34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 42:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T565,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win32_SmartGameBooster_A_potentially_unwanted_application Sample 08d167fca300… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 08d167fca300…. Malware family: Win32_SmartGameBooster_A_potentially_unwanted_application. Threat score 100/100. 2/25 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989","keywords":["Malicious","Win32_SmartGameBooster_A_potentially_unwanted_application","malware analysis","sandbox report","threat intelligence","08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989"],"about":{"@type":"SoftwareApplication","name":"08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989","applicationCategory":["peexe","executable"],"identifier":"08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win32_SmartGameBooster_A_potentially_unwanted_application","antivirusDetections":{"malicious":2,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2314,Found reference to API (Indicator: "Toolhelp32ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiDestroyClassImageList"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "sample.bin"), Found reference to API (Indicator: "getservbyport"; Source: "sample.bin"), Found reference to API (Indicator: "GetAcceptExSockaddrs"; Source: "sample.bin"), Found reference to API (Indicator: "VaultEnumerateItems"; Source: "sample.bin"), Found reference to API (Indicator: "DrawIconEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "getprotobyname"; Source: "sample.bin"), Found reference to API (Indicator: "getservbyname"; Source: "sample.bin"), Found reference to API (Indicator: "WSASetServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "WSASetServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "closesocket"; Source: "sample.bin"), Found reference to API (Indicator: "ntohl"; Source: "sample.bin"), Found reference to API (Indicator: "ntohs"; Source: "sample.bin"), Found reference to API (Indicator: "getsockname"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStartup"; Source: "sample.bin"), Found reference to API (Indicator: "VaultFree"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdW"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdA"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiDrawMiniIcon"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAddressToStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAddressToStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WSACancelAsyncRequest"; Source: "sample.bin"), Found reference to API (Indicator: "WSAIoctl"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; Source: "sample.bin"), Found reference to API (Indicator: "__WSAFDIsSet"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceNextA"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceNextW"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32Next"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncSelect"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetClassImageIndex"; Source: "sample.bin"), Found reference to API (Indicator: "WSAInstallServiceClassA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAInstallServiceClassW"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceBeginA"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetDeviceInstanceIdW"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceBeginW"; Source: "sample.bin"), Found reference to API (Indicator: "WSASetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetClassDescriptionW"; Source: "sample.bin"), Found reference to API (Indicator: "WSACleanup"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32ListNext"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "WSARecvEx"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "inet_ntoa"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "htons"; Source: "sample.bin"), Found reference to API (Indicator: "htonl"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetServByName"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStringToAddressW"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStringToAddressA"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "WSASend"; Source: "sample.bin"), Found reference to API (Indicator: "inet_addr"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetServByPort"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceEnd"; Source: "sample.bin"), Found reference to API (Indicator: "gethostname"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "SetupGetInfDriverStoreLocationW"; Source: "sample.bin"), Found reference to API (Indicator: "VaultOpenVault"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleBaseNameA"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiLoadClassIcon"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "VaultCloseVault"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetHostByName"; Source: "sample.bin"), Found reference to API (Indicator: "gethostbyaddr"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetHostByAddr"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetClassImageList"; Source: "sample.bin"), Found reference to API (Indicator: "getpeername"; Source: "sample.bin"), Found reference to API (Indicator: "WSARemoveServiceClass"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "EnumDeviceDrivers"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; Source: "sample.bin"), Found reference to API (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API (Indicator: "getsockopt"; Source: "sample.bin"), Found reference to API (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetDevicePropertyW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32ListFirst"; Source: "sample.bin"), Found