtu.sohieu, thangct, ngayct, ngaygs, manguon, makho, diengiai, matkno, matkco, sops, sops2no, chungtu.sops2co, mavattu, chungtu.ghichu, ct_id, madt, madt1, madt2, madt3, makh, ctgs, makhc, matp, dvt, user_id, manv,", Heuristic match: " group by kqkd.ma", Pattern match: "www.ucdit.vn", Heuristic match: " and kqkd48.shtkno<>'0' and kqkd48.shtkco<>'0' group by kqkd48.ma", Heuristic match: " group by kqkd911.ma"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792822755310,"unified_at":"2026-10-24T06:19:15.310Z","metadata":{"hashes":{"sha256":"0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250","sha1":"b57286ff41cdb86fbceddffde4710efef5f37967","md5":"13229a0a59b336cb3bf3c243d9d5d268"},"file_info":{"file_name":"0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250","file_type":["peexe","executable"],"file_type_id":"exe","file_size":23810048,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792822745000,"last_seen":1792822747000,"last_multi_scan":1792822747000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":17},"sandbox_signatures":{"informative_count":17,"suspicious_count":1,"malicious_count":0,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.83285","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.83285 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanDownloader/VBCode.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.THTH-1510","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Yogi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains SQL queries","description":"$27","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c TZUTIL /s \" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\"), Found string \"cmd.exe /c rundll32.exe shell32.dll,Control_RunDLL timedate.cpl,,/Z \" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SetFocus\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"baotri.tvl@gmail.com\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"software\\microsoft\\windows\\currentversion\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$28","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Microsoft.XMLHTTP\" (Indicator: \"microsoft.xmlhttp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-469","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET GV.DienGiai=\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"SET ChungTu.MaTKNo = TKMap.MaSo\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set as default Database\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"SET ChungTu.MaTKCo = TKMap.MaSo\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"SET DuNo_0=0, DuCo_0=0, DuNT_0=0 \" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"SET ThongSo.KH_NS = \" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$29","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Invalid password\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"AES chunked context not initialized\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-794","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"SMTP\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.google.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"baotri.tvl@gmail.com\" (Indicator: \"@gmail.\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Yogi.Generic Sample 0468270bb741… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0468270bb741…. Malware family: Yogi.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250"}],["$","meta","4",{"property":"og:title","content":"Malicious Yogi.Generic Sample 0468270bb741… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0468270bb741…. Malware family: Yogi.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0468270bb741cf67cbf4b558da6136e195b640be76dd1a440e408c6c61d83250"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Yogi.Generic Sample 0468270bb741… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0468270bb741…. Malware family: Yogi.Generic. Threat score 100/100. 8/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]