24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Tedy.Generic Sample 1ba40977145d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1ba40977145d…. Malware family: Adware.Tedy.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 14 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd","keywords":["Malicious","Adware.Tedy.Generic","malware analysis","sandbox report","threat intelligence","1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Tedy.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tcac,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Release" in "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "svca.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "svca.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "svca.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "svca.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "svca.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "svca.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "svca.exe.bin"26:Td1e,Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp")27:T590," nul" (Indicator: "ping"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "Hostname" (Indicator: "hostname"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "Route" (Indicator: "route"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp")4b:Te65,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001084.00000000.211648.030C0000.00000004.mdmp") Found string "ECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001084.00000000.211648.030C0000.00000004.mdmp") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003200.00000000.202174.02F30000.00000004.mdmp, 00000000-00003200.00000001.204093.02F30000.00000004.mdmp, 00000000-00003200.00000002.206016.02F30000.00000004.mdmp") Found string "ECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003200.00000000.202174.02F30000.00000004.mdmp") Found string "ECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003200.00000000.202174.02F30000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003200.00000000.202174.02F30000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003200.00000000.202174.02F30000.00000004.mdmp") Found string "ELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "ELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "ELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "elect * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "ELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp") Found string "ELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003200.00000001.204093.00932000.00000002.mdmp")4c:T988,"k__BackingField\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\n \"get_CountryCode\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\n \"set_CountryCode\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\n \"countrycode\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\n \"CountryCode\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\n \"countryCode\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\n \"Response//CountryCode\" (Indicator: \"countrycode\") in Source: 1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"철삍籛⍾ᇈ᠅㯥夰ᙦ瀁飯迂欖㊢ᨤ쒮Ᾱा潼::䲖靎ꊨ㾑⽧؂䅙⟩빭䎲隂쾞볥槞ꇋ寒侶ম떐(xClient.Core.Packets.ServerPackets.GetSystemInfo,母라琔떬砃�겏㒏误魡࢐곟맚⼺顅A) at d76311e02288ea1c088f56ee1bdc5961-60002cd-_~_\n 母라琔떬砃�겏㒏误魡࢐곟맚⼺顅A::狽⸀͟豶虒⍎焖㖂۹ᗄ峺爈₣숤ﻹ⩢䀞�悉(xClient.Core.Packets.ServerPackets.GetSystemInfo) at d76311e02288ea1c088f56ee1bdc5961-600036a-GetSystemInfo~Execute\n xClient.Core.Packets.ClientPackets.GetSystemInfoResponse::set_SystemInfos(System.String[]) at d76311e02288ea1c088f56ee1bdc5961-600049c-ctor\n 母라琔떬砃�겏㒏误魡࢐곟맚⼺顅A::狽⸀͟豶虒⍎焖㖂۹ᗄ峺爈₣숤ﻹ⩢䀞�悉(xClient.Core.Packets.ClientPackets.GetSystemInfoResponse) at d76311e02288ea1c088f56ee1bdc5961-600049d-GetSystemInfoResponse~Execute\n xClient.Core.Packets.ClientPackets.GetSystemInfoResponse::Execute(母라琔떬砃�겏㒏误魡࢐곟맚⼺顅A) at d76311e02288ea1c088f56ee1bdc5961-60006cc-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"svca.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Fri\n 29 May 2026 01:26:46 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 277\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322.......\n \"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Fri\n 29 May 2026 01:26:49 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 277\nAccess-Control-Allow-Origin: *\nX-Ttl: 56\nX-Rl: 43 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"), Found string \"ping -n 10 localhost > nul\" (Indicator: \"ping -\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"svca.exe.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"svca.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping -n 10 localhost > nul\" (Indicator: \"ping \"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002500-00000C2B-2154490046\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /json/\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002500-00000C2B-2154489917\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002500-00000C2B-2154608992\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002500-00000C2B-2154609016\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00003200-00000C2B-2159499159\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$46","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"\n Observed namespace \"System.Net\" in \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00002500-00000C2B-2154489917\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"12.0.0.0\"\n \"1.3.0.0\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" />\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Culture=neutral\n Pu\", Potential IP \"4.0.0.0\" found in string \"ternals\n4.0.0.0\n\n31b\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://sche\"\n Pattern match: \"mas.microsoft.com/smi/2005/windowssettings\"\n Pattern match: \"http://freegeoip.net/xml/\"\n Pattern match: \"http://api.ipify.org/\"\n Heuristic match: \"ip-api.com\"\n Pattern match: \"http://ip-api.com/json/\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Heuristic match: \"mb.bn\"\n Heuristic match: \"stem.co\"\n Heuristic match: \"ystem.co\"\n Heuristic match: \"rm.co\"\n Heuristic match: \"g`.bi\"\n Heuristic match: \"th.th\"\n Heuristic match: \"#i.bn\"\n Pattern match: \"ip-api.com/json/\"\n Pattern match: \"freegeoip.net/xml/\"\n Heuristic match: \"pathext=.cg\"\n Heuristic match: \"fll0v.ni\"\n Heuristic match: \"cim_system.name\"\n Heuristic match: \"mif.dm\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$47","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001084.00000000.211648.030C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")\n Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"[Esc]

\" (Indicator: \"[esc]\"; File: \"1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd.bin\")\n Found string \"p class=\"h\">[Esc]

\" (Indicator: \"[esc]\"; Source: \"00000000-00003200.00000001.204093.00932000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a18eb3de307e71371039c02"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"