reference to API (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "TransmitFile"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetProtoByName"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API (Indicator: "WSASocketA"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; Source: "sample.bin"), Found reference to API (Indicator: "AcceptEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32First"; Source: "sample.bin"), Found reference to API (Indicator: "getprotobynumber"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "recvfrom"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetProtoByNumber"; Source: "sample.bin"), Found reference to API (Indicator: "ioctlsocket"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetClassDevsW"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassInfoW"; Source: "sample.bin")37:T890,"delete from urls where (last_visit_time <= " (Source: sample.bin, Indicator: "delete from urls where (last_visit_time <= "), "select * from urls" (Source: sample.bin, Indicator: "select * from urls"), "delete from visit_source" (Source: sample.bin, Indicator: "delete from visit_source"), "delete from moz_cookies where host COLLATE NOCASE not in " (Source: sample.bin, Indicator: "delete from moz_cookies where host collate nocase not in "), "delete from cookies where (host_key COLLATE NOCASE not in " (Source: sample.bin, Indicator: "delete from cookies where (host_key collate nocase not in "), "SELECT * FROM Win32_DiskDrive" (Source: sample.bin, Indicator: "select * from win32_diskdrive"), "delete from visits" (Source: sample.bin, Indicator: "delete from visits"), "delete from omni_box_shortcuts" (Source: sample.bin, Indicator: "delete from omni_box_shortcuts"), "delete from visits where (visit_time <= " (Source: sample.bin, Indicator: "delete from visits where (visit_time <= "), "select * from urls where (last_visit_time <= " (Source: sample.bin, Indicator: "select * from urls where (last_visit_time <= "), "delete from moz_historyvisits where (visit_date <= " (Source: sample.bin, Indicator: "delete from moz_historyvisits where (visit_date <= "), "delete from urls" (Source: sample.bin, Indicator: "delete from urls"), "select [sql] from sqlite_master where [type] = 'table' and lower(name) = '" (Source: sample.bin, Indicator: "select [sql] from sqlite_master where [type] = 'table' and lower(name) = '"), "delete from omni_box_shortcuts where (last_access_time <= " (Source: sample.bin, Indicator: "delete from omni_box_shortcuts where (last_access_time <= "), "delete from moz_places where id in (select place_id from moz_historyvisits) and id not in (select fk from moz_bookmarks where fk <>'') and (last_visit_date <= " (Source: sample.bin, Indicator: "delete from moz_places where id in (select place_id from moz_historyvisits) and id not in (select fk from moz_bookmarks where fk <>'') and (last_visit_date <= "), "delete from channel_id where (host COLLATE NOCASE not in " (Source: sample.bin, Indicator: "delete from channel_id where (host collate nocase not in ")38:Tb07,"\Software\Microsoft\Windows\CurrentVersion" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: sample.bin, "\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Game Booster_is1" in Source: sample.bin, "\Software\Wow6432Node\" in Source: sample.bin, "Opera Software\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPC" in Source: sample.bin, "\System\CurrentControlSet\Control\CrashControl" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData" in Source: sample.bin, "\SYSTEM\ControlSet001\Control\Session Manager\Power" in Source: sample.bin, "AVAST Software\Browser\User Data\Default" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "\SYSTEM\CurrentControlSet\Enum\PCIIDE\IDEChannel\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPC AdCleaner" in Source: sample.bin, "\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: sample.bin, "\Software\Microsoft\Internet Explorer\IntelliForms" in Source: sample.bin, "\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare_is1" in Source: sample.bin, "\Software\Microsoft\Internet Explorer\TypedURLs" in Source: sample.bin, "SYSTEM\CurrentControlSet\services\WSearch" in Source: sample.bin, "\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "SYSTEM\CurrentControlSet\Enum\PCIIDE\IDEChannel\" in Source: sample.bin, "\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\" in Source: sample.bin, "\Software\Microsoft\Protected Storage System Provider" in Source: sample.bin, "Opera Software\Opera Stable" in Source: sample.bin, "\SOFTWARE\PCGameBoost\Smart Game Booster" in Source: sample.bin, "\Software\" in Source: sample.bin, "BraveSoftware\Brave-Browser\User Data\Default" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin, "SOFTWARE\WOW6432Node\PCGameBoost\Smart Game Booster" in Source: sample.bin, "SOFTWARE\PCGameBoost\Smart Game Booster" in Source: sample.bin39:T79d,"SalamWeb\User Data\Default" (Indicator: "salamweb\user data") in Source: sample.bin, "\Google\Chrome\User Data\" (Indicator: "google\chrome\user data") in Source: sample.bin, "Vivaldi\User Data\Default\" (Indicator: "vivaldi\user data") in Source: sample.bin, "CryptoTab Browser\User Data\Default" (Indicator: "cryptotab browser\user data") in Source: sample.bin, "Google\Chrome\User Data" (Indicator: "google\chrome\user data") in Source: sample.bin, "Comodo\Dragon\User Data\Default" (Indicator: "comodo\dragon\user data") in Source: sample.bin, "AVAST Software\Browser\User Data\Default" (Indicator: "avast software\browser\user data") in Source: sample.bin, "MapleStudio\ChromePlus\User Data\Default" (Indicator: "maplestudio\chromeplus\user data") in Source: sample.bin, "\Microsoft\Edge\User Data\" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "\Software\Microsoft\Internet