24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T534,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Trojan.TangoStealer.Marte.A Sample 1157e29047fe… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1157e29047fe…. Malware family: Dump:Generic.Trojan.TangoStealer.Marte.A. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b","keywords":["Malicious","Dump:Generic.Trojan.TangoStealer.Marte.A","malware analysis","sandbox report","threat intelligence","1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b"],"about":{"@type":"SoftwareApplication","name":"1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Trojan.TangoStealer.Marte.A","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7cc,Found reference to API "WriteProcessMemory64From32" (Indicator: "WriteProcessMemory"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "[-] VirtualAlloc failed" (Indicator: "VirtualAlloc"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "[-] CreateThread failed" (Indicator: "CreateThread"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")26:Tdab,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetObjectForIUnknown" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeBSTR" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SystemMaxDBCSCharSize" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "OffsetOf" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt16" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReAllocHGlobal" in "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin"27:Tbda,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "TripleDES" (Indicator: "TripleDES"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "AesManaged" (Indicator: "Aes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "AesManaged" (Indicator: "AesManaged"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "AesGcm" (Indicator: "Aes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "AesGcm" (Indicator: "AesGcm"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")28:T784,"d__1" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "d__2" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "d__3" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "d__5" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "d__7" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "SendMessageAsync" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "SendMessageInfoAsync" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "+Stub.DiscordSendLogs+d__2" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "/Stub.DiscordSendLogs+d__3" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "'Stub.FtpSendLogs+d__5" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "+Stub.FtpSendLogs+d__7" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API ",Stub.TelegramSendLogs+d__2" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "0Stub.TelegramSendLogs+d__3" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "'Stub.UploadToFtp+d__1" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "Discord >> SendMessage exception:\n" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "/sendMessage?chat_id=" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "Telegram >> SendMessage exception:\n" (Indicator: "sendmessage"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")2e:T1169,"5__1" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpDeliveryMethod" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpPassword" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "UploadToSmtp" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpSender" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpReceiver" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpServer" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpSendLogs" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpClient" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpPort" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpCheckBox" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "(Stub.SmtpSendLogs+d__7" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "'Stub.SmtpSendLogs+d__8" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "(Stub.UploadToSmtp+d__8" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Program: Checking Smtp configuration..." (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Program: Invalid Smtp configuration, initiating self-destruct" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Program: Smtp configuration is valid" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Program: Error checking Smtp configuration:" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Sending logs to Smtp" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Logs Sent to Smtp" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Config: Begin Decrypting Smtp details" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpServer Decrypted: '" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpSender Decrypted: '" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpPassword Decrypted: '" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SmtpReceiver: '" (Indicator: "smtp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")46:Te87,"4.0.0.0" "11.0.0.0" "1.0.0.0" "10.200.169.204" "104.198.155.173" "104.200.151.35" "109.145.173.169" "109.226.37.172" "109.74.154.90" "109.74.154.91" "109.74.154.92" "140.228.21.36" "149.88.111.79" "154.61.71.50" "154.61.71.51" "172.105.89.202" "174.7.32.199" "176.63.4.179" "178.239.165.70" "181.214.153.11" "185.220.101.107" "185.44.176.125" "185.44.176.135" "185.44.176.143" "185.44.176.70" "185.44.176.85" "185.44.177.132" "185.44.177.133" "185.44.177.138" "185.44.177.193" "185.44.177.254" "185.44.177.55" "188.105.165.80" "188.105.71.44" "188.105.91.116" "188.105.91.143" "188.105.91.173" "191.101.209.39" "191.96.150.218" "192.211.110.74" "192.40.57.234" "192.87.28.103" "193.128.114.45" "193.225.193.201" "193.226.177.40" "194.110.13.70" "194.154.78.144" "194.154.78.152" "194.154.78.160" "194.154.78.169" "194.154.78.179" "194.154.78.210" "194.154.78.227" "194.154.78.230" "194.154.78.235" "194.154.78.77" "194.154.78.91" "194.186.142.178" "194.186.142.180" "194.186.142.183" "194.186.142.195" "194.186.142.204" "194.186.142.214" "194.186.142.236" "194.186.142.246" "195.181.175.103" "195.181.175.105" "195.228.105.39" "195.239.51.3" "195.239.51.42" "195.239.51.46" "195.239.51.59" "195.239.51.65" "195.239.51.73" "195.239.51.80" "195.239.51.89" "195.68.142.20" "195.68.142.3" "195.74.76.222" "2.94.86.134" "20.114.22.115" "20.99.160.173" "204.101.161.31" "204.101.161.32" "207.102.138.83" "207.102.138.93" "208.78.41.115" "209.127.189.74" "212.119.227.136" "212.119.227.151" "212.119.227.167" "212.119.227.179" "212.119.227.184" "212.41.6.23" "213.33.142.50" "213.33.190.109" "213.33.190.118" "213.33.190.171" "213.33.190.22" "213.33.190.227" "213.33.190.242" "213.33.190.35" "213.33.190.42" "213.33.190.46" "213.33.190.69" "213.33.190.74" "23.128.248.46" "34.105.0.27" "34.105.183.68" "34.105.72.241" "34.138.255.104" "34.138.96.23" "34.141.146.114" "34.141.245.25" "34.142.74.220" "34.145.195.58" "34.145.89.174" "34.17.49.70" "34.17.55.59" "34.253.248.228" "34.73.60.153" "34.83.46.130" "34.85.243.241" "34.85.253.170" "35.186.33.204" "35.192.93.107" "35.197.127.11" "35.199.6.13" "35.229.69.227" "35.237.47.12" "38.154.242.210" "45.8.148.171" "5.45.98.162" "52.250.30.131" "64.124.12.162" "67.218.111.202" "78.139.8.50" "79.104.209.109" "79.104.209.168" "79.104.209.172" "79.104.209.221" "79.104.209.231" "79.104.209.24" "79.104.209.249" "79.104.209.33" "79.104.209.36" "79.104.209.66" "80.211.0.97" "81.181.60.60" "84.147.54.113" "84.147.54.61" "84.147.56.249" "84.147.60.41" "84.147.60.52" "84.147.61.28" "84.147.62.12" "84.147.63.171" "84.147.63.236" "84.57.183.108" "84.57.200.69" "87.166.48.65" "87.166.50.1" "87.166.50.213" "87.166.51.209" "88.132.225.100" "88.132.226.203" "88.132.227.238" "88.132.231.71" "88.153.199.169" "88.64.35.141" "88.64.36.101" "88.66.107.75" "88.66.111.235" "88.66.8.175" "88.67.131.90" "88.67.134.91" "88.86.117.130" "89.208.29.106" "89.208.29.108" "89.208.29.140" "89.208.29.149" "89.208.29.63" "89.208.29.64" "89.208.29.95" "89.208.29.96" "89.208.29.97" "89.208.29.98" "92.211.109.160" "92.211.192.144" "92.211.52.62" "92.211.55.199" "93.216.75.209" "95.25.204.90" "95.25.71.112" "95.25.71.12" "95.25.71.5" "95.25.71.64" "95.25.71.65" "95.25.71.70" "95.25.71.80" "95.25.71.86" "95.25.71.87" "95.25.71.89" "95.25.71.92" "95.25.81.24" Potential IP "64.124.12.162" found in string "250-sky.superhosting.bg Hello DESKTOP-FVVF82A [64.124.12.162]250-SIZE 52428800250-LIMITS MAILMAX=1000 RCPTMAX=50000250-8BITMIME250-PIPELINING250-PIPECONNECT250-AUTH PLAIN LOGIN250 HELP"47:T898,"5__2" (Indicator: "zipfile"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "5__2" (Indicator: "base64"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "DecryptBase64" (Indicator: "base64"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "AesManaged" (Indicator: "aes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "FromBase64String" (Indicator: "base64"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "zipFilePath" (Indicator: "zipfile"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "CryptoStream" (Indicator: "cryptostream"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "AesGcm" (Indicator: "aes"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[-] Invalid Base64 format" (Indicator: "base64"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "base64" (Indicator: "base64"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")49:T457,Found reference to API "GetModuleHandle64" (Indicator: "GetModuleHandle"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")4a:T617,Found string "_password" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Mailpassword" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "password_hex" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "password_value" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Chromium_passwords_" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "password" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "password-check" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Gecko_passwords_" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "Wifi - GetPassword: Failed to retrieve password for profile '" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "- Saved networks with passwords:" (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "No WinSCP sessions found or master password is enabled." (Indicator: "password"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")4b:Tb3d,Found string "[TAB]" (Indicator: "[tab]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[BACKSPACE]" (Indicator: "[BACKSPACE]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[ESC]" (Indicator: "[esc]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[PAGEUP]" (Indicator: "[PageUp]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[PAGEDOWN]" (Indicator: "[Pagedown]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[END]" (Indicator: "[end]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[HOME]" (Indicator: "[home]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[LEFT]" (Indicator: "[left]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[RIGHT]" (Indicator: "[right]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[DOWN]" (Indicator: "[down]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[PRINTSCREEN]" (Indicator: "[PrintScreen]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[INSERT]" (Indicator: "[insert]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[DELETE]" (Indicator: "[Delete]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[SCROLLLOCK]" (Indicator: "[ScrollLock]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[NUMLOCK]" (Indicator: "[NumLock]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[F10]" (Indicator: "[F10]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[F11]" (Indicator: "[F11]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[F12]" (Indicator: "[F12]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[SHIFT]" (Indicator: "[shift]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[CTRL]" (Indicator: "[ctrl]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[CTRL]" (Indicator: "[Ctrl]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[ALT]" (Indicator: "[alt]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "[ALT]" (Indicator: "[Alt]"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")4c:T4a9,Found string "SystemInfo >> GetPublicIP : Request error" (Indicator: "systeminfo"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "hostname" (Indicator: "hostname"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "chcp 65001" (Indicator: "chcp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "SystemInfo >> GetPublicIP : Request error\n" (Indicator: "systeminfo"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "chcp 65001 && netsh wlan show profile | findstr All" (Indicator: "chcp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found string "chcp 65001 && netsh wlan show profile name=\"" (Indicator: "chcp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin"), Found string "chcp 65001 && netsh wlan show networks mode=bssid" (Indicator: "chcp"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin"), Found string "HostName" (Indicator: "hostname"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")4d:T4eb,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin")4e:T9e5,"> GetPublicIP : Request error\" (Indicator: \"systeminfo \"; File: \"1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin\")\n Found string \"SystemInfo >> GetPublicIP : Request error\\n\" (Indicator: \"systeminfo \"; File: \"1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 6d81de3e2b745c7faa109dc4a3f8492f-6000216-SharpInjector~GetProcessHandleWithRequiredRights\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 6d81de3e2b745c7faa109dc4a3f8492f-6000217-SharpInjector~IsProcess64Bit\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 6d81de3e2b745c7faa109dc4a3f8492f-60002c6-Utils~IsProcessAdmin\n Stub.NativeMethods::OpenProcessToken(System.IntPtr,System.UInt32,System.IntPtr&) at 6d81de3e2b745c7faa109dc4a3f8492f-60002c7-Utils~IsProcessAdmin\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 6d81de3e2b745c7faa109dc4a3f8492f-60002cc-Utils~DupHandle\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 6d81de3e2b745c7faa109dc4a3f8492f-60002cf-Utils~KillProcess","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 1157e29047fe44576bdaed5bda75bbbc6e047b980ccdcaccd336fb12a9e0cb3b.bin","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$31","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Mon\n 16 Feb 2026 15:34:50 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nCF-RAY: 9cee1c830c708188-SJC\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET\nSet-Cookie: __cf_bm=ecYj0gDZKnA1NzzvZafOTGFxHWfbo.KRbJ8ZP3AEOcE-1771256090-1.0.1.1-Tt5mq_mwQQoJDfZeZOo0zOpqfshMthrID4jVLqEH7qZpyiW0p7YO9BVz76OyUUakT75WZuxr8GtArGt99UcvPmNNiN7mboV4tSLwfBNZVRQ; path=/; expires=Mon\n 16-Feb-26 16:04:50 GMT; domain=.icanhazip.com; HttpOnly\nServer: cloudflare\nalt-svc: h3=\":443\"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"699338ec9918032b18003bef"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"