Explorer\TypedURLs" (Indicator: "microsoft\internet explorer\typedurls") in Source: sample.bin, "Vivaldi\User Data" (Indicator: "vivaldi\user data") in Source: sample.bin, "Epic Privacy Browser\User Data\Default" (Indicator: "epic privacy browser\user data") in Source: sample.bin, "Microsoft\Edge\User Data" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "Slimjet\User Data\Default" (Indicator: "slimjet\user data") in Source: sample.bin, "Chromium\User Data\Default" (Indicator: "chromium\user data") in Source: sample.bin, "Torch\User Data\Default" (Indicator: "torch\user data") in Source: sample.bin, "CentBrowser\User Data\Default" (Indicator: "centbrowser\user data") in Source: sample.bin, "Google\Chrome SxS\User Data\Default" (Indicator: "google\chrome sxs\user data") in Source: sample.bin, "Yandex\YandexBrowser\User Data\Default" (Indicator: "yandex\yandexbrowser\user data") in Source: sample.bin, "BraveSoftware\Brave-Browser\User Data\Default" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin3a:T4bf,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Module32First" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Process32First" (Indicator: "Process32First"; Source: "sample.bin")3b:T490,"\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Game Booster_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPC" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPC AdCleaner" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin3c:T695,Found reference to API "setsockopt(IP_ADD_MEMBERSHIP)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_RCVBUF)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_MULTICAST_TTL) Invalid address format" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_LINGER)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IPV6_ADD_MEMBERSHIP)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_KEEPALIVE)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_REUSEADDR)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IPPROTO_TCP, TCP_NODELAY)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_SNDBUF)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_EXCLUSIVEADDRUSE)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_BROADCAST)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_MULTICAST_IF)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IPV6_ADD_MEMBERSHIP) Invalid multicast address" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_MULTICAST_TTL)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_ADD_MEMBERSHIP) Invalid address format" (Indicator: "setsockopt"; Source: "sample.bin")3d:T695,Found reference to API "setsockopt(IP_ADD_MEMBERSHIP)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_RCVBUF)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_MULTICAST_TTL) Invalid address format" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_LINGER)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IPV6_ADD_MEMBERSHIP)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_KEEPALIVE)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_REUSEADDR)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IPPROTO_TCP, TCP_NODELAY)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_SNDBUF)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_EXCLUSIVEADDRUSE)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(SO_BROADCAST)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_MULTICAST_IF)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IPV6_ADD_MEMBERSHIP) Invalid multicast address" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_MULTICAST_TTL)" (Indicator: "setsockopt"; Source: "sample.bin"), Found reference to API "setsockopt(IP_ADD_MEMBERSHIP) Invalid address format" (Indicator: "setsockopt"; Source: "sample.bin")3e:T475,Pattern match: "http://f.pcgameboostdrivers.com/drivers/", Pattern match: "https://s1.driverboosterscan.com/worker.php", Pattern match: "http://www.w3.org/2001/xmlschema", Pattern match: "http://www.w3.org/1999/xmlschema", Pattern match: "http://www.w3.org/2001/xmlschema-instance", Pattern match: "https://s2.driverboosterscan.com/worker.php", Heuristic match: "iobit.com", Pattern match: "www.veoh.com\settings.sol", Pattern match: "https://www.pcgameboost.com/appgoto.php", Pattern match: "http://www.w3.org/2000/10/xmlschema", Pattern match: "http://www.w3.org/1999/xmlschema-instance", Pattern match: "http://www.cd4o.com/drivers/wlst/v.json", Pattern match: "https://www.pcgameboost.com/appgoto.php?name=smgb&ver=%s1&lan=%s2&type=%3&to=%s4", Pattern match: "http://schemas.xmlsoap.org/soap/encoding/", Pattern match: "http://ascstats.pcgameboost.com/usage_v3.php", Pattern match: "http://www.borland.com/namespaces/types", Pattern match: "http://www.w3.org/2000/xmlns/", Pattern match: "http://www.w3.org/2000/10/xmlschema-instance", Pattern match: "www.veoh.com\veohwebplayer.sol", Pattern match: "http://ascstats.iobit.com/usage.php"3f:T95c,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "sample.bin"), Found reference to API "Connect: Socket already in use" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "sample.bin"), Found reference to API "Could not bind extended" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "Winsock get socket name failed - " (Indicator: " socket "; Source: "sample.bin"), Found reference to API " Winsock Send failed - " (Indicator: " send "; Source: "sample.bin"), Found reference to API " Dup accepting accepted socket = " (Indicator: " socket "; Source: "sample.bin"), Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "sample.bin"), Found reference to API "TWSocket will connect to " (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Make system shutdown faster" (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "sample.bin"), Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "sample.bin"), Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "sample.bin"), Found reference to API "Could not bind integer" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "gethostname" (Indicator: "gethostname"; Source: "sample.bin"), Found reference to API "Could not bind int64" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "Could not bind boolean" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API "Could not bind BLOB" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API "Cannot connect to our server. Please check your network/proxy settings and try again." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Could not bind null" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "Could not bind text" (Indicator: " bind "; Source: "sample.bin"), Found reference to API " Bandwidth Paused on send " (Indicator: " send "; Source: "sample.bin"), Found reference to API "Bind socket failed - " (Indicator: " socket "; Source: "sample.bin")40:T540,Found string "\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Game Booster_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPC" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPC AdCleaner" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "sample.bin")41:T4e9,Found string "Can't read add private key to context" (Indicator: "private key"; Source: "sample.bin"), Found string "Expected a Base64 encoded PEM private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Can't add private key to context" (Indicator: "private key"; Source: "sample.bin"), Found string "Error reading private key from " (Indicator: "private key"; Source: "sample.bin"), Found string "Error writing private key to " (Indicator: "private key"; Source: "sample.bin"), Found string "Public Key: " (Indicator: "public key"; Source: "sample.bin"), Found string "Can't load private key from Engine" (Indicator: "private key"; Source: "sample.bin"), Found string "Can't load private key file "" (Indicator: "private key"; Source: "sample.bin"), Found string "Private key not assigned" (Indicator: "private key"; Source: "sample.bin"), Found string "Certificate and private key do not match from " (Indicator: "private key"; Source: "sample.bin"), Found string "Failed to read encoded PEM private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Can't read private key lines" (Indicator: "private key"; Source: "sample.bin"), Found string "Can't use private key" (Indicator: "private key"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793882077286,"unified_at":"2026-11-05T12:34:37.286Z","metadata":{"hashes":{"sha256":"08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989","sha1":"0d301a55753ae2cd98357e3ffa0fcb18a2d448cf","md5":"2978b59e8f4be50389b3a6256837b78a"},"file_info":{"file_name":"08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5511736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793882069000,"last_seen":1793882070000,"last_multi_scan":1793882070000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":46},"sandbox_signatures":{"informative_count":65,"suspicious_count":13,"malicious_count":0,"total":78},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win32_SmartGameBooster_A_potentially_unwanted_application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/SmartGameBooster.A potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win32_SmartGameBooster_A_potentially_unwanted_application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"informative","value":"Contains ability to query sqlite firefox history"},{"type":"suspicious","value":"Able to retrieve browser history information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Able to access Windows Vault"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"},{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","identifiers":[{"type":"suspicious","value":"Able to modify scheduled task(s)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"},{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"YARA signature match - DES algorithm (S-box)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on DES file \"sample.bin\", YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - DES algorithm (S-box)","description":"YARA signature for S-box in DES algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"CreateFileMapping = 0,GetLastError=\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\"), Found reference to API \"OpenFileMapping error,GetLastError=\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMapping > 0,GetLastError = ERROR_ALREADY_EXISTS\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMapping = 0,GetLastError=\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMapping > 0,GetLastError = ERROR_ALREADY_EXISTS\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$37","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: \" (Indicator: \"user-agent: \"; Source: \"sample.bin\"), Found string \"User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10\n\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\"), Found string \"User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10\n\" (Indicator: \"user-agent: \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"RunDosCommand CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$39","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"Found string \"VaultEnumerateItems\" (Indicator: \"VaultEnumerateItems\"; Source: \"sample.bin\"), Found string \"VaultFree\" (Indicator: \"VaultFree\"; Source: \"sample.bin\"), Found string \"VaultOpenVault\" (Indicator: \"VaultOpenVault\"; Source: \"sample.bin\"), Found string \"VaultEnumerateVaults\" (Indicator: \"VaultEnumerateVaults\"; Source: \"sample.bin\"), Found string \"VaultCloseVault\" (Indicator: \"VaultCloseVault\"; Source: \"sample.bin\"), Found string \"VaultGetItemW7\" (Indicator: \"VaultGetItem\"; Source: \"sample.bin\"), Found string \"VaultGetItemW8\" (Indicator: \"VaultGetItem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.004","id":"string-627","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"\\logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"\\logins.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"bin.base64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"Expected a Base64 encoded PEM private key\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"base64Binary\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"Expected Base64 encoded PEM certificates\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"No X509 Base64 certificate found\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"Expected a Base64 encoded DH params\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"base64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"Rijndael\" (Indicator: \"rijndael\"; Source: \"sample.bin\"), Found string \"ECDSA Key Encryption\" (Indicator: \"ecdsa\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"can't resolve hostname to IP address\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"No route to host\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"WSocket Resolve Host: Invalid Hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"/c ipconfig /flushdns\" (Indicator: \"ipconfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"%AppData%\\Comodo\\IceDragon\" (Indicator: \"\\comodo\\\") in Source: sample.bin, \"MapleStudio\\ChromePlus\\User Data\\Default\" (Indicator: \"\\chromeplus\\\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \"\\Microsoft\\Windows\\INetCookies\" (Source: \"sample.bin\"), Found string \"\\Microsoft\\Windows\\INetCookies\\Low\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-692","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"%s SslHandshakeDone(%d) Error=%d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"Can't change HTTP proxy password if not closed\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"sample.bin\"), Found string \"'} WHERE AssocClass = Win32_LogicalDiskToPartition\" (Indicator: \" Win32_LogicalDisk\"; Source: \"sample.bin\"), Found string \"'} WHERE AssocClass = Win32_LogicalDiskToPartition\" (Indicator: \" Win32_LogicalDiskToPartition\"; Source: \"sample.bin\"), Found string \"'} WHERE AssocClass = Win32_DiskDriveToDiskPartition\" (Indicator: \" Win32_DiskDrive\"; Source: \"sample.bin\"), Found string \"'} WHERE AssocClass = Win32_DiskDriveToDiskPartition\" (Indicator: \" Win32_DiskDriveToDiskPartition\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-532","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"\\places.sqlite\" (Indicator: \"places.sqlite\"; Source: \"sample.bin\"), Found string \"\\formhistory.sqlite\" (Indicator: \"formhistory.sqlite\"; Source: \"sample.bin\"), Found string \"places.sqlite\" (Indicator: \"places.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query sqlite firefox history","description":"Found string \"delete from moz_places where id in (select place_id from moz_historyvisits) and id not in (select fk from moz_bookmarks where fk <>'') and (last_visit_date <= \" (Indicator: \"select <> from moz_\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-464","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"RunDosCommand TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"RunDosCommand TerminateProcess Over\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"TRecyclebinOpration.DeleteFileOrDir (OneDelMaxCount : %d, FileTotalCount : %d, GroupCount : %d)\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"TRecyclebinOpration.DeleteFileOrDir (1)\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"TRecyclebinOpration.DeleteFileOrDir (2)\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"TRecyclebinOpration.DeleteFileOrDir (3)\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"TRecyclebinOpration.DeleteFileOrDir Time: \" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"TRecyclebinOpration.DeleteFileOrDir (Except 1)\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeManageVolumePrivilege\" (Indicator: \"SeManageVolumePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonatePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonate\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\microsoft\\windows\\currentversion\\explorer\\clsid\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-344","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\Scsi\\SI%d1\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1485","id":"string-442","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"Insufficient Storage (WebDAV)\" (Indicator: \"webdav\"; Source: \"sample.bin\"), Found string \"Multi-Status (WebDAV)\" (Indicator: \"webdav\"; Source: \"sample.bin\"), Found string \"Unprocessable Entity (WebDAV)\" (Indicator: \"webdav\"; Source: \"sample.bin\"), Found string \"Failed Dependency (WebDAV)\" (Indicator: \"webdav\"; Source: \"sample.bin\"), Found string \"Locked (WebDAV)\" (Indicator: \"webdav\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-476","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3f","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://s1.driverboosterscan.com\", Found HTTPS url \"https://s2.driverboosterscan.com\", Found HTTPS url \"https://www.pcgameboost.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\", \"127.0.0.1\", \"0.0.0.0\", \"0.0.0.1\", \"4.2.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"Proxy server must support HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"HTTP/1.0 200 OK\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"/c ipconfig /flushdns\" (Indicator: \"/c ipconfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-325","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\shell folders\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-410","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"TTaskSchedulerInterfaces2.RegisterTask\" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"TTaskSchedulerInterfaces1.RegisterTask\" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"TTaskSchedulerInterfaces2.RegisterTask Leave\" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"TTaskSchedulerInterfaces1.RegisterTask Leave\" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"RegisterTask.exception : \" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"RegisterTask : \" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"RegisterTask.EOleException : \" (Indicator: \"RegisterTask\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053","id":"string-401","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from urls\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"select * from urls where (last_visit_time <= \" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\"), Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\"), Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"State = httpDnsLookup\" (Indicator: \"nslookup\"; Source: \"sample.bin\"), Found string \"DnsLookup: Window not assigned\" (Indicator: \"nslookup\"; Source: \"sample.bin\"), Found string \"State = httpDnsLookupDone\" (Indicator: \"nslookup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-430","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$40","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"delete from moz_cookies where host COLLATE NOCASE not in \" (Indicator: \"moz_cookies\"; Source: \"sample.bin\"), Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\"), Found string \"moz_cookies\" (Indicator: \"moz_cookies\"; Source: \"sample.bin\"), Found string \"Apple Computer\\Safari\\Cookies\\Cookies.binarycookies\" (Indicator: \"cookies.binarycookies\"; Source: \"sample.bin\"), Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set sslSESS_CACHE_SERVER\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set Security Level: \" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"sample.bin\"), Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; Source: \"sample.bin\"), Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-533","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindow SMGBDownloader false\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindow SMGBDownloader false\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve disk information","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"sample.bin\"), Found string \"'} WHERE AssocClass = Win32_DiskDriveToDiskPartition\" (Indicator: \" Win32_DiskDrive\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-514","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_DiskDrive\" (Indicator: \" win32_diskdrive\"; Source: \"sample.bin\"), \"'} WHERE AssocClass = Win32_LogicalDiskToPartition\" (Indicator: \" win32_logicaldisk\"; Source: \"sample.bin\"), \"'} WHERE AssocClass = Win32_DiskDriveToDiskPartition\" (Indicator: \" win32_diskdrive\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"\\places.sqlite\" (Source: \"sample.bin\"), Found string \"\\formhistory.sqlite\" (Source: \"sample.bin\"), Found string \"places.sqlite\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive%d; Source: \"sample.bin\"), Found string - \\\\.\\Scsi%d:; Source: \"sample.bin\"), Found string - \\\\.\\PhysicalDrive; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"sample.bin\"), Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"sample.bin\"), Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497","id":"string-253","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to modify scheduled task(s)","description":"Found string \"/c schtasks /Change /Disable /TN \"\\Microsoft\\Windows\\Defrag\\ScheduledDefrag\"\" (Indicator: \"schtasks /change\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1036.004","id":"string-630","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"truncated HMAC\" (Indicator: \"HMAC\"; Source: \"sample.bin\"), Found reference to \"Rijndael\" (Indicator: \"Rijndael\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$41","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\"), Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\"), Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WbemScripting.SWbemLocator\" (Indicator: \"wbemscripting.\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"Explorer.EXE\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win32_SmartGameBooster_A_potentially_unwanted_application Sample 08d167fca300… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 08d167fca300…. Malware family: Win32_SmartGameBooster_A_potentially_unwanted_application. Threat score 100/100. 2/25 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989"}],["$","meta","4",{"property":"og:title","content":"Malicious Win32_SmartGameBooster_A_potentially_unwanted_application Sample 08d167fca300… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 08d167fca300…. Malware family: Win32_SmartGameBooster_A_potentially_unwanted_application. Threat score 100/100. 2/25 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/08d167fca3002ad9500e0ba2bcb806913cbb9467ffb6b6ee42c23f2ec8845989"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win32_SmartGameBooster_A_potentially_unwanted_application Sample 08d167fca300… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 08d167fca300…. Malware family: Win32_SmartGameBooster_A_potentially_unwanted_application. Threat score 100/100. 2/25 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]] 32:null